# Cybersecurity Risk Assessment: A Systematic Mapping Review, Proposal, and Validation
## 4 Analyze and Discuss the Results
### Risk Measurement
#### 4.3.2 Quantitative Tools
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Tool** & **Underlying Measurement Method** & **Input Variables for Risk Measurement** \\ \hline CRISM tool & Common vulnerability scoring system (CVSS) & The impact of exploiting the vulnerability, the asset values, how the vulnerability can be exploited, the complexity required for the vulnerability to be exploited, and how many instances of authentication are required to exploit the vulnerability. \\ \hline Rimsha, tool & Common vulnerability scoring system (CVSS) & The damage assessment, the threat assessment, and the probability of the event. \\ \hline Quantitative network security risk situation model & Common vulnerability scoring system (CVSS) & A BAG (Bayesian attack graph) tuple that considers the values of the following variables: threat capacity, vulnerability-exploiting probability metric, expected time for vulnerability exploits, expected time for vulnerability removals, and threat prediction (goal, path, probability, time). \\ \hline RL-BAGS & Q-Learning model and SARSA learning & The asset value (AV), rate of occurrence (RO), risk exposure (RE), probability of compromise (POC), influence of function (IOF), and cost to patch (CTP). \\ \hline Data Protection Impact Assessment tool & Joint risk and trust model (JRTM) & The adjusted probability, the vulnerability index, the adjusted impact, and the asset index. \\ \hline [PERSON]. [PERSON] model & [PERSON] model & The basic operation dimension, the vulnerability dimension, and the threat dimension. \\ \hline Mobile risk calculator & SANS Institute quantitative risk analysis step by step & The annualized rate of occurrence (ARO), the annualized loss expectancy (ALE), and internal rate of return (IRR). \\ \hline [PERSON]. [PERSON] model & Semantic reasoning algorithm and web rules language (SWRL) & The residual risk of the threat, the decreasing value of the impact (severity), the probability of the threat before and after applying a countermeasure, and the impact (severity) of the threat when it materializes. \\ \hline Teng. algorithm & Analytical hierarchy process (AHP) & The value of the asset, the value of the threat, the value of the vulnerability, the impact of a loss of assets, the degree of exposure of the assets, the control measures, and the consequences of breach of confidentiality, integrity, and availability. \\ \hline CYRVM & Two algorithms: one for calculating the arithmetic mean of vulnerabilities and another for the factoring matrix & The probability, the number of vulnerabilities, the number of systems, the value of the impact or likelihood of the vulnerability of a system in a test set, the calculated value of impact or likelihood of system vulnerability, the maximum deviation of the calculated value and a test set. \\ \hline OSINT & Simple relationships between variables & The numerical value relative to the importance of the information in the organization. \\ \hline MST risk analysis & A recursive type of algorithm relating network nodes & The impact of a disruption being realized into a network traffic, and the dependency of asset. \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Quantitative risk measurement models in tools. such as the Markov model, the semantic reasoning algorithm and web rules language, and the analytical hierarchy process (AHP). These algorithms are used together with variables such as the probability of occurrence and impact to measure risk. Finally, some tools, such as the CYRVM and OSINT tools, use quantitative risk measurement algorithms created by the relationships between the variables defined by the authors. The variables used in the case of these algorithms are diverse. However, some standard variables considered by the other tool groups are asset value, vulnerability, probability of occurrence, and risk for these two tools. Quantitative tools generally measure risk based on the probability of occurrence and impact parameters. However, they also usually consider other sub-parameters, which they relate to through pre-established algorithms.