A quantitative bow-tie cyber risk classification and assessment framework

Barry Sheehan, Finbarr Murphy, Arash N. Kia and Ronan Kiely

Journal of Risk Research, 2021, vol. 24, issue 12, 1619-1638

Abstract: Cyber-attacks pose a growing threat to global commerce that is increasingly reliant on digital technology to conduct business. Traditional risk assessment and underwriting practices face serious shortcomings when encountered with cyber threats. Conventional assessment frameworks rate risk based on historical frequency and severity of losses incurred, this method is effective for known risks; however, due to the absence of historical data, prove ineffective for assessing cyber risk. This paper proposes a conceptual cyber risk classification and assessment framework, designed to demonstrate the significance of proactive and reactive barriers in reducing companies’ exposure to cyber risk and quantify the risk. This method combines a bow-tie model with a risk matrix to produce a rating based on the likelihood of a cyber-threat occurring and the potential severity of the resulting consequences. The model can accommodate both historical data and expert opinion and previously known frameworks to score the Threats, Barriers and Escalators for the framework. The resultant framework is applied to a large city hospital in Europe. The results highlighted both cyber weaknesses and actions that should be taken to bolster cyber defences. The results provide a quick visual guide that is assessable to both experts and management. It also provides a practical framework that allows insurers to assess risks, visualise areas of concern and record the effectiveness of implementing control barriers.

Date: 2021
References: Add references at CitEc
Citations: View citations in EconPapers (4)

Downloads: (external link)
http://hdl.handle.net/10.1080/13669877.2021.1900337 (text/html)
Access to full text is restricted to subscribers.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:taf:jriskr:v:24:y:2021:i:12:p:1619-1638

Ordering information: This journal article can be ordered from
http://www.tandfonline.com/pricing/journal/RJRR20

DOI: 10.1080/13669877.2021.1900337

Access Statistics for this article

Journal of Risk Research is currently edited by Bryan MacGregor

More articles in Journal of Risk Research from Taylor & Francis Journals
Bibliographic data for series maintained by Chris Longhurst ().