Cyber risk assessment model for information assets: a tailored approach for the financial and banking sector

Amir Schreiber,Israel Waismel-Manor

DOI: https://doi.org/10.21314/jop.2024.006

IF: 0.645

2024-11-07

The Journal of Operational Risk

Abstract:The authors present a novel model risk assessment model designed specifically for cyber risks and information assets,

business, finance

What problem does this paper attempt to address?

Cyber Risk Assessment for Capital Management

Wing Fung Chong,Runhuan Feng,Hins Hu,Linfeng Zhang

2023-10-23

Abstract:Cyber risk is an omnipresent risk in the increasingly digitized world that is known to be difficult to manage. This paper proposes a two-pillar cyber risk management framework to address such difficulty. The first pillar, cyber risk assessment, blends the frequency-severity model in insurance with the cascade model in cybersecurity, to capture the unique feature of cyber risk. The second pillar, cyber capital management, provides informative decision-making on a balanced cyber risk management strategy, which includes cybersecurity investments, insurance coverage, and reserves. This framework is demonstrated by a case study based on a historical cyber incident dataset, which shows that a comprehensive cost-benefit analysis is necessary for a budget-constrained company with competing objectives for cyber risk management. Sensitivity analysis also illustrates that the best strategy depends on various factors, such as the amount of cybersecurity investments and the effectiveness of cybersecurity controls.

Risk Management,Cryptography and Security,Optimization and Control
A comprehensive model for cyber risk based on marked point processes and its application to insurance

Gabriela Zeller,Matthias Scherer

DOI: https://doi.org/10.1007/s13385-021-00290-1

2021-08-17

European Actuarial Journal

Abstract:Abstract After scrutinizing technical, legal, financial, and actuarial aspects of cyber risk, a new approach for modelling cyber risk using marked point processes is proposed. Key covariates, required to model frequency and severity of cyber claims, are identified. The presented framework explicitly takes into account incidents from malicious untargeted and targeted attacks as well as accidents and failures. The resulting model is able to include the dynamic nature of cyber risk, while capturing accumulation risk in a realistic way. The model is studied with respect to its statistical properties and applied to the pricing of cyber insurance and risk measurement. The results are illustrated in a simulation study.
FINANCIAL TECHNOLOGY RISK MANAGEMENT MODELS

D.A. Kurmanova,D.R. Sultangareev,L.R. Khabibullina,,,

DOI: https://doi.org/10.17122/2541-8904-2020-2-32-82-91

2020-01-01

Bulletin USPTU Science education economy Series economy

Abstract:Cyber incidents continue to move up in the rating of possible threats and occupy the second position in the ranking of risks in the activities of companies (40 %). Five years ago, they were on the fifteenth line. Like a natural disaster or pandemic, a cyber attack can have a negative impact on hundreds of companies, and the number of such incidents is growing. So-called "cyber incidents",when hackers interfere with the activities of a large number of companies, using the dependencies of their shared Internet infrastructure, occur more often. This reflects the fact that today's world of risk management is more volatile than ever. At the same time, with the upcoming entry into force of the General data protection regulation (GDPR), which has been in effect throughout Europe since may 2018, the prospects of imposing more and larger fines on companies that do not comply with it have already become real. Actions taken by the company in light of a data integrity violation directly affect the final cost of such a violation. Reputational damage is inevitable if the response to a cyber incident is inadequate. New risks require new tools to respond to their potential impacts and mitigate them. This article discusses the possible risks of financial technologies, draws attention to cyber threats, the frequency of which is increasing, and offers a model for identifying and evaluating cyber risks.
Capital Requirements for Cyber Risk and Cyber Risk Insurance: An Analysis of Solvency II, the U.S. Risk-Based Capital Standards, and the Swiss Solvency Test

Martin Eling,Werner Schnell

DOI: https://doi.org/10.1080/10920277.2019.1641416

2019-10-30

North American Actuarial Journal

Abstract:Cyber risk is becoming more significant for insurance companies in both underwriting and operational risk terms, but the characteristics of cyber risk are still not yet well understood. We contribute to the literature by analyzing the role of cyber risk in insurance regulation frameworks. The aggregated cyber risk exposure of an insurer is estimated by fitting different marginal distributions and dependence models to historical cyber losses. This aggregated cyber exposure allows us to derive the insurer's survival probability and compare it with the goals of regulatory frameworks, such as the U.S. Risk Based Capital (RBC) or Solvency II (SII). Our findings indicate that regulatory models underestimate the potential risks associated with cyber threats. This is especially true for small cyber insurance portfolios, which are predominant in practice today. Regulatory models should be adapted to account for the heavy tails and dependence structure specific to cyber risks, instead of assuming "one size fits all."

