Strengthening Cyber Risk Management and Oversight through Digital Twin Technology and Simulation Gaming

Dr. Sander Zeijlemaker is the Managing Director of the Disem Institute, a Research Affiliate in Cybersecurity at MIT CAMS, an agenda contributor to the World Economic Forum, a member of the ENISA Ad-hoc Security Operation Center Working Group, and the president of the Security, Stability, and Resilience special interest group of the System Dynamics Society.

Abstract

• In our technology-dependent society, it is essential for organizations to have a comprehensive understanding of cyber risk.
• The complex nature of cyber risk necessitates a holistic approach to effectively mitigate risk and take appropriate action.
• Decision-makers can enhance their understanding and foresight in managing cyber risk through exploratory and interactive technologies.

The pervasive integration of computer technology into our daily lives has significantly transformed how we operate. Businesses increasingly rely on technology for everything from data storage to machine learning. However, despite implementing various identification methods to secure data and systems, the world is witnessing a troubling rise in cyber threat exposure. At the current growth rate (18% y.o.y based on 2024), the cost of cybercrime is projected to reach approximately $23.8 trillion annually by 2027.

This societal exposure has prompted governments to elevate cyber risk management to the boardroom level through legislation such as the Network and Information Security Directive (NIS2) in Europe and the Cybersecurity Rules of the Securities and Exchange Commission (SEC) in the USA.

Executives and business leaders regularly face difficult decisions regarding the governance and oversight of cyber risks, as exposure to these risks can impact competitive positioning, customer trust, reputation, and may lead to fines and lawsuits.

Governing and overseeing cyber risk presents significant challenges as executive decision-makers navigate their organizations through a complex and ever-changing landscape. Evolving adversaries, human behavioral limitations, and imperfections in security-enhancing technology make organizations vulnerable to cyberattacks. Additionally, securing a dynamic organization—characterized by changing personnel, processes, technology, suppliers, shifting strategic priorities, and emerging events—is exceedingly difficult.

Unfortunately, executives and business leaders often feel overwhelmed by the complexity and urgency of addressing cyber risk issues. In such situations, the risk of security blind spots increases, leading to costly and suboptimal approaches to cyber risk management. This underscores the need to strengthen managerial foresight capabilities to align business needs with cyber risk management.

Simulations provide a safe environment to anticipate the impact of intended strategic decisions 

We can learn much from aviation, where flight simulators play a crucial role in pilot training. These simulators offer pilots extensive experience in handling various complex and rare scenarios before they fly multi-million-dollar aircraft. After gaining sufficient experience, pilots can fly with a supervisor and ultimately assume full responsibility for the airplane and crew.

The current state of technology and science enables us to apply similar principles in the business environment. Digital twin technologies allow us to replicate real-world corporate decision-making environments to analyze the outcomes of hypothetical investment choices. This technology effectively simulates real-life scenarios even before implementation, facilitating comprehensive risk and reward assessments.

Such simulation-based approaches can be applied in three areas: (1) strengthening managerial foresight capabilities, (2) raising strategic awareness and conveying cyber risk management heuristics, and (3) optimizing communication and process quality in complex networks. For governing and overseeing cyber risks, only the first two areas are relevant.

Strengthening managerial foresight capabilities.

Utilizing digital twin technology and simulations to enhance managerial foresight provides executive decision-makers with an exploratory and interactive environment to evaluate how intended strategic decisions will perform in the future concerning critical performance indicators. These applications are calibrated to the specific organization, involving numerous test procedures. A crucial validation mechanism is that historical trends of critical performance indicators from management dashboards during a reference period will be replicated by the digital twin solution.

Typical applications of this approach include (1) assessing how a cyber risk management strategy is affected by organizational changes (people, processes, technology, suppliers) resulting from a digital transformation strategy, (2) determining which security program roadmap yields the best results for prioritizing investments in various security capabilities, (3) continuously monitoring the performance of security capabilities with a future-oriented perspective, (4) evaluating the “shelf-time” of a cyber risk management strategy, and (5) enhancing cyber risk management dashboards.

Below are two figures from case studies illustrating these applications. Figure 1 depicts the future simulated security resources required under the current cyber risk management strategy while 200 random attack patterns are launched, varying in attack strength, tactics, technologies, campaign durations, and exploited vulnerabilities. Figure 2 displays a trend prediction of cumulative security incidents over time under the current strategy (base) compared to three alternative investment scenarios.

