A New Cybersecurity Assessment Framework for Private Networks

Abstract

Cybersecurity is becoming of increasing importance, as the use of cyberspace is growing, and as the security challenges facing it are rising. The purpose of this paper is to develop a new cybersecurity assessment framework that provides a quantitative measurement of the cybersecurity state of private networks of organizations and consequently enables its future improvement. The framework is based on considering five domains of private network cybersecurity protection controls on the one hand, and on the quantitative assessment of the implementation state of these controls on the other. On this base, the framework identifies the domains and their protection controls based on recent version of ISO 27002:2022, and considering other international and national cybersecurity standards. Each control is refined into a set of implementation questions that enable providing a quantitative measurement indicator for the state of the control implementation. For providing a multilevel structure of the assessment outcomes, the indicators of the controls are grouped to provide sub-indices for the domains, and an overall index for the cybersecurity implementation state of a targeted network. The framework provides quantitative benchmarks to guide the required improvements of assessed networks. The use of the framework is finally illustrated through an assessment of a Saudi private network in an organization as case study.