# Critical Integration of Quantitative and Qualitative Approaches in Cyber Threat Intelligence Analysis and Cyber Risk Analysis
#
## **Abstract**

With the increasing complexity of organizational network architectures, cyber threats are escalating, necessitating effective cyber threat intelligence analysis and cyber risk analysis. A thorough comprehension of threats and risks has become especially crucial. This paper critically examines the integration of quantitative and qualitative analytical methods in this area, underscoring the significance of the FAIR approach. The FAIR structured methodology aids in quantifying and understanding the complexities of cyber risk, which is vital in decision-making. It explores the increasingly crucial role of machine learning and artificial intelligence in enhancing decision-making and threat detection.

Although current approaches by organizations lean towards the quantitative, this paper argues for the importance of incorporating a quantitative aspect by utilizing both methods for threat and risk analysis. It identifies key challenges in implementing effective rigorous methods and the failure of organizations to integrate qualitative and quantitative methods. This critical analysis aims to uncover the underlying reasons for this failure and suggests ways to overcome these obstacles, including the adoption of a FAIR approach for a more balanced and thorough risk analysis.

## **Introduction**

The days of cyber as an afterthought are gone. Security experts use various intelligence to analyze previous breaches, understanding the techniques, vulnerabilities, malwares exploited by cyber attackers, and the tools used for their deployment (David, 2013). In achieving this, organizations must be up-to-date on these cyber threats, collect cyber intelligence information by analyzing previous incidents using external sources. Exploring the FAIR approach in enhancing CRA through quantitative and qualitative analytical methods.

With the introduction of Machine Learning (ML), Artificial Intelligence (AI), and data analytics in CTIA and CRA, organizations could easily detect cyber threats, leading to good decisions in averting cyberattacks. Despite the growing rate of cyberattacks, current approaches believe more in the quantitative method for CRA to mitigate cyberattacks (Apostolakis, 2004). Hubbard (Hubbard, 2016) argues that there is no reason why only a quantitative method could be used without qualitative and subjective approaches. However, there are also challenges to the qualitative method as well as quantitative approaches. Despite the many apparent significances of both qualitative and quantitative methods, many organizations yet fail to implement and integrate these approaches into their cybersecurity framework. As seen from the black swan concept, underestimating the probability and impact of these approaches will lead to much unpredictable surprise, causing a massive risk impact, subjecting to bias that will lead to wrong decisions (Taleb, 2007). This essay critically examines the underlying reason why organizations fail to fully implement rigorous CTIA and CRA methods, examining obstacles and suggesting possible solutions.

To achieve such an objective, the paper has the following structure: Firstly, it will deal extensively with definitions of terminologies related to CTI and CRM. The main part will dwell much on critical analysis against quantitative and qualitative methods for CTIA and CRA. Finally, the limitation of implementation by the organization from achieving a rigorous method and possible way forward.

**1.1 Definitions of Risk and Threat**

Getting the definition to fit into this essay is essential as many authors have tried to distinguish between threat and risk. In this context, to capture uncertainty as the absence of complete certainty, which is the presence of more than one possibility (Hubbard et al., 2016), into the definition of risk. Hubbard defines risk as a potential loss or other undesirable events measured with probabilities assigned to losses of various magnitudes. Another definition by Freund and Jones (Freund et al., 2014) states risk as the probable frequency and probable magnitude of future loss. Both definitions fit into this paper for cyber threat and risk analysis. This is so because knowing the frequency of events without understanding its magnitude is relatively meaningless in decision-making. In contrast, a threat can be defined as the potential cause of an unwanted incident causing harm to a system or organization (a fair approach). It is also the function of capability and intent (Strachan-Morris, 2012). Simply put, a threat is anything capable of acting in a manner that could result in harm and should be protected against. Both threat and risk should not be used interchangeably.

**1.2 Threat Analysis vs Risk Analysis**

Threat analysis is a quantitative analysis that involves analyzing data such as the frequency of past incidents, severity of potential impact, probability of occurrence, vulnerability data, and cost of mitigation. According to Allen (Allen, 2015), threat analysis is defined as 'Scope of impact x source identification x control weaknesses.' On the other hand, risk analysis is the process used to comprehend the nature of risk and to determine the level of risk, providing bases for risk evaluation, risk treatment, and risk estimation (Hubbard, 2016). The common misconception is that both risk analysis and risk assessment are the same, but there is a difference. From a FAIR perspective, risk analysis is often a subcomponent of the risk assessment process (Freund, 2004). In organizations, threat and risk analysis are used to identify potential threats, quantify threat impact, inform decision-makers, and guide resource allocation for effective risk mitigation.

