Toward Quantitative Assessments of Cybersecurity Countermeasure Efficacy

Abstract

Most organizations have limited cybersecurity budgets, but there is no standard methodology for prioritizing cyber countermeasure investment. Without a rigorous, quantitative methodology for measuring efficacy, organizations can never hope to allocate countermeasure investment effectively. Other industries such as medicine measure efficacy by combining multiple metrics into a single figure of merit. We seek to address the question of countermeasure efficacy measurement by reporting properties that can measure efficacy, aligning these properties to the high-level tactics laid out in the MITRE D3FEND™ framework, and proposing the combination of these properties with qualitative organizational priorities via a weight matrix. The resulting score for a given countermeasure (within a D3FEND tactic) begins to answer the question of quantitative prioritization of security countermeasures.