# Cyber Security Risk Modeling in Distributed Information Systems
## 2 Literature Review and Problem Statement  
### Research Background  
Every business is regularly exposed to the risk of unexpected, unpredictable information security events that can cause financial losses and significant damage to a company's infrastructure or reputation. The risk management process reduces both the likelihood of potential security incidents and their impact on existing business processes. Effective risk management is aimed at optimizing the company's success (including financial success) by minimizing threats [10; 11; 12; 13]. According to the Deloitte research \"Cyber risk reporting in the UK 2016\", 87% of companies consider cybersecurity risks a key factor in strategic business process planning (Figure 1). At the same time, the main areas today are the risks associated with cybercrime and information security threats (over 72% of respondents consider them a priority), data theft (33%), protection of confidential information (59%), and failure of IT infrastructure elements (71%) [14]. Literature review in this area has shown that risk assessment is one of the most difficult and urgent tasks in the process of information security management. There are no generally accepted approaches and methods for risk assessment [15; 16; 17; 18]. Also, the risk assessment procedure is a time-consuming task. Performing the analysis manually, using office tools, is almost impossible due to the large amount of information for processing and the high probability of obtaining weak results. Modern risk management techniques are based on the use of the probability of threats, damage, and vulnerabilities. However, in most cases, information security experts conduct the assessment in the form of verbal formulations and then associate them with numerical values, using their own experience. This method of obtaining risk assessments significantly  
Figure 1: Types of cyber risks according to the annual Deloitte research “Cyber risk reporting in the UK 2016”. limits the possibilities of the methodology in general, as risk factors (threat, vulnerability, and damage) are analyzed using heuristic methods, resulting in different data if the examination was conducted by different experts. Therefore, confidence in the expert's assessment may be debatable [19]. On the other hand, most risk analysis methods today focus on calculating only technical vulnerabilities, which does not allow for adequately assessing the economic aspects of the impact (Figure 2) [20]. Marsh and Microsoft's 2022 Global Cyber Risk study is currently underway [21]. Another problem that risk experts may face is the complexity and large infrastructures of modern organizations and the widespread implementation of distributed information systems. Even for a medium-sized company, the number of assets can reach tens of thousands. And this in turn creates problems associated with the analysis of information resources of the organization and data aggregation from different sources in conditions of data allocation and general functional distribution. Moreover, information systems have a distributed architecture consisting of a large number of components. Collection and analysis of metadata and metrics about their work significantly complicate the process of risk analysis. Modern techniques are slow and do not provide the desired result. The evaluation process takes a long time, which is accompanied by a rapid loss of relevance [22]. Research in the field of risk management was carried out by Ukrainian and Polish researchers [PERSON], [PERSON], [PERSON] et al. [23; 24]. The study [23] concerns stakeholder risk management in integrated projects of the European Green Deal. The article substantiates the need to develop tools (models, methods, and algorithms) for quantitative risk assessment of each type of project (e.g., agricultural waste and their components and justification of risk response). The article [24] is devoted to planning and risk analysis in projects for the procurement of agricultural raw materials for the production of environmentally friendly fuel.