A multi-objective decision support framework for simulation-based security control selection

Autor(en)

Elmar Kiesling, Christine Strauß, Christian Stummer

Abstrakt

In this paper, we report on our ongoing research on simulation-based information security risk assessment and multi-objective optimization of investment in security controls. We outline a methodological framework that accounts for characteristics of the organization, its information infrastructure, assets to be protected, the particular threat sources it faces, and the decision-makers' risk preferences. This framework comprises (i) ontological modeling of security knowledge, (ii) dynamic attack graph generation techniques, (iii) probabilistic simulation of attacks by goal-driven threat agents, (iv) meta-heuristic identification of efficient portfolios of information security controls, and (v) interactive decision support. These components facilitate novel techniques to infer possible routes of attacks and generate attack graphs based on attackers' motivation, objectives, capabilities, and available modes of entry and to use this inferred knowledge to simulate attacks on an organization's modeled infrastructure. The method supports decision makers evaluating potential security control investments in striking a balance between monetary and non-monetary criteria regarding risks, costs, and benefits. We are currently in the process of developing a prototypical implementation of the framework that will be used to evaluate the approach through application case studies.

Organisation(en)

Institut für Rechnungswesen, Innovation und Strategie

Externe Organisation(en)

Secure Business Austria (SBA), Universität Bielefeld

Seiten

454-462

Anzahl der Seiten

9

DOI

https://doi.org/10.1109/ARES.2012.70

Publikationsdatum

11-2012

Peer-reviewed

Ja

ÖFOS 2012

102016 IT-Sicherheit, 101015 Operations Research, 502050 Wirtschaftsinformatik

Schlagwörter

ASJC Scopus Sachgebiete

Safety, Risk, Reliability and Quality

Link zum Portal

https://ucris.univie.ac.at/portal/de/publications/a-multiobjective-decision-support-framework-for-simulationbased-security-control-selection(49b09d12-7eb4-48ce-9585-535e5687f541).html