English Else
Mind the Gap: Securely modeling cyber risk based on security deviations from a peer group

Taylor Reynolds,Sarah Scheffler,Daniel J. Weitzner,Angelina Wu

2024-02-07

Abstract:There are two strategic and longstanding questions about cyber risk that organizations largely have been unable to answer: What is an organization's estimated risk exposure and how does its security compare with peers? Answering both requires industry-wide data on security posture, incidents, and losses that, until recently, have been too sensitive for organizations to share. Now, privacy enhancing technologies (PETs) such as cryptographic computing can enable the secure computation of aggregate cyber risk metrics from a peer group of organizations while leaving sensitive input data undisclosed. As these new aggregate data become available, analysts need ways to integrate them into cyber risk models that can produce more reliable risk assessments and allow comparison to a peer group. This paper proposes a new framework for benchmarking cyber posture against peers and estimating cyber risk within specific economic sectors using the new variables emerging from secure computations. We introduce a new top-line variable called the Defense Gap Index representing the weighted security gap between an organization and its peers that can be used to forecast an organization's own security risk based on historical industry data. We apply this approach in a specific sector using data collected from 25 large firms, in partnership with an industry ISAO, to build an industry risk model and provide tools back to participants to estimate their own risk exposure and privately compare their security posture with their peers.

Cryptography and Security,Computers and Society,General Economics,Applications
A Framework for Digital Asset Risks with Insurance Applications

Zhengming Li,Jianxi Su,Maochao Xu,Jimmy Yuen

2024-08-30

Abstract:The remarkable growth of digital assets, starting from the inception of Bitcoin in 2009 into a 1 trillion market in 2024, underscores the momentum behind disruptive technologies and the global appetite for digital assets. This paper develops a framework to enhance actuaries' understanding of the cyber risks associated with the developing digital asset ecosystem, as well as their measurement methods in the context of digital asset insurance. By integrating actuarial perspectives, we aim to enhance understanding and modeling of cyber risks at both the micro and systemic levels. The qualitative examination sheds light on blockchain technology and its associated risks, while our quantitative framework offers a rigorous approach to modeling cyber risks in digital asset insurance portfolios. This multifaceted approach serves three primary objectives: i) offer a clear and accessible education on the evolving digital asset ecosystem and the diverse spectrum of cyber risks it entails; ii) develop a scientifically rigorous framework for quantifying cyber risks in the digital asset ecosystem; iii) provide practical applications, including pricing strategies and tail risk management. Particularly, we develop frequency-severity models based on real loss data for pricing cyber risks in digit assets and utilize Monte Carlo simulation to estimate the tail risks, offering practical insights for risk management strategies. As digital assets continue to reshape finance, our work serves as a foundational step towards safeguarding the integrity and stability of this rapidly evolving landscape.

Applications,Computational Engineering, Finance, and Science
Modeling and Pricing Cyber Insurance -- Idiosyncratic, Systematic, and Systemic Risks

Kerstin Awiszus,Thomas Knispel,Irina Penner,Gregor Svindland,Alexander Voß,Stefan Weber

DOI: https://doi.org/10.48550/arXiv.2209.07415

2022-08-18

Risk Management

Abstract:The paper provides a comprehensive overview of modeling and pricing cyber insurance and includes clear and easily understandable explanations of the underlying mathematical concepts. We distinguish three main types of cyber risks: idiosyncratic, systematic, and systemic cyber risks. While for idiosyncratic and systematic cyber risks, classical actuarial and financial mathematics appear to be well-suited, systemic cyber risks require more sophisticated approaches that capture both network and strategic interactions. In the context of pricing cyber insurance policies, issues of interdependence arise for both systematic and systemic cyber risks; classical actuarial valuation needs to be extended to include more complex methods, such as concepts of risk-neutral valuation and (set-valued) monetary risk measures.
Cyber risk frequency, severity and insurance viability

