 Mind the denominator: towards a more effective measurement system for cybersecurityEric Jardine Journal of Cyber Policy, 2018, vol. 3, issue 1, 116-139 Abstract: Crime statistics in the physical world are routinely normalised around the population of a city or country. Such normalisations are essential, as they provide both a propensity-based perspective on crime (e.g. the odds of being murdered are 1 in 100,000) and correct for the simple fact that a larger population should have more crimes. Unfortunately, many cybersecurity metrics tend to be uncorrected counts of malicious phenomena such as the number of phishing websites. While normalisation cannot make bad measures good, a failure to normalise even the best cybersecurity metrics can lead to bias. A failure to normalise count statistics around the size of the ecosystem, sensor density or risk mitigation personnel has implications for the observed trends, often making the state of cybersecurity seem worse than it actually is. In short, normalisation of malicious count data is a crucial measurement step and has significant impacts for both firm- and economy-wide risk management strategies and policy assessment. Date: 2018 Downloads: (external link) Related works: Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text Persistent link: https://EconPapers.repec.org/RePEc:taf:rcybxx:v:3:y:2018:i:1:p:116-139 Ordering information: This journal article can be ordered from DOI: 10.1080/23738871.2018.1472288 Access Statistics for this article Journal of Cyber Policy is currently edited by Emily Taylor More articles in Journal of Cyber Policy from Taylor & Francis Journals |
Is your work missing from RePEc? Here is how to contribute.
Questions or problems? Check the EconPapers FAQ or send mail to .
EconPapers is hosted by the
School of Business at Örebro University.