An Agent-Based Socio-technical Approach to Impact Assessment for Cyber Defense

This paper presents a work in progress simulation and a novel model for estimating the impact of cyber attacks. Previous methods so far, have taken the old - fashioned "intuition" approach - a qualitative or quantitative risk based analysis on the business level. More recent technical approaches involve simulations on networks of systems and sensor input from 3rd party detection tools of events occurring into the network. We propose an interdependency impact assessment approach, focusing on the responsibilities and the dependencies that flow through the supply chain, mapping them down into an agent - based socio - technical model. This method should be especially useful for modeling consequences across all levels of complex organizations networks - business processes, business roles and systems. We are aiming to make forward and backward inferences on threat scenarios and perform impact assessment, providing situational awareness and vulnerability analysis for cyber defense purposes.