University of Oxford Department of Computer Science

Analysing Cyber Value-at-Risk

As the volume of cyber-attacks continues to rise and also the levels of harm suffered from them, it is becoming critical that organisations can demonstrate that reasonable efforts are being undertaken to reduce cyber-risk. However, the risk responses and controls typically viewed as necessary, and even essential, by the professional and expert community are generally not underpinned by any framework that facilitates rigorous reasoning, qualification or quantification of the benefits resulting from their deployment. This means that the real value of compliance, or variability of compliance, to risk-control standards is not well reasoned or measurable in a scientific, unambiguous or verifiable sense.

Academics within Oxford’s Computer Science Department have partnered with AXIS Insurance Company (previously Novae Group plc) to tackle this challenge and probe the effectiveness of current defences against cyber-attacks, and the standards set by international bodies which businesses use to measure the sufficiency of their cyber security efforts. In their first project, they proposed a model that defines the associations between risk controls on the one side and assets, Cyber-Value-at-Risk (CVaR) and the different types of cyber-harm which may occur in a typical organisation on the other. The research also included an initial validation of the model and core analysis through interviews and focus groups with industry professionals in the areas of cybersecurity and cyber-insurance.

[See: white paper]

In the second, ongoing project titled "Analysing Cyber Value-at-Risk", the aim is to develop the model and provide a means to calculate CVaR by:
[null, null, {"document_url": "http://www.cs.ox.ac.uk/projects/ACVAR/index.html", "unformatted_src": "/img/nophotoavailable.png", "src": "https://www.cs.ox.ac.uk/img/nophotoavailable.png", "formatted_filename": "nophotoavailable"}, null, {"document_url": "http://www.cs.ox.ac.uk/projects/ACVAR/index.html", "unformatted_src": "/img/nophotoavailable.png", "src": "https://www.cs.ox.ac.uk/img/nophotoavailable.png", "formatted_filename": "nophotoavailable"}, null, null, {"document_url": "http://www.cs.ox.ac.uk/projects/ACVAR/index.html", "unformatted_src": "/files/8082//jasonnurse7.jpeg", "src": "https://www.cs.ox.ac.uk/files/8082//jasonnurse7.jpeg", "formatted_filename": "jasonnurse", "alt_text": "Personal photo - Jason Nurse"}, null, {"document_url": "http://www.cs.ox.ac.uk/projects/ACVAR/index.html", "unformatted_src": "/img/nophotoavailable.png", "src": "https://www.cs.ox.ac.uk/img/nophotoavailable.png", "formatted_filename": "nophotoavailable"}, null, null]