# Despite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics
## 2 Related Work
### Aggregation  
In cybersecurity metric research, aggregation strategies vary, although the importance of proper aggregation is widely recognised [17; 18]. To discuss different aggregation strategies, we define a mathematical context with an aggregation strategy \(S:\mathbb{R}^{n}_{\geq 0}\to\mathbb{R}_{\geq 0}\), where \(\mathbb{R}_{\geq 0}\) is the set of non-negative real numbers. We define metric value variables \(x_{i}\), corresponding to metrics \(i=1,\ldots,n\). The metric values are assumed to be non-negative: \(x_{i}\in\mathbb{R}_{\geq 0}\,\forall i\). We assume that for each metric, a higher metric value corresponds to lower security, without loss of generality. A negative relationship between a metric and security is common in the security literature, as it is often the lack of security, or risk, which is being measured. A desirable property of a strategy \(S\) is that it is responsive to changes in metric values. This is captured by the property of injectivity, where we consider a strategy \(S\) to be injective when for \(a,b\in\mathbb{R}_{\geq 0}\), \(a\
eq b\), \(S(a,x_{1},x_{2},\ldots,x_{n})\
eq S(b,x_{1},x_{2},\ldots,x_{n})\). Injectivity implies that a change in a metric value will always result in a change of the aggregate, provided all else remains constant. A stronger requirement would be strict monotonicity of the strategy \(S\). Although this property could be desirable in the cybersecurity context, we only consider the less strict injectivity in this paper. \begin{table}
\begin{tabular}{l l l c} \hline \hline
**Research** & **Year** & **Focus Area** & **Social Factors Evaluated** \\ \hline Current paper & 2021 & Generic & \\ [PERSON] [29] & 2009 & Generic & \(\times\) \\ [PERSON] and Schwarz [30] & 2012 & Generic & \(\times\) \\ [PERSON] et al. [17] & 2016 & Generic & \(\checkmark\) \\ [PERSON] et al. [18] & 2019 & Generic & \(\checkmark\) \\ [PERSON] et al. [31] & 2019 & Attack Prediction & \(\checkmark\) \\ Iannacone and Bridges [32] & 2020 & Cyber Defense & \(\times\) \\ [PERSON] et al. [33] & 2014 & Directed Acyclic Graphs & \(\times\) \\ [PERSON] et al. [34] & 2020 & Incident Management & \(\checkmark\) \\ [PERSON] et al. [35] & 2015 & Industrial Control Systems & \(\checkmark\) \\ [PERSON] et al. [36] & 2019 & Industrial Control Systems & \(\checkmark\) \\ [PERSON] et al. [37] & 2019 & Industrial Control Systems & \(\times\) \\ [PERSON] et al. [38] & 2019 & Internet Security & \(\times\) \\ [PERSON] et al. [39] & 2020 & Moving Target Defense & \(\times\) \\ [PERSON] and [PERSON] [40] & 2013 & Network Security & \(\times\) \\ [PERSON] et al. [41] & 2017 & Network Security & \(\checkmark\) \\ [PERSON] et al. [42] & 2016 & SCADA Systems & \(\checkmark\) \\ [PERSON] et al. [43] & 2018 & Software Security & \(\times\) \\ [PERSON] et al. [44] & 2019 & Unknown Vulnerabilities & \(\times\) \\ [PERSON] et al. [45] & 2019 & Wireless Networks & \(\times\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Existing cybersecurity metric (systematic) reviews. The research focus area is shown, with “generic” indicating research without a specific focus area. We consider social factors to be evaluated when the review covers socio-technical cybersecurity metrics. A common property of averages, which constitute a specific branch of aggregation, is idempotence. A strategy \(S\) is idempotent, when for \(a\in\mathbb{R}_{\geq 0}\), \(S(a,a,\ldots,a)=a\). When an aggregation strategy \(S\) is both injective and idempotent, the result of the aggregation always lies between the minimum and the maximum values of all metrics. Both injectivity and idempotence capture what we would intuitively expect of an aggregation strategy, as these are properties satisfied by the Pythagorean means. In this sense, these are desirable properties in the context of SMEs, where cybersecurity knowledge is often lacking. To still allow employees to feel competence and relatedness [25] in the complex cybersecurity setting, we should at least use an aggregation strategy they understand.