Return on Cybersecurity Investment in Operational Technology Systems: Quantifying the Value That Cybersecurity Technologies Provide after Integration

摘要

Appropriate cybersecurity investment is a challenge faced by both private and public organizations. This challenge includes understanding the actual vulnerabilities of an organization's networked systems, as well as the cost of a successful cyber attack on those systems. On top of this, an organization's cybersecurity acquisition workforce must be able to discern reality from the marketing hype that is produced by cybersecurity sales forces. This paper builds upon earlier work which developed a cybersecurity acquisition decision support mechanism (Romero-Mariona. et al., 2016). In particular, cybersecurity technology evaluation results are extended to assist organizations to define a Return on Cybersecurity Investment. This new capability is instantiated within the context of networked critical infrastructure and industrial control systems.