Mission-Oriented Security Model, Incorporating Security Risk, Cost and Payout
One of the most difficult challenges facing network operators is to estimate risk and allocate resources in adversarial environments. Failure to properly allocate resources leads to failed activities, poor utilization, and insecure environments. In this paper, we explore an optimization-based approach to allocating resources called a mission-oriented security model. This model integrates security risk, cost and payout metrics to optimally allocate constrained secure resources to discrete actions called missions. We model this operation as a Mixed Integer Linear Program (MILP) which can be solved efficiently by different optimization solvers such as MATLAB MILP solver, IBM-CPLEX optimizer or CVX solver. We further introduce and explore a novel method to evaluate security risk in resource planning using two datasets—the Ponemon Institute cost of breach survey and CSI/FBI surveys of security events. Data driven simulations are used to validate the model robustness and uncover a number of insights on the importance of risk valuation in resource allocation.
Research was sponsored by the Army Research Laboratory and was accomplished under Cooperative Agreement Number W911NF-13-2-0045 (ARL Cyber Security CRA). The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Army Research Laboratory or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation herein.
- 3.Celik, Z.B., et al.: Mapping sample scenarios to operational models. In: Military Communications Conference (MILCOM) (2016)Google Scholar
- 5.Dekker, M., Liveri, D.: Cloud security guide for SMEs-cloud computing security risks and opportunities for SMEs. European Union Agency for Network and Information Security (ENISA) (2015)Google Scholar
- 8.Gordon, L.A., Loeb, M.P., Lucyshyn, W., Richardson, R.: 2006 CSI/FBI computer crime and security survey (2006). www.lfca.net/Reference Documents/2006CSI-FBI Survey.pdf. Accessed 11 Jan 2018
- 10.Hoo, K.J.S.: How Much is Enough? A Risk Management Approach to Computer Security. Stanford University, Stanford (2000). Consortium for Research on Information Security and PolicyGoogle Scholar
- 11.Hu, N., La Porta, T., Bartolini, N.: Self-adaptive resource allocation for event monitoring with uncertainty in sensor networks. In: IEEE Mobile Ad Hoc and Sensor Systems (MASS) (2015)Google Scholar
- 12.Information technology - Security techniques - Information security risk management (2017). http://www.iso27001security.com/html/27005.html. Accessed 11 Jan 2018
- 15.McDaniel, P., et al.: Security and science of agility. In: ACM Workshop on Moving Target Defense (2014)Google Scholar
- 17.Papoulis, A., Pillai, S.U.: Probability, Random Variables, and Stochastic Processes. Tata McGraw-Hill Education, New York City (2002)Google Scholar
- 18.Ponemon Institute: Cost of cyber crime study and the risk of business innovation (2016). http://www8.hp.com/us/en/software-solutions/ponemon-cyber-security-report/. Accessed 11 Jan 2018
- 19.Richardson, R.: Issues and trends: 2003 CSI/FBI computer crime and security survey (2003). www.lfca.net/Reference Documents/2003-CSI-FBI-Survey.pdf. Accessed 11 Jan 2018
- 20.Richardson, R.: 2010/2011 computer crime and security survey (2010)Google Scholar
- 21.Schneidewind, N.F.: Cyber security prediction models. In: Systems and Software Engineering with Applications (2005)Google Scholar