The Economic Impact of Extreme Cyber Risk Scenarios

Figures & data

TABLE 1 Schematic Representation of an Input–Output Transaction Table (Miller and Blair 2009)

		Producers as consumers								Final demand
		Agriculture	Mining	Construction	Manufacturing.	Trade	Transportation	Services	Other industry	Personal consumption expenditures	Gross private domestic investment	Govt. purchases of goods & services	Net exports of goods & services
Producers	Agriculture
	Mining
	Construction
	Manufacturing
	Trade
	Transportation
	Services
	Other industry
Value added	Employees	Employee compensation								Gross domestic product
	Business owners and capital	Profit-type income and capital consumption allowances
	Government	Indirect business taxes

TABLE 2 Analyzed Cyberattack Scenarios Classified According to the Computer and Network Incident Taxonomy

Scenario	Attackers	Tool	Vulnerability	Action	Target	Unauthorized result	Objectives
1)	Hackers, terrorists	User commands	Design vulnerability	Delete	Network	Denial of service	Political gain, damage
2)	Professional criminals	Toolkit	Implementation vulnerability	Authenticate	Internetwork	Denial of service	Financial gain
3)	Hackers, terrorists, professional criminals	Script or program	Design vulnerability	Delete	Network	Denial of service	Financial gain, political gain, damage
4)	Hackers, terrorists	Autonomous agent	Configuration vulnerability	Authenticate	Data, network	Denial of service	Financial gain, political gain
5)	Professional criminals	Autonomous agent	Design vulnerability	Modify	Component	Denial of service	Financial gain, political gain, damage
6)	Professional criminals	Autonomous agent	Design vulnerability	Delete	Network	Denial of service	Financial gain

TABLE 3 Summary of the Scenarios and the Respective Input Parameters for the Input–Output Analysis

Scenario	Risk factor	Affected sectors	Initial inoperability	Recovery time
1)	Supervisory control and data acquisition network/industrial control system extortion	D01T03, D10T12, D31T33, D35T39, D41T43, D49T53, D86T88	0.05–0.15*	21 days
2)	Cloud service failure	D62T63*	0.27	1–7 days
3)	Health sector and hospitals	D86T88	0.10–1.00	14–21 days
4)	Municipal services	D84	1.00	5 days
5)	Telecommunication	D61	0.18	7 days
6)	Cross-sector attack	D20T21, D26, D29, D35T39, D64T66	0.32–0.52**	10–12 days**

Note: All entries are taken from the cited studies, except for *not specified in the cited studies and self-estimated based on the scenario description and **average values of the other five scenarios.

TABLE 4 Top 10 Affected Sectors Based on Average Inoperability

		Economic loss		Average inoperability
Sector	Name	Rank	Value (mUS$)	Rank	Value (%)^26
D45T47	Wholesale and retail trade; repair of motor vehicles	1	2,283	19	0.36%
D86T88	Human health and social work	2	2,255	14	0.46%
D69T82	Human health and social work	3	1,997	20	0.32%
D49T53	Transportation and storage	4	1,846	3	0.83%
D10T12	Food products, beverages and tobacco	5	1,440	8	0.64%
D01T03	Agriculture, forestry, and fishing	6	1,424	1	1.29%
D05T06	Mining and extraction of energy producing products	7	1,344	2	0.98%
D41T43	Construction	8	1,306	13	0.51%
D64T66	Financial and insurance activities	9	1,202	25	0.19%
D19	Coke and refined petroleum products	10	0,878	16	0.42%

FIGURE 1. Inoperability Development of the Top 10 Inoperable Sectors.

FIGURE 2. Cumulative Economic Losses for the Top 10 Affected Sectors.

FIGURE 3. Dynamic Cross-Prioritization Plot.

TABLE 5 Summary of Total Economic Losses by Scenario

Scenario	Risk factor	Total economic damage (mUS$)
		Mean	Variation inoperability only					Variation inoperability & recovery time
			Min	Max	Range	Range/mean	Min		Max	Range	Range/mean
1)	Supervisory control and data acquisition network/industrial control system extortion	23,220	11,610	34,830	23,220	1.00	11,610		34,830	23,220	1.00
2)	Cloud service failure	722	—	—	—	—	542		1,264	722	1.00
3)	Health sector and hospitals	28,481	5,178	51,784	46,606	1.64	6,214		62,141	55,927	1.96
4)	Municipal services	23,261	—	—	—	—	—		—	—	—
5)	Telecommunication	1,521	—	—	—	—	—		—	—	—
6)	Cross-sector attack	34,881	26,756	43,186	16,430	0.47	24,160		47,112	22,952	0.66

Miller, R. E., and P. D. Blair. 2009. Input-output analysis: Foundations and extensions. Cambridge University Press.

 Google Scholar