Matteo Malavasi,Gareth W. Peters,Pavel V. Shevchenko,Stefan Trück,Jiwook Jang,Georgy Sofronov

DOI: https://doi.org/10.1016/j.insmatheco.2022.05.003

2022-09-01

Insurance: Mathematics and Economics

Abstract:In this study an exploration of insurance risk transfer is undertaken for the cyber insurance industry in the United States of America, based on the leading industry dataset of cyber events provided by Advisen. We seek to address two core unresolved questions. First, what factors are the most significant covariates that may explain the frequency and severity of cyber loss events and are they heterogeneous over cyber risk categories? Second, is cyber risk insurable in regards to the required premiums, risk pool sizes and how would this decision vary with the insured companies industry sector and size? We address these questions through a combination of regression models based on the class of Generalized Additive Models for Location Shape and Scale (GAMLSS) and a class of ordinal regressions. These models will then form the basis for our analysis of frequency and severity of cyber risk loss processes. We investigate the viability of insurance for cyber risk using a utility modeling framework with premiums calculated by classical certainty equivalence analysis utilizing the developed regression models. Our results provide several new key insights into the nature of insurability of cyber risk and rigorously address the two insurance questions posed in a real data driven case study analysis.

English Else
Pricing cyber-insurance for systems via maturity models

Henry Skeoch,David Pym

DOI: https://doi.org/10.48550/arXiv.2302.04734

2023-02-09

General Economics

Abstract:Risks associated with information technology systems present a complex modelling challenge, combining the disciplines of operations management, security, and economics. The challenge is to establish a representation of an organization's operational and systems architecture that allows an assessment of the security postures of its various components able to support an assessment of its insurance risk. This work proposes a socioeconomic model for cyber-insurance decisions compromised of entity relationship diagrams, security maturity models, and economic models, thereby linking systems-type and economic approaches to cyber-security assessments. The concept of a cyber-loss-adjuster is introduced, who reconciles cyber-incidents with economic losses. The work aims to bridge a number of disciplines to partly address a longstanding research challenge of accounting for organizational structure in the design and pricing of cyber-insurance. It is important to note the following: insurance companies have long experience of the magnitude and frequency of losses that arise in organizations based on their size, industry sector, and location. Consequently, their calculations of premia will start from a baseline determined by these considerations. The contribution of the methodology proposed here is to provide a framework for calculating the effects of cyber-based risk on the frequency and magnitude of losses. This is achieved through a security analysis of the relationship between the operational structure of an organization and its information systems. It also provides a consistent means for those seeking insurance to describe and understand their security posture and for an insurance company to price its offer of coverage.
Cyber risk modeling: a discrete multivariate count process approach

Yang Lu,Jinggong Zhang,Wenjun Zhu

DOI: https://doi.org/10.1080/03461238.2023.2289374

IF: 1.7821

2024-01-04

Scandinavian Actuarial Journal

Abstract:In the past decade, cyber risk has raised much interest in the economy, and cyber risk has evolved from a type of pure operational risk to both operational and liability risk. However, the modeling of cyber risk is still in its infancy. Compared with other financial risks, cyber risk has some unique features. In particular, discrete variables regularly arise both in the frequency component (e.g. number of events per unit time), and the severity component (e.g. the number of data breaches for each cyber event). In addition, the modeling of these count variables are further complicated by nonstandard properties such as zero inflation, serial and cross-sectional correlations, as well as heavy tails. Previous cyber risk models have largely focused on continuous models that are incompatible with many of these characteristics. This paper introduces a new count-based frequency-severity framework to model cyber risk, with a dynamic multivariate negative binomial autoregressive process for the frequency component, and the generalized Poisson inverse-Gaussian distribution for the severity component. We unify these new modeling tools by proposing a tractable Generalized Method of Moments for their estimation and applying them to the Privacy Rights Clearinghouse (PRC) dataset.

social sciences, mathematical methods,mathematics, interdisciplinary applications,statistics & probability
Calculating Strategic Risk in Financial Institutions