Raising strategic awareness and conveying cyber risk management heuristics.

To raise awareness among business leaders and executives, a simplified version of the technology can be employed in a simulation gaming setting, where participants steer a virtual hypothetical organization with more straightforward decision-making options. In this context, security standards are simplified to prevention, detection, response, and recovery, while the application for strengthening managerial foresight capabilities incorporates a comprehensive cyber risk management framework.

Typical applications of this approach include (1) introducing cyber risk governance and oversight to management, (2) learning about specific challenges, such as combating ransomware from an organizational perspective, and (3) exploring how different settings influence decision-making processes. Figure 3 illustrates heuristics shared during executive training regarding the importance of timing when investing in cybersecurity. Figure 4 presents simulation gaming results comparing the quality of decision-making about risk (system at risk) between individuals (security strategists) and groups (security strategists and two non-technical executives).

We have conducted these training simulations with hundreds of executives, business leaders, security strategists, and executive students, particularly focusing on combating ransomware. On average, three simulation games were necessary to design an effective strategy against ransomware. Can you imagine what may happen if only one change was given while implementing a strategy in real life?

 

The three ways digital twin technology enhances cyber risk governance

In conclusion, the technological transformation of our society is reshaping numerous processes and activities. One example is the application of digital twin technology and simulation gaming as part of cyber risk governance and oversight. This approach offers several benefits:

• Simulations reveal the five-year future effects of intended strategic decisions, allowing management to augment existing dashboards and providing sufficient time for intervention or strategic change as future performance declines, can be observed early.
• It enables the exploration of different scenarios—prioritization, resourcing, and budgeting for cyber risk management efforts—to maximize profit and minimize risks before implementation.
• It provides a holistic view of cyber risk management while integrating business, operations and technology, and finance. This simplifies the governance process by connecting different perspectives. Larger organizations often have hierarchically separated departments covering these activities, each bound by its own functional policies and processes, which can hinder the creation of an integrated and holistic view.

The application of digital twin technology and simulation gaming allows for a rethinking of human-machine interaction. It involves interconnected groups of people and computers performing intelligent tasks—in this case, governing and overseeing cyber risks. A well-considered configuration can lead to significantly better strategic decisions.

Literature

Zeijlemaker, S., Pal, R., & Siegel, M. (2024). Strengthening Managerial Foresight to Defeat Cyber Threats, AMCIS 2024, August 15-17, Salt Lake City, Utah. https://aisel.aisnet.org/amcis2024/security/security/18/

Zeijlemaker, S. & Siegel, M. (2023). Capturing the Dynamic Nature of Cyber Risk: Evidence from an Explorative Case Study, Hawaii International Conference on System Sciences (HICSS) – 56, January 3-6, 2023, Hawaii. https://aisel.aisnet.org/hicss-56/os/cybersecurity/5/

Charlton, E. (2024, January 10). 2023 Was a Big Year for Cybercrime – Here’s How We Can Make Our Systems Safer, World Economic Forum. https://www.weforum.org/agenda/2024/01/cybersecurity-cybercrime-system-safety

Zeijlemaker, S., Siegel, M., Khan, S., & Goldsmith, S. (2022, August, 4). How to Align Cyber Risk Management with Business Needs. World Economic Forum, Cyber Security Working Group. https://www.weforum.org/agenda/2022/08/how-to-align-cyber-risk-management-with-business-needs/

Zeijlemaker, S., Hetner, C., & Siegel, M. (2023, June, 2). 4 Areas of Cyber Risk That Boards Need to Address, Harvard Business Review. https://hbr.org/2023/06/4-areas-of-cyber-risk-that-boards-need-to-address

Delvecchio, T., Zeijlemaker, S., De Bernardis, G., & Siegel, M. (2024). Revolutionizing Board Cyber-Risk Management Using Collaborative Gaming. In Proceedings of the 10th International Conference on Information Systems Security and Privacy, ISBN 978-989-758-683-5, ISSN 2184-4356, pages 112-119. https://www.scitepress.org/PublishedPapers/2024/123494/

Photo: Istock.com/stnazkul