QUANTITATIVE METHODOLOGY FOR ASSESSING CYBERSECURITY RISKS IN THE ABSENCE OF FINANCIAL DATA ON LOSSES

Abstract

The article addresses the pressing issue of cybersecurity risk assessment in military information and communication systems (ICS) during aggressive warfare, where it is impossible to assess potential losses in monetary terms, and considering the specifics of hybrid threats. The introduction discusses the relevance of the problem and emphasizes the need for a proactive cyber defense strategy and timely risk assessment, especially in the context of the active use of cyberweapons by the adversary. Particular attention is given to the impossibility of assessing potential losses from cyberattacks in monetary terms, which necessitates new approaches to risk assessment. The section “Specifics of Cybersecurity Risk Assessment in the ICS of the Armed Forces of Ukraine” analyzes existing standards and methodologies, such as the standards of the DSTU ISO/IEC 27000 group, as well as current cybersecurity risk assessment methodologies, and reveals the limitations of their application in wartime conditions. The section emphasizes the importance of automating the risk assessment process to ensure a rapid response to cyber threats. The advantages of quantitative risk assessment models over qualitative ones are considered, especially in the context of military information and communication systems. The following sections examine in detail the key risk assessment processes according to DSTU ISO/IEC 27005:2023 and in accordance with current methodologies. A comparative analysis of the OCTAVE, NIST, COBIT, TARA, and FAIR methodologies is conducted from the perspective of their suitability for the needs of the Armed Forces of Ukraine. The advantages and disadvantages of each methodology are discussed, and the necessity of developing a new methodology based on OpenFAIR (an open version of the FAIR methodology), adapted to the specifics of military ICS and the realities of hybrid warfare, is substantiated. The research results are presented in the form of an activity diagram for a cybersecurity risk assessment algorithm in military information and communication systems, along with a detailed description of these steps, emphasizing the differences from the OpenFAIR methodology. The “Conclusions” section summarizes the work done and formulates proposals for further research.