Tomer Kedarya,Amir Elalouf,Rafael Sherbu Cohen

DOI: https://doi.org/10.1007/s40171-023-00342-3

2023-05-27

Global Journal of Flexible Systems Management

Abstract:Banks face many intangible hazards that are difficult to calculate. Strategic risk is one of the most critical factors affecting a bank's profitability, financial strength, and commercial success. The impact of risk on profit may be insignificant in the short term. Still, it may become highly significant in the medium and long term, with the potential to cause substantial financial losses and impair bank stability. Hence, strategic risk management is an important endeavor that must be carried out according to the rules set out under the Basel II framework. Analysis of strategic risk is a relatively new research enterprise. The current literature addresses the need to manage this risk and links it to the concept of economic capital, the amount of capital that a company should hold to survive such a risk. However, an action plan has yet to be produced. This paper attempts to address this gap by providing a mathematical analysis of the probability and effect of different strategic risk factors. Specifically, we develop a methodology for calculating a metric of strategic risk in terms of a bank's risk assets. Furthermore, we suggest a way of integrating this metric into the calculation of the capital adequacy ratio.
Disentangling the sources of cyber risk premia

Loïc Maréchal,Nathan Monnet

2024-09-13

Abstract:We use a methodology based on a machine learning algorithm to quantify firms' cyber risks based on their disclosures and a dedicated cyber corpus. The model can identify paragraphs related to determined cyber-threat types and accordingly attribute several related cyber scores to the firm. The cyber scores are unrelated to other firms' characteristics. Stocks with high cyber scores significantly outperform other stocks. The long-short cyber risk factors have positive risk premia, are robust to all factors' benchmarks, and help price returns. Furthermore, we suggest the market does not distinguish between different types of cyber risks but instead views them as a single, aggregate cyber risk.

Portfolio Management,Machine Learning
Cyber Security in Cloud: Risk Assessment Models

Carlos Bendicho

DOI: https://doi.org/10.1007/978-3-030-80119-9_28

2021-06-19

Abstract:The present paper shows a proposal of the characteristics Cloud Risk Assessment Models should have and presents the review of the literature considering those characteristics in order to identify current gaps. This work shows a ranking of Cloud RA models and their degree of compliance with the theoretical reference Cloud Risk Assessment model. The review of literature shows that RA approaches leveraging CSA (Cloud Security Alliance) STAR Registry that have into account organizations security requirements present higher degree of compliance, but they still lack risk economic quantification. The myriad of conceptual models, methodologies and frameworks although based on current NIST SP 800:30, ISO 27001, ISO 27005, ISO 30001, ENISA standards could be enhanced by the use of techno-economic models like UTEM, created by the author, in order to conceive more simplified models for effective Risk Assessment and Mitigation closer to the theoretical reference model for Cloud Risk Assessment, available for all cloud models (IaaS, PaaS, SaaS) and easy to use for all stakeholders.

Networking and Internet Architecture,Cryptography and Security
Cyber risk management in the US banking and insurance industry: A textual and empirical analysis of determinants and value

Nadine Gatzert,Madeline Schubert

DOI: https://doi.org/10.1111/jori.12381

2022-05-23

Abstract:In this paper, we first construct a cyber risk consciousness score using a text mining algorithm, applied to annual reports of large‐ and mid‐cap US banks and insurers from 2011 to 2018. We next categorize the firms' cyber risk management based on keywords to study determinants and value‐relevance. Our results show an increasing cyber risk consciousness, regardless of the industry. In addition, for the entire sample we find that firms belonging to the banking industry, with a higher cyber risk consciousness score and a higher general risk awareness are more likely to implement cyber risk management, which also holds for both industries separately. We find the opposite in the case of profitable firms for the entire sample and the insurer subsample. Finally, we observe a significant positive relationship between cyber risk management and firm value measured by Tobin's Q for the entire sample and the subsamples of banks and insurers.

economics,business, finance
Cyber risk and cybersecurity: a systematic review of data availability

Frank Cremer,Barry Sheehan,Michael Fortmann,Arash N Kia,Martin Mullins,Finbarr Murphy,Stefan Materne

