We use cryptographic tools to aggregate sensitive cyber-risk data and learn how to help firms, companies, governments and organizations better defend their networks and data.
Read more about our ongoing research in the August 2020 edition of the Harvard Data Science Review:
Castro, L. de, Lo, A. W., Reynolds, T., Susan, F., Vaikuntanathan, V., Weitzner, D. J., & Zhang, N. (2020). SCRAM: A Platform for Securely Measuring Cyber Risk . Harvard Data Science Review.
We develop a new cryptographic platform called SCRAM (Secure Cyber Risk Aggregation and Measurement) that allows multiple entities to compute aggregate cyber risk measures without requiring any entity to disclose its own sensitive data on cyber attacks, penetrations, and losses. We present results from two computations using the SCRAM platform: (1) benchmarks of the adoption rates of 171 critical security measures across six large firms; and (2) links between monetary losses from 49 security incidents and the specific subcontrol failures implicated in the incident. These results provide insight into problematic cyber-risk control areas that need additional scrutiny and/or investment, but do so in a completely anonymized and privacy-preserving platform.