Systematic review: cybersecurity risk taxonomy

Abstract

In cybersecurity,the identification of risks is a fundamental part because this activity is not unique to cybersecurity and it is hardto know what the risks in this areaare. This study aims to identify if there are some risk taxonomies in cybersecurity.For this, a systematic review of the studies published from 1990to 2017 was carried out. We found 132papersand some of them mention some risk taxonomieswithin the scope of IT (information technologies)cybersecurity, althoughonly five primary elementswere selected, identifying the main risk taxonomies. A classification of cybersecurity risk taxonomy types has been adapted, with the inclusion of new categories, categorized according to their perspective and domain.We have analysed the taxonomies form a proposed five level perspective. Finally, it has been observed that risk taxonomies may be shifting the focus from the asset level to service and business level.