A National Cyber Risk Aggregation Framework: Why Micro-Security Metrics Fail at Macro Scale
DOI:
https://doi.org/10.22399/ijcesen.5551Keywords:
Systemic cyber risk, National cyber resilience, Risk aggregation, Critical infrastructure interdependence, Security metricsAbstract
Macro-scale cyber risk is often inferred from micro-scale security metrics, including vulnerability severity scores, exploitability estimates, and enterprise attack-graph measures. This review assesses why micro-security measures do not necessarily remain valid when scaled to national-level risk assessment and develops the foundation for a national cyber-risk aggregation framework. Peer-reviewed journal articles and academic books on vulnerability scoring, exploit prediction, attack-graph analytics, cyber interdependence, cyber insurance, cyber resilience, and systemic cyber risk were critically evaluated. A literature-derived evidence map of 17 representative studies was coded using four analytical dimensions: analytical scale, dependency representation, validation strategy, and macro-readiness. The review finds that local observables remain most useful for bounded technical triage, while all vulnerability-scale studies reviewed lacked explicit dependency representation and all organization-scale attack-graph studies remained non-macro-ready without a cross-sector dependency layer. Macro-oriented studies have increasingly addressed contagion, tail dependence, and critical-function disruption, but they continue to rely more heavily on simulation and conceptual modeling than on well-observed national data. The evidence supports a multilayered approach in which local technical observables are translated through organizational, sectoral, and national dependency models before national impact is inferred. This review concludes that national cyber risk is an emergent construct of interdependent socio-technical systems, rather than a simple additive function of micro-level security measures. Future research should prioritize concentration-sensitive aggregation, resilience-oriented inference, explicit uncertainty treatment, and public-private evidence infrastructures for systemic calibration.
References
[1] Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438–457. DOI: https://doi.org/10.1145/581271.581274
[2] Anderson, R., & Moore, T. (2006). The economics of information security. Science, 314(5799), 610–613. DOI: https://doi.org/10.1126/science.1130992
[3] Kunreuther, H., & Heal, G. (2003). Interdependent security. Journal of Risk and Uncertainty, 26(2–3), 231–249. DOI: https://doi.org/10.1023/A:1024119208153
[4] Rinaldi, S. M., Peerenboom, J. P., & Kelly, T. K. (2001). Identifying, understanding, and analyzing critical infrastructure interdependencies. IEEE Control Systems Magazine, 21(6), 11–25. DOI: https://doi.org/10.1109/37.969131
[5] Dueñas-Osorio, L., & Vemuru, S. M. (2009). Cascading failures in complex infrastructure systems. Structural Safety, 31(2), 157–167. DOI: https://doi.org/10.1016/j.strusafe.2008.06.007
[6] Buldyrev, S. V., Parshani, R., Paul, G., Stanley, H. E., & Havlin, S. (2010). Catastrophic cascade of failures in interdependent networks. Nature, 464(7291), 1025–1028. DOI: https://doi.org/10.1038/nature08932
[7] Camillo, M. (2017). Cyber risk and the changing role of insurance. Journal of Cyber Policy, 2(1), 53–63. DOI: https://doi.org/10.1080/23738871.2017.1296878
[8] Eling, M., & Schnell, W. (2016). What do we know about cyber risk and cyber risk insurance? The Journal of Risk Finance, 17(5), 474–491. DOI: https://doi.org/10.1108/JRF-09-2016-0122
[9] Welburn, J. W., & Strong, A. (2022). Systemic cyber risk for national critical functions. Risk Analysis, 42(8), 1606–1622. DOI: https://doi.org/10.1111/risa.13715
[10] Holm, H., & Afridi, K. K. (2015). An expert-based investigation of the Common Vulnerability Scoring System. Computers & Security, 53, 18–30. DOI: https://doi.org/10.1016/j.cose.2015.04.012
[11] Liu, Y., & Zhang, Y. (2011). VRSS: A new system for rating and scoring vulnerabilities. Computer Communications, 34(3), 264–273. DOI: https://doi.org/10.1016/j.comcom.2010.04.006
[12] Allodi, L., & Massacci, F. (2014). Comparing vulnerability severity and exploits using case-control studies. ACM Transactions on Information and System Security, 17(1), 1–20. DOI: https://doi.org/10.1145/2630069
[13] Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I., & Roytman, M. (2021). Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice, 2(3), Article 20, 1–17. DOI: https://doi.org/10.1145/3436242
[14] Noel, S., Jajodia, S., Wang, L., & Singhal, A. (2010). Measuring security risk of networks using attack graphs. International Journal of Next-Generation Computing, 1(1), 135–147.
