Peer Risk Model for Cyber Security Risk
- 1. VivoSecurity Inc., Los Altos, CA. Email: [email protected] George Box, British Mathematician and champion of Bayesian Inference A PEER RISK MODEL Calculate Custodial Data Risk, Compare with Industry Peers Calculate residual risk in dollars to PII, PFI, PHI and CHD using historical industry data. Calculate ROI and prioritize controls, estimate insurance needs and the value of incident response, communicate risk to senior management and objectively set risk appetite. Prior Beliefs EvidencePosterior Beliefs
- 2. More effectively mitigate risk Manage black-swan events Measure reduction in risk Focus where risk is highest Adopt a strategic approach Manage risk in business terms Communicate risk in dollars Justify security investments Weigh risk against business priorities Right-size cyber insurance Manage Cyber Risk in Business Terms A Peer Risk Model allows senior management to compare cyber risk to their peers – in dollars. A rigorous statistical model that is trained on historical industry data gives a risk assessment credibility and senior management the confidence to manage cyber risk in business terms. It allows consideration of the ROI of new security controls, helps demonstrate insurance adequacy and allows an objective consideration of risk appetite. A Peer Risk Model can give the board of directors a clear understanding of risk and demonstrate a strong risk management culture.
- 3. What is a Peer Risk Model? A Peer Risk Model is a statistical model built upon historical industry data, that can calculate the residual risk for the average company of a particular size and industry. Information about a companies past breach rate can be added to estimate how a company differs from industry averages (i.e. their peers). The model is “trained” on historical industry data using standard statistical (actuarial) techniques such as linear regression and Bayesian Model Averaging (see George Box on cover). Modeling techniques are rigorous and comply with the standards put forth by the Federal Reserve for model management (SR 11-‐7). A rigorous modeling process provides credibility, since the process discovers factors that are predictive of the cost and the probability of a data breach. A model is no better than it’s data and our historical industry data comes from credible and comprehensive sources such as State Attorney Generals, Heath and Human Services (HHS), US Census data and 10K filings from public companies. The Peer Risk Model actually integrates four models: 1) a model for the probability of lawsuits, 2) a model for the cost distribution of a given breach, 3) a breach size vs frequency model, and 4) a model that characterizes incident rate by industry. The Peer Risk Model can be deployed in an easy to use Excel Spreadsheet which requires a small number of variable inputs that have been found to be predictive of cost.
- 4. Investigation Notification Call center Remediation o Business Loss o Damage to personal credit o Theft of money & goods o Credit card replacement costs Business loss; theft of money & goods Credit monitoring & privacy insurance. Fines & settlements Public & Other BusinessesBreach Company Total costs Mitigate Transfer via suits Data Breach Costs Covered by the Peer Risk Model Response CostsDamage costs Term Meaning Investigation Cost of investigating what happened in a data breach including data that was exposed. Costs of updating agencies of investigation progress. Remediation Cost to preventing future data breach. Notification Legal costs of notifying federal agencies and states attorney general. Call Center Cost of hiring or expanding call centers to handle calls from people affected by data breach. Business Loss, theft of money & goods Loss of business and customers, fraud costs, cost of goods pur chased with stolen cards Credit Monitoring & Privacy Insurance Cost of providing credit monitoring such as Experian, insurance to cover personal loss by people affected by the data breach. Fines & Settlements Government fines, lawsuit awards and settlements, defense costs. Glossary The Peer Risk Model calculates risk to custodial data. Custodial data is any PII data which triggers reporting requirements of various government agencies (also known as risk to confidentiality, in AppSec parlance). The model calculates Total Costs; below is a graphical breakdown of costs included in Total Costs.
- 5. 6 Model Outputs The following graphs are example ways that risk can be summarized by the model. Examples are for hypothetical companies.
- 6. 0% 20% 40% 60% 80% 100% 0 >0 1 2 3 4 5 Probability Number of Lawsuits $0 $5 $10 $15 $20 $25 Likelihood Breach Cost Millions $19.8M 80% Confidence Interval Model Outputs: Maximum Data Breach Cost; Probability of Lawsuit Modeling of historical industry data finds a distribution of costs for any particular breach size and type, with a small percentage of companies experiencing very large costs. The model shows this as a probability distribution for the cost. Confidence intervals are indicated for the maximum breach costs as well as the value of incident response activities to reduce the confidence interval. Confidence intervals are valuable for estimating insurance needs. When they occur, lawsuits are an important component of the cost. One focus of incident response is to prevent lawsuits. The model also calculates and graphs the probability for lawsuits to help guide incident response decisions. Value of Incident Response Controls Less than 10% chance of a lawsuit in the largest data breach. Most companies would experience a cost of under $5M.
