Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CHAPTER III: INFORMATION AND COMMUNICATION TECHNOLOGY
are dictated by the perceived vulnerability, threat likelihood and ensuing cost due
to a realized threat (Anderson and Moore 2006) 90 . The latter combines immediate
costs attributed to revenue loss, asset damage, settlement costs, legal exposure,
productivity losses, as well as intangible costs related to market perception and
customer churn. Moreover, expenditure on protection measures also becomes
correlated to the willingness of end users to accept a service surcharge for a given
level of protection. This is usually expressed in service level agreements (SLAs)
between the provider and the subscriber, whereby the degree of protection afforded
(e.g., availability, encryption level etc.) varies according to service classification. 91
Worse still, most CII owners are maintaining a prudent view on additional
expenditures due to the free spending (e.g., on inflated third-generation mobile
license auctions) of the 1990s that precipitated into the bursting of the dot-com
bubble and the eclipse of telecom boom in early part of this decade 92 .
On the other hand, CIIP objectives specifically target high-impact events
(e.g., targeted DDoS attacks on Estonia, Hurricane Gudrun in southern Sweden
etc.) that result from low-probability, uncertain, unexpected or even unknown
threats. Unfortunately, the true level of risk associated with such threats may be
difficult to discern, making the argument for supplementary security investments
for CIIP unjustifiable using traditional threat-based cost-benefit analysis and risk
assessment methodologies. These methods usually prioritize security measures
against high-probability known threats with a potential cause medium or highimpact
disruptions. Unfortunately, by relying on hard intelligence and reactive
responses to previously seen attacks, this threat-based approach leaves a large
security gap exploitable by surprise attacks. Alternatively, by basing security
investment decisions on the vulnerability-based approach, it is possible to ignore
the threat probability in the analysis, thus clearly highlighting the potential
benefits of CIIP investments (Rauscher et al 2006). Consider Figure 29, which
illustrates the cost versus security level relationship under the vulnerability-based
approach. The highest level of security investment justifiable for protection
against known threats is reached at an optimum point that guarantees maximum
returns on the investment. However, this investment is lower than that required for
protection against unknown threats, thus creating a CIIP investment gap, which in
turn translates into a high-risk security gap with a potential to cause great financial
loss when breached (see Figure 29).
90 See, for example, Sherwood et al. (2005).
91 See, for example, Fawaz et al. (2004). They propose a platinum, gold, silver and bronze service
classification, where for instance, service recovery time is