SD-ABM-ISM: An integrated system dynamics and agent-based modeling framework for information security management in complex information systems with multi-actor threat dynamics

The increasing complexity and dynamic nature of modern Information Systems (IS) and evolving cybersecurity threats pose significant challenges for organizations in managing information security. Traditional methods often focus on isolated security aspects, failing to capture the intricate interdependencies between internal and external threats, vulnerabilities, and defensive strategies. These limitations necessitate a holistic approach that can comprehensively model and analyze the interactions within IS environments. Motivated to address these research gaps, we developed SD-ABM-ISM, a multi-method framework integrating System Dynamics (SD) and Agent-Based Modeling (ABM). This framework is designed to capture the complex dynamics of IS, incorporating insider and outsider threats and their interactions with defensive measures. SD-ABM-ISM enables an in-depth examination of how various threat actors impact security outcomes and how proactive and reactive investment strategies influence the resilience of the IS. The proposed framework provides a unique approach to understanding multi-actor threat dynamics and their effect on IS over time, facilitating informed decision-making for security investments. The framework offers a robust tool for security decision-makers, enabling organizations to align their security strategies with the evolving threat surface and enhance their resilience against cyberattacks. The detailed simulation and statistical analysis identify the influential elements in the IS over time, highlighting the impact of interactions between insider threats, outsider threats, and the IS itself in an environment characterized by high uncertainty and diverse threat behaviors. The insights from these interactions demonstrate how coordinated threats from multiple actors can amplify vulnerabilities while effective security measures can mitigate these risks. Considering proactive and reactive security investment strategies, SD-ABM-ISM provides a dynamic and cost-effective security investment strategy to protect IS from adversaries with various behaviors.