- 7. 0.001 0.010 0.100 1.000 10.000 100.000 1,000.000 10 100 1,000 10,000 CostMillions Years All Other Incidents Malicious Outsider Dominant Cause Model Outputs: Loss Exceedance Curve Commonly used in catastrophe modeling, the loss exceedance curve considers the most likely cost from all incident types, and includes the possibility of extraordinary data breach costs (tail risk). This curve is valuable for setting a companies risk appetite and insurance coverage. Example: $1M insurance covers a once in 100 year (or once in 100 companies, each year) event.
- 8. Model Outputs: Residual Risk by Incident Type and Breach Size Residual risk can be broken down and graphed in various ways including Incident Type and breach size. Such graphs are valuable for understanding and communicating the major sources of risk, weighing business priorities against cyber risk and for resource allocation. $0.00 $100.00 $200.00 $300.00 $400.00 $500.00 $600.00 $700.00 $800.00 $900.00 $1,000.00 Malicious Outsider Accident Lost, Stolen Malicious Insider Thousands 5 Year Period, 80% Confidence Small (<500) Medium (500 to 10,000) Large (10,000 to 1 million) Huge (1 million to 100 million) Largest risk reduction would be obtained by focusing on reduction of small accidents.
- 9. $0 $50 $100 $150 $200 $250 $300 $350 $400 $450 $500 Thousands Value of Additional Controls 5 year period, 80% Confidence Interval Model Outputs: Value of Additional Controls The value of a control is calculated based upon residual industry risk, and the degree to which a control reduces the frequency of incidents. When the value of a control is combined with the cost, it is possible to prioritize resources based upon ROI, thus achieving a greater reduction in risk. Understanding the value of a control and ROI in dollars helps to communicate the need and justify the investment. Largest risk reduction would be from Data Loss Prevention
- 10. Gather Data Company information is gathered as part of a standard security audit, including: 1) the number of customers for which records are not sequestered, 2) types of PII data, NAICS industry code, number of employees and past incidents. Data into Model Data is entered into the model and the residual risk is automatically calculated based upon historical industry data and broken down by incident and data types, size vs frequency, probability for lawsuits and cost distributions for all possible breach sizes. Risk is further broken down into quadrants for the purposeofevaluating additional (new) controls. Incident Response Additional Controls The security expert sets confidence intervals based upon an evaluation of the companies incident response as compared with peers, including written response plan, training and rehearsals, instrumenting theenterprise, and engaging an experienced security company and law firm. A security expert assigns additional (new) controls to risk quadrants and assigns percent effectiveness based upon experience, industry reports, and implementation. The model automatically calculates thedollar valuefor each control. ROI The cost of additional (new) controls is entered from external sources, the calculation interval is adjusted according to the cost amortization period for controls and the model automatically estimates ROI. Report Controls are ordered by ROI and graphed. Other graphs which summarized risk are copied from the model and used to generate a report. The report can be presented to senior management to set risk appetite, justify and prioritizeinvestments and guideinsurancepurchases. Use Case Thediagram below shows theprocess by which a typical company an use the Peer Risk Model to evaluate residual risk in dollars and calculatea dollar based ROI for additional (new) controls. Much oftheinformation needed is gathered as part ofa standard security audit.
- 11. About VivoSecurity VivoSecurity Inc, 1247 Russell Ave, Los Altos California; Contact: [email protected], (650) 919-‐3050 VivoSecurity provides data analytics and statistical modeling to companies in the financial and high tech industries. We are a Silicon Valley Startup since 2012, with PhD level scientists and statisticians. We use advanced data analytic techniques to model the probability and cost of cybersecurity events. We have strong cybersecurity domain knowledge, strong knowledge of software applications, strong knowledge of operating systems and hardware and a strong understanding of enterprise operations. Model Description Cyber-‐Loss Model Calculates the maximum cost of a data breach of custodial data. Probability for Fraud, personal customers Calculates probability for a cyber attach that leads to fraud. Probability for Fraud, corporate customers Calculates probability for a cyber attach that leads to fraud. 3rd party (vendor) Risk Calculates risk in dollars posed by 3rd party partners. Additional Offerings