[Paper Review] An Approach to Select Cost-Effective Risk Countermeasures Exemplified in CORAS

Le Minh Sang Tran, Bjørnar Solhaug+1 more|arXiv (Cornell University)|Jan 1, 2013

Information and Cyber Security1 references6 citations

TL;DR

This paper proposes a generic, formal approach to select cost-effective risk countermeasures by integrating cost, risk reduction effectiveness, and interdependencies into a risk model annotated with countermeasure data. Using a calculus-based reasoning system, it generates ranked decision diagrams to support managers in choosing optimal, cost-efficient security controls, demonstrated through instantiation in the CORAS risk analysis method for eHealth systems.

ABSTRACT

Risk is unavoidable in business and risk management is needed amongst others to set up good security policies. Once the risks are evaluated, the next step is to decide how they should be treated. This involves managers making decisions on proper countermeasures to be implemented to mitigate the risks. The countermeasure expenditure, together with its ability to mitigate risks, is factors that affect the selection. While many approaches have been proposed to perform risk analysis, there has been less focus on delivering the prescriptive and specific information that managers require to select cost-effective countermeasures. This paper proposes a generic approach to integrate the cost assessment into risk analysis to aid such decision making. The approach makes use of a risk model which has been annotated with potential countermeasures, estimates for their cost and effect. A calculus is then employed to reason about this model in order to support decision in terms of decision diagrams. We exemplify the instantiation of the generic approach in the CORAS method for security risk analysis.

Motivation & Objective

• Address the lack of prescriptive, cost-effective guidance in risk management for selecting security countermeasures.
• Provide a systematic method to balance countermeasure cost against risk mitigation effectiveness.
• Support decision-making with quantitative, multi-aspect analysis of countermeasures including cost, risk reduction, and interdependencies.
• Integrate cost assessment directly into risk modeling to improve decision quality in security policy development.
• Demonstrate the approach’s feasibility and utility through instantiation in the CORAS method for real-world eHealth applications.

Proposed method

• Annotate a risk model with potential countermeasures, their estimated costs (Countermeasure Expenditure), and their risk reduction effects (Reduction Effect).
• Model dependencies between countermeasures using Effect Dependency to capture synergistic or conflicting impacts.
• Apply a formal calculus to propagate likelihoods and consequences through the annotated risk graph, enabling quantitative analysis.
• Use the calculus to compute risk reduction and cost-benefit trade-offs across all risk scenarios.
• Generate decision diagrams that visually rank countermeasure alternatives based on cost-effectiveness.
• Instantiate the generic approach within the CORAS method, adapting notations and rules to align with CORAS risk modeling conventions.

Experimental results

Research questions

• RQ1 How can cost, risk reduction, and interdependencies among countermeasures be formally integrated into a risk model to support decision-making?
• RQ2 What formal mechanisms enable the systematic comparison of countermeasure alternatives based on cost-effectiveness?
• RQ3 How can synergy effects between multiple countermeasures be modeled and quantified in risk treatment decisions?
• RQ4 To what extent can this approach be instantiated within existing risk analysis methods like CORAS?
• RQ5 Can the approach produce actionable, ranked recommendations for risk countermeasures that balance cost and effectiveness?

Key findings

• The approach successfully integrates cost, risk reduction, and interdependence factors into a unified risk model, enabling systematic countermeasure selection.
• The formal calculus allows propagation of likelihood and consequence values through annotated risk graphs, supporting quantitative analysis of individual and combined countermeasures.
• Decision diagrams generated by the approach provide a clear, visual ranking of countermeasure alternatives based on cost-effectiveness, aiding managerial decision-making.
• In the eHealth case study, the method identified specific countermeasure combinations—such as GS6, GS7, and GS8—that offered optimal risk reduction at acceptable cost levels.
• The approach demonstrated synergy effects, where combined countermeasures (e.g., GS8) reduced risk more effectively than individual measures, with GS8 achieving a 112,100 cost for a significant risk reduction.
• The instantiation in CORAS proved feasible, showing that the generic approach can be adapted to existing risk modeling frameworks with minimal disruption to established processes.