**1.3 Quantitative vs Qualitative**

Quantitative methods generate numerical data or information that can be converted (McLeod, 2023). This method is purely objective since it seeks precise measurement, while Qualitative methods are primarily subjective and seek to understand human behavior and the reasons affecting such behavior (Ayyub, 2001). It focuses on gathering mainly verbal data for measurement and is analyzed in an interactive manner. The difference between both methods is the type of data they collect and analyze. A rigorous method demands a comprehensive approach that involves the application of both qualitative and quantitative techniques in assessing and managing cyber threats and risks. Organizations use these methods to gather, analyze, and disseminate information about cyber threats, focusing on intelligence-driven decision-making in responding to cyber-attacks and employed in assessing risk.

**2. Cyber Risk Analysis**

Although there is no immunity against subjective elements in quantitative risk assessment, quantitative approaches better account for subjectivity, whereas qualitative approaches do not (Hubbard, 2016). Many organizations believe that risk doesn't mean the same thing to everyone and is therefore difficult to quantify. Overcoming the misconception regarding quantification requires a combination of great approaches. One of these Cyber Risk Analysis (CRA) frameworks is the FAIR approach, which provides a measure of temporally-bound probability (Freund et al., 2014). This means there is a measurement of the probability of occurrence, and it is time-bound. The FAIR approach provides a comprehensive method for quantifying risk by assigning numerical values to risk factors. It categorizes risk data into two quantifiable categories: the probability of a loss event and loss magnitude.

With the FAIR approach, one wonders what assumptions were made in a few risks' metrics labeled as high, medium, low, extremely low. Moreover, the notion that vulnerability is a condition that represents a weakness ready to be exploited is quite misleading. This is because vulnerability is a matter of degree rather than a difference that a loss event may or may not occur (Freund et al., 2014). That is to say, vulnerability will answer the question of how likely a threat event becomes a loss event. However, the limitation of the FAIR approach is that it restricts the use of certain statistical distributions and may present an inaccurate risk profile if it does not support such distribution (Wang, 2020). Likewise, FAIR uses a pre-calculated value stored in the cache for complex calculations in real-time to speed up the process, introducing inaccuracy in the model.

**Figure 1. Steps within the FAIR model (Freund, 2014)**

Figure 1 shows the logical flow indicating a structured quantitative risk analysis approach that combines qualitative input, i.e., expert estimation, with quantitative analysis, which are the Program Evaluation and Review Techniques (PERT) and Monte Carlo engine in assessing risk. For instance, if you are examining the risk associated with a trading portal, then all estimated factors will be tailored to that scenario, including how the trading portal is being attacked and the frequency that cybercriminals attack the portal. It is estimating how this portal is likely to be attacked during the time period (usually annually), which helps keep the values realistic and relevant to the analysis of the portal. These assist the cyber team gain insight into the frequency of risk events and the potential financial loss (Freund et al., 2014).

**2.3 Quantitative and Qualitative Analytical Method in Cyber Threat Intelligence and Cyber Risk Analysis**

Cyber Threat Intelligence Analysis (CTIA) is dynamic, focusing more on external threats by identifying, analyzing, and interpreting cyber threats and collecting data from open-source intelligence to understand the tactics, techniques, and procedures (TTP) of potential threats (Tounsi et al., 2018). This achieves a proactive, anticipated approach to mitigate threats before they materialize. In contrast, Cyber Risk Analysis (CRA) is a broader term involving assessing internal potential vulnerabilities within an organization (Ayyub, 2001). CRA considers the likelihood of a cyber-attack and its potential impact, prioritizing security measures and allocating resources effectively. By integrating AI and ML in risk analytics, a stronger and more resilient defense against cyber-attacks can be created. ML will monitor and detect future attacks based on seen and unseen data (Radanliev et al., 2020). According to Facebook, they employed ML technology to drop approximately 2 billion fake accounts in 2019 to protect real users, showcasing the effectiveness of ML in threat detection (Kumar et al., 2022). Although CTIA and CRA are essential components of a comprehensive cybersecurity strategy relying on data analysis, continuous updating is necessary to remain effective. CRA aims to protect organizations from cyber threats and reduce the likelihood of successful cyber-attacks.

