Applying the Cybersecurity Game to a Point-of-Sale System

Abstract

The objective of this chapter is to describe the application of the cybersecurity game (CSG) to a point-of-sale (PoS) system and the knowledge discovered from these activities. All PoS systems process over 195 billion electronic transactions with a volume of over US $28.8 trillion per year. In 2014, there were 79,790 cybersecurity incidents reported affecting PoS. There exists a pressing need to understand the cost-benefit for cybersecurity risk reduction investments; however, risk reduction investments face resource limitations. CSG was applied to a PoS to address this need. CSG is a methodology and software tool that models the cyber risk of information and communication technology (ICT) systems. CSG produces security portfolios that are Pareto optimal against quantitative cyber risk and investment costs. CSG identifies the set of defensive methods that best reduce cyber risk for any given investment level. The nominal risk score without employing any defensive methods is 8,492,934. The best risk reduction can be achieved using all of the tools at a cost of ~250,000; however, 89% of the risk reduction is achieved by spending only ~16% of the cost. Additionally, two defense methods were found to provide major reductions in risk. The first is to segment the network between PoS systems and the remainder of the merchant’s ICT system. The second was to encrypt information throughout the merchant’s ICT system.