HiSPO: A Novel Threat Analysis and Risk Mitigation Approach to Prevent Cyber Intrusions

Abstract

In this paper, we study recent data breaches from both technical and business operation perspectives and propose an approach that calculates threat factors of information systems based on various features in hardware, software, policies and business operations. The assessment process takes more than 200 features into account. The data are then imported into an algorithm that calculates the threat factor and normalizes the value to [0-1]. A higher threat factor means the information systems would be hacked at higher risk. Mitigation strategies are provided to reduce risks of information systems from being hacked into and to protect data from being misused, stolen or identifiable. Experiments show that the threat factor reduced from 0.71 to 0.38 in one month for the company we worked with. It was further reduced to 0.18 after finishing a four-month assessment and mitigation period. This comprehensive approach can reduce data breaches caused by cyber intrusions to corporations such as Anthem, Sony, JP Morgan, Home Depot and Target. It can also deal with privacy concerns in this big data arena. Government agencies and private sectors can reduce risks of cyber intrusions by adopting this innovative threat analysis and risk mitigation strategy.