Quantifying the Impact Propagation of Cyber Attacks Using Business Logic Modeling

Cyber-attacks affect the security properties of critical systems, such as confidentiality, integrity, and availability of crucial business activities. They also affect mission quality and performance. Existing risk assessment tools handling the problem still present some limitations, owing to the difficulty of describing the enterprise infrastructure, such as identifying assets, missions, and their dependencies. Furthermore, little research has been conducted to assess the impact propagation of external events on business entities. In this chapter, we survey existing methods aiming to solve the aforementioned limitations. We focus on two main families: financial and operational impact assessment. The latter aims to specifically assess the impact propagation of cyber-attacks. For instance, cyber-attacks targeting the infrastructure assets and perturbing the execution and performance of the company’s activities. It can also include the evaluation of the financial impact based on former financial assessment methodologies. We also present a concrete operational impact propagation assessment contribution. This contribution extends previous work by enhancing the definition associated to organizational activities that might be impacted by cyber-attacks. It relies on business impact analysis via business logic modeling. It also includes metrics to quantify (i) the impact propagation probability on the business entities, and (ii) critical time (i.e., the time during which the business entity is not be impacted).