Authors:
Roger A. Hallman
1
;
Maxine Major
2
;
Jose Romero-Mariona
2
;
Richard Phipps
2
;
Esperanza Romero
2
and
John M. San Miguel
2
Affiliations:
1
Thayer School of Engineering, Dartmouth College, Hanover, New Hampshire, U.S.A., Naval Information Warfare Center Pacific, San Diego, California, U.S.A.
;
2
Naval Information Warfare Center Pacific, San Diego, California, U.S.A.
Keyword(s):
Cybersecurity Investment, Acquisition, Decision Support, Return on Cybersecurity Investment.
Abstract:
Appropriate cybersecurity investment is a challenge faced by both private and public organizations. This challenge includes understanding the actual vulnerabilities of an organization’s networked systems, as well as the cost of a successful cyber attack on those systems. On top of this, an organization’s cybersecurity acquisition workforce must be able to discern reality from the marketing hype that is produced by cybersecurity sales forces. This paper builds upon earlier work which developed a cybersecurity acquisition decision support mechanism (Romero-Mariona. et al., 2016). In particular, cybersecurity technology evaluation results are extended to assist organizations to define a Return on Cybersecurity Investment. This new capability is instantiated within the context of networked critical infrastructure and industrial control systems.