DOI: https://doi.org/10.1057/s41288-022-00266-6

Abstract:Cybercrime is estimated to have cost the global economy just under USD 1 trillion in 2020, indicating an increase of more than 50% since 2018. With the average cyber insurance claim rising from USD 145,000 in 2019 to USD 359,000 in 2020, there is a growing necessity for better cyber information sources, standardised databases, mandatory reporting and public awareness. This research analyses the extant academic and industry literature on cybersecurity and cyber risk management with a particular focus on data availability. From a preliminary search resulting in 5219 cyber peer-reviewed studies, the application of the systematic methodology resulted in 79 unique datasets. We posit that the lack of available data on cyber risk poses a serious problem for stakeholders seeking to tackle this issue. In particular, we identify a lacuna in open databases that undermine collective endeavours to better manage this set of risks. The resulting data evaluation and categorisation will support cybersecurity researchers and the insurance industry in their efforts to comprehend, metricise and manage cyber risks. Supplementary information: The online version contains supplementary material available at 10.1057/s41288-022-00266-6.
Modeling Cybersecurity Risk: The Integration of Decision Theory and Pivot Pairwise Relative Criteria Importance Assessment with Scale for Cybersecurity Threat Evaluation

Aleksandar Šijan,Dejan Viduka,Luka Ilić,Bratislav Predić,Darjan Karabašević

DOI: https://doi.org/10.3390/electronics13214209

IF: 2.9

2024-10-27

Electronics

Abstract:This paper presents a comprehensive model for cyber security risk assessment using the PIPRECIA-S method within decision theory, which enables organizations to systematically identify, assess and prioritize key cyber threats. The study focuses on the evaluation of malware, ransomware, phishing and DDoS attacks, using criteria such as severity of impact, financial losses, ease of detection and prevention, impact on reputation and system recovery. This approach facilitates decision making, as it enables the flexible adaptation of the risk assessment to the specific needs of an organization. The PIPRECIA-S model has proven to be useful for identifying the most critical threats, with a special emphasis on ransomware and DDoS attacks, which represent the most significant risks to businesses. This model provides a framework for making informed and strategic decisions to reduce risk and strengthen cyber security, which are critical in a digital environment where threats become more and more sophisticated.

engineering, electrical & electronic,computer science, information systems,physics, applied
Asset criticality and risk prediction for an effective cybersecurity risk management of cyber-physical system

Halima Ibrahim Kure,Shareeful Islam,Mustansar Ghazanfar,Asad Raza,Maruf Pasha

DOI: https://doi.org/10.1007/s00521-021-06400-0

2021-08-11

Neural Computing and Applications

Abstract:Risk management plays a vital role in tackling cyber threats within the cyber-physical system (CPS). It enables identifying critical assets, vulnerabilities and threats and determining suitable proactive control measures for the risk mitigation. However, due to the increased complexity of the CPS, cyber-attacks nowadays are more sophisticated and less predictable, which makes risk management task more challenging. This paper aims for an effective cybersecurity risk management (CSRM) practice using assets criticality, predication of risk types and evaluating the effectiveness of existing controls. We follow a number of techniques for the proposed unified approach including fuzzy set theory for the asset criticality, machine learning classifiers for the risk predication and comprehensive assessment model (CAM) for evaluating the effectiveness of the existing controls. The proposed approach considers relevant CSRM concepts such as asset, threat actor, attack pattern, tactic, technique and procedure (TTP), and controls and maps these concepts with the VERIS community dataset (VCDB) features for the risk predication. The experimental results reveal that using the fuzzy set theory in assessing assets criticality supports stakeholder for an effective risk management practice. Furthermore, the results have demonstrated the machine learning classifiers exemplary performance to predict different risk types including denial of service, cyber espionage and crimeware. An accurate prediction of risk can help organisations to determine the suitable controls in proactive manner to manage the risk.

computer science, artificial intelligence
Can Cyber Risk Of Health Care Firms Be Insured? A Multinomial Logistic Regression Model

Swati Jain,Arunabha Mukhopadhyay,Saloni Jain

DOI: https://doi.org/10.1080/10919392.2023.2244386

IF: 2.2368

2023-08-12

Journal of Organizational Computing and Electronic Commerce

Abstract:The healthcare sector is prone to Distributed Denial-of-Service and Ransomware attacks owing to unsecured networks and software. This results in stalling of outpatient and inpatient operations of a hospital. In this study, we propose an H-CRAM model that computes the risk of a cyber-attack based on the threat appraisal component of the Protection Motivation Theory (PMT) using multinomial logistic regression. We also hypothesize that training the healthcare staff, implementing IT governance, and intervening technology will decrease the probability of the occurrence of a cyber threat. The severity of the risk is computed using Collective Risk Modelling. Next, based on the coping appraisal component of PMT, Rational Choice Theory, and NIST guidelines, we propose that the CIO of a healthcare firm should first reduce the cyber-risk by investing in encrypting Electronic Health Records, Security Incident and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) tools. Then pass the residual cyber risk to a cyber insurer.