Since quantitative and qualitative analysis rely greatly on the same source of data, problems arise when data meant for quantitative analysis is presented as qualitative. Examples of quantitative approaches are Bayesian statistics and Monte Carlo simulations. For instance, if a risk analysis provides a negative result, it doesn't mean that there is no threat but updates the probability, reducing the likelihood of the risk. This statement is strongly supported by Taleb since Bayesian statisticians express judgment based on the likelihood ratio (Taleb, 2010). In contrast, the qualitative approach to CRA is the risk matrix, widely espoused for assessing and analyzing risk. Misconceptions arise from the risk matrix as ordinal data cannot be quantified (Hubbard, 2016). The key question that remains unanswered is whether the use of the risk matrix guides us towards making better risk analyses and leading to better decision-making processes. Non-profit foundations, such as the Open Worldwide Application Security Project (OWASP), still use the risk rating methodology for vulnerability assessment (Borja, 2021). This affects the outcome of the analysis due to oversimplification of complex risks, leading to biases and more errors. Such a risk matrix fails to accurately quantify risk, necessitating complementing it with quantitative tools for effective risk management (Hubbard, 2016).

Although qualitative risk assessment requires no statistical measurement dependence and numerical values, making the assessment quick and easy, there is bias in determining probability and effect. Imagine an analysis producing a result in an ordinal scale; meaningfulness must be questioned to understand what a value like a risk score of 4 and a risk score of 1 mean. The result from such inconsistent risk matrices will impair decision-making. If risks and mitigation strategies were quantified in a meaningful way, decisions would be better supported (Hubbard et al., 2016).

Quantitative methods in risk analysis are objective and produce detailed and actionable results with more complexity and time consumption compared with qualitative methods. The black swan concept is not against quantitative risk management but against risk management based on speculations and theories, not facts (Taleb, 2007). This makes quantifying a cardinal-interval scale result difficult since the differences in the assigned numbers to such attributes have no meaning. For example, saying 20°C is twice as hot as 10°C is incorrect because the zero point (0°C) is not an absolute zero. Bearing in mind that no scale used by mortals is perfectly free of their taint (Stevens, 1946). There is no way qualitative results are more accurate than organized quantitative results (Freund et al., 2014). For effective risk analysis, quantify the risk in terms of numbers, figures, and percentages for asset valuation and risk factors to be computed mathematically. Although we can represent quantitative analysis results in a qualitative form, we cannot do the reverse (McLeod, 2023). Rigorous quantitative and qualitative methods in CTIA and CTA are characterized by their precision, reliability, and validity in risk mitigation. Using both quantitative and qualitative methods in mitigating risk is the most beneficial option.

**2.4 Barriers to Implementation**

**2.4.1 Lack of Collaboration**

Most cyber threat intelligence is public in nature and demands a collaborative approach. In information security, several threat intelligence providers need to be engaged with to obtain proper cyber threat intelligence (Freund et al., 2014). Although most stakeholders would like to share cyber intelligence, successful models are missing or incomplete (Wagner et al., 2019). Sharing CTI helps organizations understand the threat landscape, coordinate responses to new threats, reduce impact, and cut the cost of acquiring intelligence (Stillions, 2014). Yet, several barriers limit such possibilities within organizations. Factors affecting collaboration include trust and interpersonal relationships. Lack of trust has been demonstrated to diminish the transfer of information (Pala et al., 2019). Interpersonal relationships among stakeholders also affect collaboration. Studies show that collaboration among the cybersecurity incident response team community is closely bonded, with colleagues sharing high-value information (Pala et al., 2019).

**2.4.2 Resource Constraints**

CTI comes with a high price tag in software, hardware, and maintenance. The lack of resources could impede the adoption of sophisticated CTI tools, leaving organizations vulnerable to cyber threats (Aldasoro et al., 2022). Additionally, the lack of skilled experts to interpret complex datasets and make informed decisions based on them poses a challenge. A good risk decision cannot be attained without a clear understanding of the threat (Freund, 2014). Some organizations lack skilled experts despite having rigorous risk analytic tools, making their utilization inefficient and resulting in minimal impact (Abu et al., 2018).

