Managing Cybersecurity Risk Using Threat Based Methodology for Evaluation of Cybersecurity Architectures

To manage limited resources available to protect against cybersecurity threats, organizations must use risk management approach to prioritize investments in protection capabilities. Currently, there is no commonly accepted methodology for cybersecurity professionals that considers one of the key elements of risk function - threat landscape - to identify gaps (blinds spots) where cybersecurity protections do not exist and where future investments are needed. This paper discusses a new, threat-based approach for evaluation of cybersecurity architectures that allows organizations to look at their cybersecurity protections from the standpoint of an adversary. The approach is based on a methodology developed by the Department of Defense and further expanded by the Department of Homeland Security. The threat-based approach uses a cyber threat framework to enumerate all threat actions previously observed in the wild and scores protections (cybersecurity architectural capabilities) against each threat action for their ability to: a) detect; b) protect against; and c) help in recovery from the threat action. The answers form a matrix called capability coverage map - a visual representation of protections coverage, gaps, and overlaps against threats. To allow for prioritization, threat actions can be organized in a threat heat map - a visual representation of threat actions' prevalence and maneuverability that can be overlaid on top of a coverage map. The paper demonstrates a new threat modeling methodology and recommends future research to establish a decision-making framework for designing cybersecurity architectures (capability portfolios) that maximize protections (described as coverage in terms of protect, detect, and respond functions) against known cybersecurity threats.