# Despite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics
## 2 Related Work
### Aggregation
Three additional properties are important in the security context. The possibility to prioritise certain metrics over others is desirable [47]. Formally, we consider a strategy to allow for prioritiisation when for any \(a,b>0\), \(a\
eq b\), there exists a pair \(i,j\) with \(i\
eq j\), such that \(S(x_{1},\ldots,x_{i}=a,\ldots,x_{j}=b,\ldots,x_{n})\
eq S(x_{1},\ldots,x_{i}= b,\ldots,x_{j}=a,\ldots,x_{n})\). Strategies should also be able to accommodate dependencies between security metrics. However, it is complicated to include metric dependencies, with some seeing it as \"the most challenging task\" in aggregation [18]. For strategies in the set \(\mathbb{D}\) of strategies that satisfy the necessary differentiability properties, we define a strategy \(S\) to allow for dependencies, when there exist distinct metrics \(i\), \(j\), and \(k\) such that:  
\[\frac{\partial^{2}S}{\partial x_{i}\partial x_{j}}\
ot\propto\frac{\partial^{ 2}S}{\partial x_{i}\partial x_{k}}. \tag{1}\]  
Equation (1) captures the idea that a strategy \(S\) allows for dependencies among metrics when it allows for relationships among metrics that are not proportional to other relationships. For aggregation strategies \(S\
otin\mathbb{D}\), we employ the same verbal definition. Care should be taken to adjust the criterion of Equation (1) appropriately where it cannot be applied directly for the strategy \(S\). A last core principle in security is that systems are only as secure as their weakest link [48]. Assuming that we have at least two distinct values among our metrics, there exists a minimum value \(x_{min}\) and a maximum value \(x_{max}\). Since we assume metrics relate negatively to security, \(x_{max}\) corresponds to the weakest link. A strategy \(S\) satisfies the weakest link principle if for any \(a>0\), \(S(x_{min}+a,\ldots,x_{max})\leq S(x_{min},\ldots,x_{max}+a)\), and there exists an \(\alpha>0\), such that \(S(x_{min}+\alpha,\ldots,x_{max})<S(x_{min},\ldots,x_{max}+\alpha)\). Thus, weakening the weakest link has more impact than weakening the strongest link with an equal amount. The most common aggregation strategy employed in the literature is the weighted linear combination (WLC), which can be defined as:  
\[S_{WLC}(\mathbf{x})=a+\frac{\sum_{i=1}^{n}w_{i}\cdot x_{i}}{b},\,a\geq 0,\;b>0, \;w_{i}>0\;\forall i. \tag{2}\]  
WLC contains the special cases of the weighted sum (\(a=0,\;b=1\)), the weighted average (\(a=0,\;b=\sum w_{i}\)), and the arithmetic mean (\(a=0,\;b=n,\;w_{i}=1\;\forall i\)). WLC strategies are injective, idempotent, and allow for prioritisation through weighting. However, these strategies do not allow for dependencies and do not satisfy the weakest link principle. A related set of strategies are the weighted product (WP) strategies:  
\[S_{WP}(\mathbf{x})=a+b\cdot\prod_{i=1}^{n}x_{i}^{w_{i}},\;a\geq 0,\;b>0,\;w_{i} \in(0,1]\;\forall i. \tag{3}\]  
Among the WP strategies are the simple product (\(a=0,\;b=1,\;w_{i}=1\;\forall i\)) and the geometric mean (\(a=0,\;b=1,\;w_{i}=\frac{1}{n}\;\forall i\)). WP strategies satisfy the same properties as WLC strategies, except for the idempotence property, which these strategies do not satisfy. Using the weighted maximum (WM) - \(S_{WM}(\mathbf{x})=max\{w_{1}\cdot x_{1},\ldots,w_{n}\cdot x_{n}\},\;w_{i}>0 \;\forall i\) metric value as the aggregated value is uncommon in most disciplines, since this strategy is not injective. However, it is used in the security field [49], and is in fact an extreme case of satisfying the weakest link principle. WM allows for prioritisation, although the basic maximum function does not. The complementary product is another aggregation strategy that is uncommon outside of the security field [49]. Let \(\hat{x}_{i}\), for \(i=1,2,\ldots,n\), denote the metric value normalised to \([0,1)\). Let \(w_{i}\) be the weight of metric \(i\) for \(i=1,2,\ldots,n\).