**2.4.3 Organizational Culture and Resistance to Change**

Cultural shift is needed to effectively deal with the black swan concept (Taleb, 2010), as most organizations may resist adopting new rigorous methods due to a preference for traditional and familiar approaches. Experts may find it difficult to believe that a quantitative model could possibly be an improvement over qualitative methods (Hubbard, 2016). For example, the data breach at Retailer Target shows they relied solely on qualitative solutions to cyber risk. Likewise, with quantitative analysis, certain misunderstandings about statistical inference might deter organizations from embracing quantitative methods. Furthermore, allowing mid-level management rather than higher-level authorities within organizations in decision-making authority (Freund, 2014). Such cultural aspects affect the nature of decision-making, leading to issues regarding resources to support decisions and means to enforce compliance. Another issue related to organizational culture is accountability for decisions. When everyone is responsible for a decision, it shows nobody will be accountable, resulting in improper decision documentation. In case of a risk analysis failure, no one will be properly held accountable.

**2.5 Strategies for Adoption Barrier Reduction**

**2.5.1 Enhanced Inter-Organizational Collaboration**

Mandatory CTI exchange could be enforced by the government to enhance speed sharing and improve the quality of threat intelligence (Wagner, T.D., Mahbub et al., 2019). CTI collaborative efforts should involve several actionable intelligences processed and sent in a timely manner. A coordinated approach to threat responses could involve sharing information among trusted organizations. This could be achieved by using data exchange standards such as STIX, TAXII, OpenIOC to send and receive information through platforms such as threatExchange to automatically uncover critical information (Abu et al., 2018). Information provided by STIX is used to identify vulnerabilities and emerging risks in the target systems.

**2.5.2 Resource Allocation**

Efficient resource allocation is essential in risk mitigation, with CTI providing actionable insights into threat actors' Tactics, Techniques, and Procedures (TTP) (Kayode-Ajala, 2023). This will help in assessing potential risks and prioritizing them based on the likelihood of occurrence and severity of the impact, allocating limited resources to address the most significant risks. Institutions such as banks and insurance companies incur more limited losses relative to other sectors due to adherence to regulations and higher investments in cybersecurity (author, the divers of cyber risk). Statistical literacy is strongly correlated with acceptance of quantitative methods (Hubbard, 2016).

**2.5.3 Cultivating Adaptive Organizational Culture of Innovation**

The most difficult part of the transition is mainly cultural, and culture is part of a function of beliefs (Hubbard et al., 2016). Cultivating a value innovation culture that promotes continuous learning and adaptability is important for unpredictable threats. Financial institutions, for example, easily adapt to new risk analysis dynamics (Kayode-Ajala, 2023). Critical decision-making should be at the high-level organization management for resource allocation and speedy risk mitigation action. Organizations should enforce and have well-defined authority, such that decision-makers need to sign a statement explicitly acknowledging their accountability (Freund et al., 2016). There should be defined decision-making roles, responsibilities, and limitations.

**6 Conclusions**

CTIA and CRA create a nuanced landscape where technology, methodology, and organizational behavior intersect. Measuring an organization’s cyber risk is challenging, especially when shifting from subjective, qualitative analysis to quantitative ones (Hubbard, 2016). Effective cyber threat intelligence and risk analysis go beyond just analyzing historical risk and common events. Taleb was correct when he argued that relying solely on predictions based on the analysis of the past without a robust theory limits the accuracy of prediction (Taleb, 2010). This is not solely contingent upon the rigorous method employed but also on the context in which it will be applied. Much threat assessment based on opinion and subjective judgment is supported by available data (Strachan-Morris et al., 2012). Intelligence analysis uses analytic judgment mixed with fragmentary data into meaningful information for further action. Regardless of whether it is a quantitative approach or qualitative approach in CTIA and CRA, both approaches are directly proportional to risk mitigation approaches (Hubbard, 2016; Freund, 2014).

I strongly agree that the integration of both quantitative and qualitative methods presents a balanced approach underscoring the complexity of cyber threats, which are neither technical nor entirely predictable. Beyond statistical models, the qualitative approach should account for the unforeseeable nature of certain events (Taleb, 2010). Since no approach to risk mitigation provides 100% accuracy without limitation, the limitation of the qualitative approach is high subjectivity of the risk while the effectiveness of the quantitative approach is fully dependent on the sufficiency and relevance of data (Fauzi et al., 2023). The exploration of balancing both qualitative and quantitative approaches could provide significant understanding and advance in risk mitigation.

