Abstract:Threat modeling has emerged as a key process for understanding relevant threats within businesses. However, understanding the importance of threat events is rarely driven by the business incorporating the system. Furthermore, prioritization of threat events often occurs based on abstract and qualitative scoring. While such scores enable prioritization, they do not allow the results to be easily interpreted by decision-makers. This can hinder downstream activities, such as discussing security investments and a security control's economic applicability. This article introduces QuantTM, an approach that incorporates views from operational and strategic business representatives to collect threat information during the threat modeling process to measure potential financial loss incurred by a specific threat event. It empowers the analysis of threats' impacts and the applicability of security controls, thus supporting the threat analysis and prioritization from an economic perspective. QuantTM comprises an overarching process for data collection and aggregation and a method for business impact analysis. The performance and feasibility of the QuantTM approach are demonstrated in a real-world case study conducted in a Swiss SME to analyze the impacts of threats and economic benefits of security controls. Secondly, it is shown that employing business impact analysis is feasible and that the supporting prototype exhibits great usability.

Quantitative Security Evaluation Model for Security Management

A Model Divides the Mobile Security Level Based on SVM

Research on Information Security Model and Security System Design

Quantitative Hierarchical Threat Evaluation Model for Network Security

Quantitative and Qualitative Support for Non-Functional Requirements in Stock Trading Systems

Power Information Systems Security: Modeling and Quantitative Evaluation

Multiple behavior information fusion based quantitative threat evaluation

A Framework of Quantitative Analysis for Information System Survivability

RESEARCH AND IMPLEMENTATION OF MODEL OF INFORMATION SECURITY EVALUATION

Study of Security Metrics of Software System for Comparative Evaluation

An Information System Security Evaluation Method Based on FCME Model

Quantifying and Calculating Security of Software Component Based on Decomposition of Security Attributes

A Stochastic Model for Quantitative Security Analyses of Networked Systems.

Approach to Security Evaluation Based on Rough Set Theory for Host Computer

Business Activity-Oriented Security Model of Information Systems

Towards Quantifying the (in)security of Networked Systems.

A Quantitative Security Architecture Design Method for Power Information System

An risk measurement model for assessing information systems

Network Security Evaluation Model Based on Cloud Computing.

Study on Evaluation for Security Situation of Networked Systems

QuantTM: Business-Centric Threat Quantification for Risk Management and Cyber Resilience