Comparative Analysis of Risk-Based Performance Indicators in Information Security Incident Remediation

Abstract

This study presents a comparative analysis of efficiency indicators expressed as risks during incident-response activities in information security, based on results obtained through discrete-event simulation. The research focuses on modelling the economic aspects of information security for a variety of organizational information systems, recognizing that protection is typically implemented under constrained financial resources. It addresses the mathematical, algorithmic and software tools used to calculate risk-based efficiency indicators that characterize an information systems’ security posture. Based on the authors’ earlier work, the paper proposes managing a monetary fund that both pays, whenever necessary, for tasks related to incident remediation creating an outflow cash stream and periodically accumulates fixed-amount payments, thereby generating an inflow cash stream. Interaction between these two streams yields a resultant process that describes the fund’s state at any moment in time t. This behavior is modelled as a special random, discrete, non-stationary process. Non-stationarity is demonstrated by the fact that, over the simulation horizon, some realizations never cross the time axis while others do. Owing to the interplay between regular and random cash flows, the fund acquires an emergent property typical of complex systems: it exhibits characteristics absent from its individual components when considered in isolation. The instant at which the fund’s balance reaches zero is defined as the time of depletion. Several risk metrics related to this event are introduced, namely a single-factor risk that captures the probability of depletion, a single-factor financial risk defined as the expected value of random variables associated with depletion, and two variants of two-factor financial risks that are likewise tied to fund depletion. The proposed mathematical framework and risk models have been implemented in software centered on a discrete-event simulation program written in Python. Using this integrated software–mathematical platform, the study conducts a comparative analysis of the proposed risks and offers both scientific insights and practical recommendations.