CYBERSECURITY Arion Cheong Soo Hyun Cho RISK MEASURE

CYBERSECURITY Arion Cheong Soo Hyun Cho RISK MEASURE Arion Cheong Won Gyun No Miklos Vasarhelyi

Going Dark Market Dark Web Hacktivist Forum

Darkweb Internal Information EDI Documents Protected Personal Information

Cybersecurity Risk Classification Method Level Topic 6 Application. User Level V 2 - Topic 7 Topic 15 Topic 1 V 6 Litigation Risk Business Level Topic 2 Topic 0 V 4 Litigation Cost Topic 3 Topic 11 Topic 4 V 3 Firm Factor Technical Level Topic 14 Topic 16 Topic 10 V 5 External Factor Topic 13 Topic 5 Control V 1 - Topic 8 Topic 9 Topic 12 Keywords Employee, Procedure, Policy, Malfeasance, Event Liability, Litigation, Disclosure, Cost, Employee Target, Client, Sabotage, Cost, Change Health, Law, Privacy, Regulation, HIPAA Reputation, Litigation, Disclosure, Misappropriation, Liability Individual, Government, Claim, Law, Payment Management, Recovery, Plan, Vendor, Threat Claim, Cost, Expense, Event, Market Software, Attempt, Transaction, Process, Error Infrastructure, Encryption, Interruption, Operating, Sophistication Threat, Encryption, Vulnerability, Resource, Provider Break, Interruption, Power, Incident, Event Power, Disaster, Interruption, Intrusion, Terrorism Infrastructure, Reputation, Industry, Standard, Control Employee, Software, Product, Market, Client Resource, Facility, Software, Cost, Capital Ability, Encrypt, Development, Product, Change Disclosure Focused on Litigation Obfuscated Contents Loose Knots Actual Exposure Breached Data Tree Classification Tree Broader Contents

Informativeness of Cybersecurity Risk Disclosure Risk Identification Mapping Exposed Data to Cybersecurity Risk vs. Management Description Disruptive Cybersecurity Risk Identification & Control Implication Focus on the Pre-existing Control Criteria Dynamic Control Criteria Structuring Firm-specific Control Criteria

Traditional Approach

Classification Cybersecurity Risk Classification Tree Exposed Data Actual Exposure Risk Description Risk Severity Relevant Control Litigation Cost Breached Data Tree Classification Tree Broader Contents

Peer Group Analysis SIC: 5961 (Retail-Catalog & Mail-Order Houses) Textual Data Preprocessed Textual Data 2013: Retail 2014: Platform 2015: Cloud Service Target Twitter Alphabet e. Bay Adobe Walmart Apple Microsoft Risk Identification 3 rd Party Risk Monitoring Business Activities Mapping with control General Control Specific Control

Dynamic Control Assessment Vulnerability Control Cybersecurity Breach Risk Assessment Dynamic Control Criteria Opinion Risk Type Risk Severity Materiality Mapped Controllability

Informativeness of Cybersecurity Risk Disclosure Multicollinearity Access Control < DB Security > Privacy Data < Overall Cybersecurity Score 825 out of 1000 ? 739 out of 1000 Regression Analysis ?

Informativeness of Cybersecurity Risk Disclosure Entity (Human) Subject of Analysis (DNA Sequences) Imagify DNA Sequences Probability of Cancer FGA-Google Deep. Variant Entity (Company) Subject of Analysis (Disclosure) Imagify Cybersecurity Risk Factors Cybersecurity Risk Metric

Informativeness of Cybersecurity Risk Disclosure Imagify DNA Sequence Images of Non-breached Firms Normal Individual Cybersecurity Risk Metric Autoencoder Prob (Cancer) (Semi-supervised) Normal Pattern of Risk Image