An Empirically Derived Loss Taxonomy Based on Publicly Known Security Incidents

In this paper we focus on the losses related to information and IT security incidents. The loss dimension in terms of business impacts is often treated only superficially in current standards, best practices and the research literature. The main focus lies often on the impacts on properties of information and services like confidentiality, integrity and availability. We make a step in the direction of filling this gap by developing a more systematic taxonomy of losses. For this purpose publicly announced security incidents have been analysed using cause- consequence diagrams to identify different types of losses. The identified causes of incidents and the resulting types of losses have been classified using an enterprise model to distinguish different levels of abstraction. This exploratory and descriptive research yielded a) a preliminary taxonomy of losses related to security incidents, b) a validation of the enterprise model used as a frame for the analysis and c) different paths of propagation of causes of incidents.