Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top

2022 | Book

Core Concepts Read chapter Read first chapter

Cybercomplexity

A Macroscopic View of Cybersecurity Risk

Author: Carl S. Young

Publisher: Springer International Publishing

Book Series : Advanced Sciences and Technologies for Security Applications

Part of: Springer Professional "Wirtschaft+Technik" , Springer Professional "Technik" , Springer Professional "Wirtschaft"

Login to get access
insite
SEARCH

About this book

This book tackles the problem of complexity within IT environments, i.e., "Cybercomplexity," which is generally recognized as a principal source of cybersecurity risk. The book first defines complexity and simplifies its analysis by assuming a probabilistic approach to security risk management. It then proposes a simple model of cybercomplexity that is based on Shannon entropy, a basic concept in information theory. The key drivers of cybercomplexity emerge from this model, where these drivers reveal the scale-dependence of cybersecurity risk and explain why macroscopic security controls are required to address cybersecurity risk on an enterprise scale. The significant operational implications of cybercomplexity are also discussed, thereby providing both a theoretical framework and a practical guide to addressing this longstanding problem in cybersecurity risk management.

Table of Contents

Frontmatter

Security Risk Fundamentals

Frontmatter
1. Core Concepts
Abstract
Unsurprisingly, any discussion on security risk management is based on the concept of risk. The fact is risk is broadly misunderstood, which may partly explain historic difficulties in its assessment. The casual use of terminology might contribute to this misunderstanding, although it is unclear if a lack of linguistic rigor is actually a cause or an effect. Whatever its origins, evidence of confusion is commonplace. For example, conflation of basic terms like “threat” and “risk” occurs frequently, even among security professionals.
Carl S. Young
2. Representing Cybersecurity Risk
Abstract
A picture is said to be worth a thousand words. The same can be said of a trend line. More precisely if less pithily, a trend line reveals how a function is changing in both magnitude and direction. In mathematical terms, a trend line graphically reveals the relationship between the independent and dependent variables of a function. If the independent variable happens to be a specific threat scenario parameter or feature, e.g., a risk factor for information compromise, and the dependent variable is a component of risk, risk-relevant information is conveyed at-a-glance.
Carl S. Young
3. Scale and Scaling Relations
Abstract
Readers old enough to recall using paper maps are already familiar with the concept of scale. A scale was printed on the map and it specified the ratio of map distance to actual distance. The bigger the ratio the coarser the scale and the less detail was visible. If the scale is too detailed the area covered by the map might be too limited. If the scale is too coarse, the requisite detail would be absent, which would potentially render the map useless for navigation.
Carl S. Young
4. IT Environment Dimensions and Risk Factors
Abstract
Risk factors for information compromise are prevalent throughout IT environments. Information technologies as well as processes that rely on these technologies have features that can be exploited by individuals with malicious intent. Some of these risk factors also facilitate unintentional data leakage. The autocomplete function in email is one well-known example of this phenomenon.
Carl S. Young

Stochastic Security Risk Management

Frontmatter
5. Security Risk Management Statistics
Abstract
Modern IT environments can contain thousands if not hundreds of thousands of individual elements. Each of these elements likely contains risk factors for information compromise. These environments are connected to other environments through intermediary networks and are continuously changing as users log on, log off, send email, connect to remote networks and access internet sites.
Carl S. Young
6. Information Entropy
Abstract
Each element in an IT environment contributes to the magnitude of cybersecurity risk. However, their aggregate effect can be difficult to ascertain. Furthermore, the variability of IT environments coupled with the sheer number of elements preclude assessments of every element and aggregating the individual results.
Carl S. Young

Enterprise Cybersecurity Risk

Frontmatter
7. Complexity and Cybercomplexity
Abstract
Security control calibration is the Holy Grail of cybersecurity risk management. Although this capability is rare, it does exist. For example, in the WiFi threat scenario described in Chap. 3, security control calibration is possible because signal detection limits are dictated by physics. The Friis formula yields a power law scaling relation equating signal intensity with the inverse-square of distance between a signal receiver and a radiating WiFi access point. Therefore, it is possible to precisely determine the required exclusion zone in order to protect against unauthorized signal detection.
Carl S. Young
8. Cybercomplexity Metrics
Abstract
It is worth reiterating that commercial IT environments typically contain myriads of elements, and each element likely contains risk factors for information compromise. The presence of numerous risk factors in even modest IT environments suggests any realistic threat scenario is characterized by significant complexity.
Carl S. Young

Cybercomplexity Genesis and Management

Frontmatter
9. Cybercomplexity Root Causes
Abstract
The objective of cybersecurity risk management is to identify and address the risk factors for information compromise or information-related business disruption via the application of security controls in accordance with an organization’s tolerance for risk.
Carl S. Young
10. Macroscopic Security Controls
Abstract
Although an assumption of stochastic security risk management is not entirely realistic, it is perhaps equally unrealistic to assume this process is completely deterministic. There is always uncertainty in security risk management, and risk factors for information compromise persist despite the best efforts of competent cybersecurity professionals.
Carl S. Young
11. Trust and Identity Authentication
Abstract
Common sense dictates that numerous, largely anonymous network users interacting with disparate technologies pursuant to sharing information would be accompanied by an increased potential for information compromise. That said, other technological environments that qualify as complex operate without an issue.
Carl S. Young
12. Operational Implications
Abstract
A theory pertaining to cybersecurity risk is of questionable value unless it has at least a vague connection to the real world. Specifically, it should provide insight into the drivers of risk with respect to information compromise, which forms the conceptual basis for applying security controls to risk factors.
Carl S. Young
Backmatter
Metadata
Title
Cybercomplexity
Author
Carl S. Young
Copyright Year
2022
Electronic ISBN
978-3-031-06994-9
Print ISBN
978-3-031-06993-2
DOI
https://doi.org/10.1007/978-3-031-06994-9

Premium Partner

    Image Credits