Mind the Gap：基于同行群体安全偏差的网络安全风险安全建模
Mind the Gap: Securely modeling cyber risk based on security deviations from a peer group
AI总结：
本文提出利用隐私增强技术安全聚合同行数据，引入防御差距指数，构建行业网络风险模型，帮助组织评估风险并与同行比较。
摘要：
关于网络风险，有两个长期存在的战略性问题，各组织在很大程度上一直无法回答：一个组织的估计风险暴露是多少，以及其安全状况与同行相比如何？回答这两个问题都需要关于安全态势、事件和损失的行业范围数据，而直到最近，这些数据对于组织而言过于敏感，难以共享。现在，隐私增强技术（PETs），如密码计算，可以实现在不披露敏感输入数据的情况下，从一组同行组织中安全计算聚合网络风险指标。随着这些新的聚合数据的出现，分析师需要将其整合到网络风险模型中的方法，这些模型能够产生更可靠的风险评估，并允许与同行群体进行比较。本文提出了一种新的框架，用于与同行进行网络态势基准比较，并利用安全计算中出现的新变量，在特定经济部门内估计网络风险。我们引入了一个新的顶层变量，称为防御差距指数（Defense Gap Index），代表组织与其同行之间的加权安全差距，可用于根据历史行业数据预测组织自身的安全风险。我们与一个行业信息共享与分析组织（ISAO）合作，在一个特定部门应用了这种方法，使用了从25家大型公司收集的数据，构建了一个行业风险模型，并向参与者提供了工具，以估计他们自身的风险暴露并私下与同行比较其安全态势。
英文摘要：
There are two strategic and longstanding questions about cyber risk that organizations largely have been unable to answer: What is an organization's estimated risk exposure and how does its security compare with peers? Answering both requires industry-wide data on security posture, incidents, and losses that, until recently, have been too sensitive for organizations to share. Now, privacy enhancing technologies (PETs) such as cryptographic computing can enable the secure computation of aggregate cyber risk metrics from a peer group of organizations while leaving sensitive input data undisclosed. As these new aggregate data become available, analysts need ways to integrate them into cyber risk models that can produce more reliable risk assessments and allow comparison to a peer group. This paper proposes a new framework for benchmarking cyber posture against peers and estimating cyber risk within specific economic sectors using the new variables emerging from secure computations. We introduce a new top-line variable called the Defense Gap Index representing the weighted security gap between an organization and its peers that can be used to forecast an organization's own security risk based on historical industry data. We apply this approach in a specific sector using data collected from 25 large firms, in partnership with an industry ISAO, to build an industry risk model and provide tools back to participants to estimate their own risk exposure and privately compare their security posture with their peers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
