Toward Quantitative Assessments of Cybersecurity Countermeasure Efficacy

Most organizations have limited cybersecurity budgets, but there is no standard methodology for prioritizing cyber countermeasure investment. Without a rigorous, quantitative methodology for measuring efficacy, organizations can never hope to allocate countermeasure investment effectively. Other industries such as medicine measure efficacy by combining multiple metrics into a single figure of merit. We seek to address the question of countermeasure efficacy measurement by reporting properties that can measure efficacy, aligning these properties to the high‐level tactics laid out in the MITRE D3FEND™ framework, and proposing the combination of these properties with qualitative organizational priorities via a weight matrix. The resulting score for a given countermeasure (within a D3FEND tactic) begins to answer the question of quantitative prioritization of security countermeasures.