  Cyber hygiene measures are often recommended for strengthening an
organization's security posture, especially for protecting against social
engineering attacks that target the human element. However, the related
recommendations are typically the same for all organizations and their
employees, regardless of the nature and the level of risk for different groups
of users. Building upon an existing cybersecurity investment model, this paper
presents a tool for optimal selection of cyber hygiene safeguards, which we
refer as the Optimal Safeguards Tool. The model combines game theory and
combinatorial optimization taking into account the probability of each user
group to being attacked, the value of assets accessible by each group, and the
efficacy of each control for a particular group. The model considers indirect
cost as the time employees could require for learning and training against an
implemented control. Utilizing a game-theoretic framework to support the
Knapsack optimization problem permits us to optimally select safeguards'
application levels minimizing the aggregated expected damage within a security
investment budget. We evaluate OST in a healthcare domain use case. The
Critical Internet Security Control group 17 for implementing security awareness
and training programs for employees belonging to the ICT, clinical and
administration personnel of a hospital. We compare the strategies implemented
by OST against alternative common-sense defending approaches for three
different types of attackers: Nash, Weighted and Opportunistic. Nash defending
strategies are consistently better than the competing strategies for all
attacker types with a minor exception where the Nash defending strategy
performs at least as good as other common-sense approaches.
