A Novel Approach to Collectively Determine Cybersecurity Performance Benchmark Data

How do we determine cybersecurity performance benchmark data across organizations without the organizations revealing data points involving their frequency of information compromises? Disclosures of underlying data points are fundamentally inhibited by the need for privacy. It is a responsible organizational action to prevent the risk of expected or unexpected damages through data disclosure. Obtaining the data, especially valid and reliable data, necessary to calculate benchmarks, was thus an unsolvable wicked problem. The problem was therefore redefined as: How do we enable a distributed power-base of cybersecurity managers across organizations to collectively determine their benchmark data without actually disclosing their own data points? The core of the solution is a simple creative idea of having a protocol for a network of organizations to calculate benchmarks by distributing such calculations starting with some obfuscating data instead of centrally collecting the constituent data points of each organization. In this way, the confidential data of the organization would never be released beyond organizational systems. The fuller development of the protocol faced the issues of establishing trust in the network and preventing statistical compromises that were addressed through creative use of available technology, leading to the final solution, a distributed peer-to-peer architecture called Trusted Query Network (TQN). Distributed processing can induce trust and privacy into computer networks. In addition: (1) A research group representing multiple strengths and different but complementary backgrounds can be a very powerful asset in solving difficult problems. (2) Use of creativity is central to design science research but is particularly needed in solving apparently intractable problems. A group format can encourage free flow of ideas and brainstorming that are useful in spurring creativity. (3) It is very useful to be visionary in finding and solving challenging problems. Research groups provide the psychological strength to confront existing design challenges and to visualize their out-of-the-box solutions.