Cyber resilience quantification: A probabilistic estimation model for IT infrastructure

In today’s digital landscape, ensuring IT infrastructure resilience against increasingly frequent and sophisticated cyber-attacks is a critical priority. Cyber resilience is the ability of a system or organisation to anticipate and recover from cyber-attacks. Effective cyber resilience quantification enables systematic analysis and comparison of IT infrastructures. Cyber resilience involves resisting and recovering from cyber-attacks. Cyber resilience refers to the ability of a system to absorb, recover from, and adapt to cyber-attacks. However, existing approaches often fail to integrate dynamic probabilistic assessment methods that capture resilience fluctuations over time. This study introduces the Probabilistic Estimation-based Quantification Model for Cyber Resilience (PEQCRM), a novel framework that enhances cyber resilience measurement and strategic decision-making. The proposed model incorporates Resilience Curves (RC) and the Area Under the Curve (AUC) methodology to quantify resilience over attack and recovery phases. Additionally, it expands traditional resilience assessment by integrating cyber resilience strategies as key influencing factors. The PEQCRM model is evaluated through extensive simulations to assess its effectiveness in real-world cybersecurity scenarios. Findings reveal that different resilience strategies exhibit varying adoption, absorption, and recovery effectiveness levels. This study evaluates the extent to which a strategy can mitigate initial attack impact and adoption for the extent to which organisations implement and sustain strategy levels of four different cyber resilience strategies. Specifically, the pre-configuration strategy demonstrates the highest level of preparedness and adoption, while the buffering-supported strategy has the lowest absorption level. The managing complexity strategy achieves the highest absorption level, whereas the mesh topology strategy exhibits strong recovery capabilities and adoption rates.