A method for quantifying information security incident costs in a Japnese national university corporation

Abstract

We propose a method to quantify costs of an information security incident in Japanese national university corporation. In order to execute several corrective and preventive actions within a limited budget, we need some indicators to compare the level of urgency or importance on each action. The total amount of loss shall consist of not only the loss directly caused by the incident such as broken equipments and lost profits, but also the indirect cost to recover to the original state. We can calculate those indirect costs with the proposed method by defining the data item corresponding to the cost factor. We applied the proposed method to constructing ISMS in Yamaguchi University, and confirmed the effectiveness.