Firstly, in reflecting on this point, I realized that neither quantitative nor qualitative method alone can suffice in the mitigation of risk, as each presents challenges. Prior to this research, I was more inclined towards quantitative data for its objectivity. Understanding the complexities and limitations of the FAIR approach was insightful, revealing that quantitative methods, though valuable, have their own challenges and emphasizing the need for continuous refinement and adaption of risk analysis (Hubbard et al., 2016; Wang et al., 2020). Similarly, the importance of qualitative analysis in providing a depth of meaning underscores the need for a holistic approach to cyber risk analysis (Rathod et al., 2017). The balance between quantitative and qualitative methods is important in analyzing and responding to cyber threats (Ayyub, 2001). Utilizing both will yield the most robust solution by assisting in problem-solving and more critical decision-making. This knowledge gained is relevant towards my maritime field where the implementation of sophisticated systems is necessary.

Secondly, the potential of AI and ML revolutionizing CTIA and CRA was another key learning point. Conversely, there is a growing trend in utilizing ML and AI techniques because of their demonstrated effectiveness in analyzing threats using both quantitative and qualitative approaches and in detecting anomalies (Conti et al., 2018). It cannot be overstated as it promises a shift from reactive to proactive risk mitigation measures. Utilizing AI and ML in the DML model by simplifying the analysis and linking of threat intelligence assists in accelerating maturity growth for organizations with access to these resources The ability of AI to predict and prevent cyber threats based on historical data offers a glimpse into the future of proactive risk mitigation measures. The critical role of technical threat intelligence was an eye-opener, especially its direct applicability and impact on organizational security. The details of actionable intelligence can significantly bolster an organization's defense mechanism (Chismon et al., 2015). In my job, my understanding regarding the automation of data makes me think more about how this will be implemented, shifting to a more adaptive and resilient approach. The integration of AI and ML as a transformative approach would aid organizations, especially those with resource constraints, to advance in their CTI activities, reducing cyberattacks, and strengthening cyber risk management.

Thirdly, I also learned that apart from the limitations affecting both quantitative and qualitative approaches stated above, other factors would serve as barriers to the organization in adopting a comprehensive and effective CTIA and CRA. A profound understanding of the unpredictability and severity of cyber threats (Taleb, 2007) underlines the urgency of overcoming these challenges for effectiveness and efficiency. The implementation hurdles for organizations, such as lack of collaboration, organizational culture, and resource constraints, were examined with potential solutions to overcome these barriers to map and analyze collaboration networks within organizations triangulated findings from quantitative data as a tool to understand the relationship among these organizations (Stillions, 2014). Freund emphasized the public nature of most CTI and the necessity for collaborative approaches mitigating risk (Freund et al., 2014). This underscores the collective nature of cyber threats and necessitates shared responses since CTIA does not work in isolation. In my profession, I now see the value of fostering open communication and collaboration not just internally but also with external stakeholders to enhance collective security and knowledge. Substantial Financial demands linked to CTI tools where limited resources can lead to vulnerability (Aldas

oro et al., 2022). This is not just about the right tools but also the necessary expertise to use them effectively. This has changed my perception to a more balanced allocation of resources not only in the investment in technology but also investment in the people to use the technology effectively. For organizational culture, I learned that aside from implementing new technological processes, it's all about changing mindsets and attitudes towards these changes. The resistance to change and a preference for traditional methods can hinder the adoption of effective cybersecurity strategies (Hubbard et al., 2016). This understanding will guide me in advocating for a more adaptive and open organizational culture in risk mitigation.

These learning profound implications not only for my understanding of risk mitigation but for my approach to complex problems from a wide perspective. This reinforces the value of quantitative and qualitative analysis approaches, the need for practical implementation challenges, and the transformative potential of emerging technologies like AI and ML. These emerging technologies, in the future, will accelerate CTI, improving risk analysis, driving great impact in cybersecurity.

**REFERENCES**

Abu, M. S., Selamat, S. R., Ariffin, A., & Yusof, R. (2018). Cyber threat intelligence–issues and challenges. Indonesian Journal of Electrical Engineering and Computer Science, 10(1), 371-379.

Aldasoro, I., Gambacorta, L., Giudici, P., & Leach, T. (2022). The drivers of cyber risk. Journal of Financial Stability, 60, 100989.

Allen, G., & Derr, R. (2015). Threat assessment and risk analysis: an applied approach. Butterworth-Heinemann.

Apostolakis, G. E. (2004). How useful is quantitative risk assessment? Risk Analysis: An International Journal, 24(3), 515-520.

Ayyub, B. M. (2001). Elicitation of expert opinions for uncertainty and risks. CRC Press.