[15] Wang, L., Islam, T., Long, T., Singhal, A., & Jajodia, S. (2008). An attack graph-based probabilistic security metric. In V. Atluri (Ed.), Data and Applications Security XXII (pp. 283–296). Springer. DOI: https://doi.org/10.1007/978-3-540-70567-3_22
[16] Noel, S., & Jajodia, S. (2017). A suite of metrics for network attack graph analytics. In L. Wang & S. Jajodia (Eds.), Network Security Metrics (pp. 141–176). Springer. DOI: https://doi.org/10.1007/978-3-319-66505-4_7
[17] Wang, L., Jajodia, S., Singhal, A., Cheng, P., & Noel, S. (2017). k-zero day safety: Evaluating the resilience of networks against unknown attacks. In L. Wang & S. Jajodia (Eds.), Network Security Metrics (pp. 75–93). Springer. DOI: https://doi.org/10.1007/978-3-319-66505-4_4
[18] Hofmann, A., & Ramaj, R. (2011). Interdependent risk networks: The threat of cyber attack. International Journal of Management and Decision Making, 11(5–6), 312–323. DOI: https://doi.org/10.1504/IJMDM.2011.043406
[19] Laszka, A., Felegyhazi, M., & Buttyan, L. (2014). A survey of interdependent information security games. ACM Computing Surveys, 47(2), Article 23, 1–38. DOI: https://doi.org/10.1145/2635673
[20] Pal, R., Huang, Z., Yin, X., Lototsky, S., De, S., Tarkoma, S., Crowcroft, J., Liu, M., Sastry, N., & Nag, B. (2021). Aggregate cyber-risk management in the IoT age: Cautionary statistics for (re)insurers and likes. IEEE Internet of Things Journal, 8(9), 7360–7371. DOI: https://doi.org/10.1109/JIOT.2020.3039254
[21] Pal, R., Huang, Z., Lototsky, S., Yin, X., Crowcroft, J., Liu, M., De, S., Sastry, N., & Nag, B. (2021). Will catastrophic cyber-risk aggregation thrive in the IoT age? A cautionary economics tale for (re-)insurers and likes. ACM Transactions on Management Information Systems, 12(2), Article 17, 1–28. DOI: https://doi.org/10.1145/3446635
[22] Peters, G. W., Shevchenko, P. V., Lin, Z., Wüthrich, M. V., & Zhang, Y. (2023). Cyber loss model risk translates to premium mispricing and risk sensitivity. Geneva Papers on Risk and Insurance: Issues and Practice, 48(2), 372–433. DOI: https://doi.org/10.1057/s41288-023-00285-x
[23] Setola, R. (2023). Systemic cyber risk. International Journal of Critical Infrastructure Protection, 43, 100652. DOI: https://doi.org/10.1016/S1874-5482(23)00065-3
[24] Hillairet, C., Lopez, O., d’Oultremont, M., & Spoorenberg, T. (2022). Cyber-contagion model with network structure applied to insurance. Insurance: Mathematics and Economics, 107, 88–101. DOI: https://doi.org/10.1016/j.insmatheco.2022.08.002
[25] Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016). A review of cyber security risk assessment methods for SCADA systems. Computers & Security, 56, 1–27. DOI: https://doi.org/10.1016/j.cose.2015.09.009
[26] Singhal, A., & Ou, X. (2017). Security risk analysis of enterprise networks using probabilistic attack graphs. In L. Wang & S. Jajodia (Eds.), Network Security Metrics (pp. 53–73). Springer. DOI: https://doi.org/10.1007/978-3-319-66505-4_3
[27] Hubbard, D. W., & Seiersen, R. (2023). How to Measure Anything in Cybersecurity Risk (2nd ed.). Wiley. DOI: https://doi.org/10.1002/9781119892335
[28] Linkov, I., Eisenberg, D. A., Plourde, K., Seager, T. P., Allen, J., & Kott, A. (2013). Resilience metrics for cyber systems. Environment Systems and Decisions, 33(4), 471–476. DOI: https://doi.org/10.1007/s10669-013-9485-y
