Abstract:Addressing cyber and privacy risks has never been more critical for organisations. While a number of risk assessment methodologies and software tools are available, it is most often the case that one must, at least, integrate them into a holistic approach that combines several appropriate risk sources as input to risk mitigation tools. In addition, cyber risk assessment primarily investigates cyber risks as the consequence of vulnerabilities and threats that threaten assets of the investigated infrastructure. In fact, cyber risk assessment is decoupled from privacy impact assessment, which aims to detect privacy-specific threats and assess the degree of compliance with data protection legislation. Furthermore, a Privacy Impact Assessment (PIA) is conducted in a proactive manner during the design phase of a system, combining processing activities and their inter-dependencies with assets, vulnerabilities, real-time threats and Personally Identifiable Information (PII) that may occur during the dynamic life-cycle of systems. In this paper, we propose a cyber and privacy risk management toolkit, called AMBIENT (Automated Cyber and Privacy Risk Management Toolkit) that addresses the above challenges by implementing and integrating three distinct software tools. AMBIENT not only assesses cyber and privacy risks in a thorough and automated manner but it also offers decision-support capabilities, to recommend optimal safeguards using the well-known repository of the Center for Internet Security (CIS) Controls. To the best of our knowledge, AMBIENT is the first toolkit in the academic literature that brings together the aforementioned capabilities. To demonstrate its use, we have created a case scenario based on information about cyber attacks we have received from a healthcare organisation, as a reference sector that faces critical cyber and privacy threats.

Man-at-the-End Software Protection as a Risk Analysis Process

Design, Implementation, and Automation of a Risk Management Approach for Man-at-the-End Software Protection

Evaluation Methodologies in Software Protection Research

Advanced Software Protection Now

M-STAR: A Modular, Evidence-based Software Trustworthiness Framework

A model-driven approach for vulnerability evaluation of modern physical protection systems

Automated Cyber and Privacy Risk Management Toolkit

A novel STPA approach to software safety and security in autonomous maritime systems

Extended Report on the Obfuscated Integration of Software Protections

Software Safety Demonstration and Idemnification

ARES: Automated Risk Estimation in Smart Sensor Environments

An Introduction to Adaptive Software Security

Identifying and Quantifying Trade-offs in Multi-Stakeholder Risk Evaluation with Applications to the Data Protection Impact Assessment of the GDPR

Using POMDP-based Approach to Address Uncertainty-Aware Adaptation for Self-Protecting Software

SMART: a Technology Readiness Methodology in the Frame of the NIS Directive

Machine Learning Based Approach to Recommend MITRE ATT&CK Framework for Software Requirements and Design Specifications

Finding Security Threats That Matter: An Industrial Case Study

An integrated risk measurement and optimization model for trustworthy software process management

Moving Target Defense for Web Applications using Bayesian Stackelberg Games

A Methodology to Support Automatic Cyber Risk Assessment Review

Towards a More Systematic Approach to Secure Systems Design and Analysis