Bianco, D. (2013). The pyramid of pain. Enterprise Detection & Response.

Borja, T., Benalcázar, M. E., Valdivieso Caraguay, Á. L., & Barona López, L. I. (2021). Risk analysis and Android application penetration testing based on OWASP 2016. In Information Technology and Systems: ICITS 2021, Volume 1 (pp. 461-478). Springer International Publishing.

Chismon, D., & Ruks, M. (2015). Threat intelligence: Collecting, analyzing, evaluating. MWR InfoSecurity Ltd, 3(2), 36-42.

Conti, M., Dargahi, T., & Dehghantanha, A. (2018). Cyber threat intelligence: challenges and opportunities (pp. 1-6). Springer International Publishing.

Fauzi, R., & Sembiring, J. (2023, September). A Review on Information Security Risk Assessment of Smart Systems: Risk Landscape, Challenges, and Prospective Methods. In 2023 10th International Conference on ICT for Smart Society (ICISS) (pp. 1-6). IEEE.

Freund, J., & Jones, J. (2014). Measuring and managing information risk: a FAIR approach. Butterworth-Heinemann.

Gartner, I.R.M. (2013). Definition: Threat intelligence. [Online]. Available: https://www.gartner.com/en/documents/2487216/definition-threat-intelligence.

Hubbard, D. W., & Seiersen, R. (2016). How to measure anything in cybersecurity risk. John Wiley & Sons.

Kayode-Ajala, O. (2023). Applications of Cyber Threat Intelligence (CTI) in Financial Institutions and Challenges in Its Adoption. Applied Research in Artificial Intelligence and Cloud Computing, 6(8), 1-21.

Kumar, K., & Pande, B. P. (2022). Applications of machine learning techniques in the realm of cybersecurity. Cyber Security and Digital Forensics, 295-315.

Mavroeidis, V., & Bromander, S. (2017, September). Cyber threat intelligence model: an evaluation of taxonomies, sharing standards, and ontologies within cyber threat intelligence. In 2017 European Intelligence and Security Informatics Conference (EISIC) (pp. 91-98). IEEE.

McLeod, S. (2023). Qualitative vs quantitative research: methods & data analysis. Simply Psychology. [Online]. Available: https://www.simplypsychology.org/qualitative-quantitative.html [Accessed Feb. 12th, 2023].

Pala, A., & Zhuang, J. (2019). Information sharing in cybersecurity: A review. Decision Analysis, 16(3), 172-196.

Radanliev, P., De Roure, D., Page, K., Nurse, J. R., Mantilla Montalvo, R., Santos, O., Maddox, L. T., & Burnap, P. (2020). Cyber risk at the edge: current and future trends on cyber risk analytics and artificial intelligence in the industrial internet of things and industry 4.0 supply chains. Cybersecurity, 3(1), 1-21.

Rathod, P., & Hämäläinen, T. (2017, August). A novel model for cybersecurity economics and analysis. In 2017 IEEE International Conference on Computer and Information Technology (CIT) (pp. 274-279). IEEE.

Stevens, S. S. (1946). On the theory of scales of measurement. Science, 103(2684), 677-680.

Stillions, R. (2014). The DML Model. Retrieved from https://ryanstillions.blogspot.com/2014/04/the-dml-model_21.html.

Strachan-Morris, D. (2012). Threat and risk: what is the difference and why does it matter?. Intelligence and National Security, 27(2), 172-186.

Taleb, N. N. (2010). The black swan: the impact of the highly improbable. 2nd ed., Random trade pbk. ed. New York, Random House Trade Paperbacks.

Tounsi, W., & Rais, H. (2018). A survey on technical threat intelligence in the age of sophisticated cyber attacks. Computers & Security, 72, 212-233.

Wagner, T. D., Mahbub, K., Palomar, E., & Abdallah, A. E. (2019). Cyber threat intelligence sharing: Survey and research directions. Computers & Security, 87, 101589.

Wang, J., Neil, M., & Fenton, N. (2020). A Bayesian network approach for cybersecurity risk assessment implementing and extending the FAIR model. Computers & Security, 89, 101659.

Conference Name: ACM Woodstock conference Conference Short Name: WOODSTOCK’18 Conference Location: El Paso, Texas USA ISBN: 978-1-4503-0000-0/18/06 Year: 2018 Date: June Copyright Year: 2018 Copyright Statement: rights retained DOI: 10.1145/1234567890 RRH: F. Surname et al. Price: $15.00