[29] Kott, A., & Linkov, I. (2021). To improve cyber resilience, measure it. Computer, 54(2), 80–85. DOI: https://doi.org/10.1109/MC.2020.3038411
[30] Cremer, F., Sheehan, B., Fortmann, M., Kia, A. N., Mullins, M., Murphy, F., & Materne, S. (2022). Cyber risk and cybersecurity: A systematic review of data availability. Geneva Papers on Risk and Insurance: Issues and Practice, 47, 698–736. DOI: https://doi.org/10.1057/s41288-022-00266-6
[31] Bhatt, P., Anand, A., & Yadavalli, V. S. S. (2021). Exploitability prediction of software vulnerabilities. Quality and Reliability Engineering International, 37(2), 648–663. DOI: https://doi.org/10.1002/qre.2754
[32] Ouyang, M. (2014). Review on modeling and simulation of interdependent critical infrastructure systems. Reliability Engineering & System Safety, 121, 43–60. DOI: https://doi.org/10.1016/j.ress.2013.06.040
[33] Akbarzadeh, M., Shafieezadeh, A., Choi, J., & Lee, J. (2021). Identifying and analyzing dependencies in and among interconnected critical infrastructures. Sensors, 21(5), 1685. DOI: https://doi.org/10.3390/s21051685
[34] Zadeh, A. H., Dehghantanha, A., Parizi, R. M., Choo, K.-K. R., & Srivastava, G. (2023). A cybersecurity risk quantification and classification framework for informed risk mitigation decisions. Decision Analytics Journal, 9, 100328. DOI: https://doi.org/10.1016/j.dajour.2023.100328
[35] Xu, X., Li, Y., Wang, Y., & Zhang, M. (2024). Supply chain cybersecurity investments with interdependent risks under different information exchange modes. International Journal of Production Research, 62(6), 2034–2059. DOI: https://doi.org/10.1080/00207543.2023.2206923
[36] Gori, T., Bernieri, G., Ferrigno, L., & Laracca, M. (2024). A systematic analysis of security metrics for industrial cyber–physical systems. Electronics, 13(7), 1208. DOI: https://doi.org/10.3390/electronics13071208
[37] Aghazadeh Ardebili, A., Lezzi, M., & Pourmadadkar, M. (2024). Risk assessment for cyber resilience of critical infrastructures: Methods, governance, and standards. Applied Sciences, 14(24), 11807. DOI: https://doi.org/10.3390/app142411807
[38] Bace, M., Dubois, D. J., & Tatar, U. (2024). Resilience against catastrophic cyber incidents: A multistakeholder analysis of cyber insurance. Electronics, 13(14), 2768. DOI: https://doi.org/10.3390/electronics13142768
[39] Barrère, M., Hankin, C., Nicolaou, C., El-Amine, K., & Kabbabe, A. (2020). Measuring cyber-physical security in industrial control systems via minimum-effort attack strategies. Journal of Information Security and Applications, 52, 102471. DOI: https://doi.org/10.1016/j.jisa.2020.102471
[40] Alhidaifi, S. M., Asghar, M. R., & Ansari, I. S. (2024). A survey on cyber resilience: Key strategies, research challenges, and future directions. ACM Computing Surveys, 56(8), Article 196, 1–48. DOI: https://doi.org/10.1145/3649218
[41] Bellini, E., D’Aniello, G., Flammini, F., & Gaeta, R. (2025). Situation awareness for cyber resilience: A review. International Journal of Critical Infrastructure Protection, 49, 100755. DOI: https://doi.org/10.1016/j.ijcip.2025.100755
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2024 International Journal of Computational and Experimental Science and Engineering
This work is licensed under a Creative Commons Attribution 4.0 International License.