computer science, information systems, interdisciplinary applications
Assessment of Cybersecurity Risks and threats on Banking and Financial Services

Rami Shehab,Abrar s.alismail,Dr. Mohammed Amin Almaiah,Dr. Tayseer Alkhdour,Dr. Belal Mahmoud AlWadi,Dr. Mahmaod Alrawad

DOI: https://doi.org/10.58346/jisis.2024.i3.010

2024-08-30

Abstract:Technology is important in all aspects of our lives, particularly in the banking sector. Advanced technologies resulted in a fundamental shift in the way banks operate. Malicious use of technology leads to security breaches, customer distrust, financial instability, and other forms of cybercrime. This paper focuses on the most important threats and challenges to be considered while interacting with banks and financial institutions. Significant number of literatures will be reviewed to identify the most common threats and attacks on banks and financial institutions sector, as well as appropriate mitigation techniques and countermeasures. This paper focuses on bank and financial services institution infrastructure vulnerabilities that are escalating attacks on the sector and affecting the banking system, individuals, and organizations. The security study in these 35 projects demonstrates how cyber intrusions continue to attack the financial sector due to the weakness of security defense and data containment. It turns out that malware attacks are the most common threats to banks and financial institutions. Sharing and exchanging information between banks and financial institutions, as well as best practices taken by bank cards issuers and users are the most effective mitigation techniques. Some previous studies proposed a successful model for mitigating the impact of threats on banks and financial institutions, as well as reducing risks that cannot be mitigated using current mitigation techniques. According to banks and financial services statistics and surveys, existing controls and laws do not provide appropriate security meet the banks and financial services institutions systems' demands and requirements.
A situation awareness model for information security risk management

Jeb Webb,Atif Ahmad,Sean B. Maynard,Graeme Shanks

DOI: https://doi.org/10.1016/j.cose.2014.04.005

2014-07-01

Abstract:Information security risk management (ISRM) is the primary means by which organizations preserve the confidentiality, integrity and availability of information resources. A review of ISRM literature identified deficiencies in the practice of information security risk assessment that inevitably lead to poor decision-making and inadequate or inappropriate security strategies. In this conceptual paper, we propose a situation aware ISRM (SA-ISRM) process model to complement the information security risk management process. Our argument is that the model addresses the aforementioned deficiencies through an enterprise-wide collection, analysis and reporting of risk-related information. The SA-ISRM model is adapted from Endsley's situation awareness model and has been refined using our findings from a case study of the US national security intelligence enterprise.

computer science, information systems

Cyber risk assessment model for information assets: a tailored approach for the financial and banking sector

Cyber Risk Assessment for Capital Management

A comprehensive model for cyber risk based on marked point processes and its application to insurance

FINANCIAL TECHNOLOGY RISK MANAGEMENT MODELS

Capital Requirements for Cyber Risk and Cyber Risk Insurance: An Analysis of Solvency II, the U.S. Risk-Based Capital Standards, and the Swiss Solvency Test

Mind the Gap: Securely modeling cyber risk based on security deviations from a peer group

A Framework for Digital Asset Risks with Insurance Applications

Modeling and Pricing Cyber Insurance -- Idiosyncratic, Systematic, and Systemic Risks

Cyber risk frequency, severity and insurance viability

Pricing cyber-insurance for systems via maturity models

Cyber risk modeling: a discrete multivariate count process approach

Calculating Strategic Risk in Financial Institutions

Disentangling the sources of cyber risk premia

Cyber Security in Cloud: Risk Assessment Models

Cyber risk management in the US banking and insurance industry: A textual and empirical analysis of determinants and value

Cyber risk and cybersecurity: a systematic review of data availability

Modeling Cybersecurity Risk: The Integration of Decision Theory and Pivot Pairwise Relative Criteria Importance Assessment with Scale for Cybersecurity Threat Evaluation

Asset criticality and risk prediction for an effective cybersecurity risk management of cyber-physical system

Can Cyber Risk Of Health Care Firms Be Insured? A Multinomial Logistic Regression Model

Assessment of Cybersecurity Risks and threats on Banking and Financial Services

A situation awareness model for information security risk management