A Risk Assessment Model for Enterprise Network Security

  • Fu-Hong Yang
  • Chi-Hung Chi
  • Lin Liu
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4158)


A formal model of security risk assessment for an enterprise information security is developed. The model, called the Graph Model, is constructed based on the mapping of an enterprise IT infrastructure and networks/systems onto a graph. Components of the model include the nodes which represent hosts in enterprise network and their weights of importance and security, the connections of the nodes, and the safeguards used with their costs and effectiveness. The model can assist to identify inappropriate, insufficient or waste protector resources like safeguards that are relative to the needs of the protected resources, and then reallocates the funds or protector resources to minimize security risk. An example is provided to represent the optimization method and process. The goal of using Graph Model is to help enterprise decision makers decide whether their security investment is consistent with the expected risks and how to allocate the funds or protector resources.


Graph Model Security Risk Risk Assessment Model Protector Resource Security Investment 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Hoo, K.J.S.: How Much Is Enough? A Risk-Management Approach to Computer Security. In: Consortium for Research on Information Security and Policy (CRISP), Stanford University (June 2000)Google Scholar
  2. 2.
    Schechter, S.E.: Computer Security Strength & Risk: A Quantitative Approach. In: Doctoral Dissertation, Harvard University (May 2004)Google Scholar
  3. 3.
    Butler, S.A.: Security Attribute Evaluation Method: A Cost-Benefit Approach. In: Proc. 24th Int’l Conf. Software Eng (ICSE 2002), pp. 232–240. IEEE CS Press, Los Alamitos (2002)CrossRefGoogle Scholar
  4. 4.
    Anderson, E., Choobineh, J., Grimaila, M.R.: An Enterprise Level Security Requirements Specification Model. In: HICSS (2005)Google Scholar
  5. 5.
    Nathan, P., Hurley, W.: Non-Equilibrium Risk Models in Enterprise Network Security. In: Symbiot, Inc. P.O. Box 9646 Austin, TX 78766-9646Google Scholar
  6. 6.
    Moore, D., Voelker, G.M., Savage, S.: Quantitative Network Security Analysis. In: Cooperative Association for Internet Data Analysis (CAIDA), NSF-01-160 (2002)Google Scholar
  7. 7.
    Schechter, S.E.: Toward Econometric Models of the Security Risk from Remote Attacks. In: Proceedings of the Third Annual Workshop on the Economics of Information Security (2004)Google Scholar
  8. 8.
    Siegel, C.A., Sagalow, T.R., Serritella, P.: Cyber-Risk Management: Technical and Insurance Controls for Enterprise-Level Security. Information Systems Security 11(4) (2002)Google Scholar
  9. 9.
    Stephenson, P.R.: A Formal Model for Information Risk Analysis Using Colored Petri Nets. In: Colored Petri Nets (CPN) (2004)Google Scholar
  10. 10.
    O’Donnell, A.J., Sethu, H.: On Achieving Software Diversity for Improved Network Security using Distributed Coloring Algorithms. In: ACM Conference on Computer and Communications Security, pp. 121–131 (October 2004)Google Scholar
  11. 11.
    McCabe, B., Ford, D.: Using Belief Networks to Assess Risk. In: Winter Simulation Conference, pp. 1541–1546 (2001)Google Scholar
  12. 12.
    Kim, J., Radhakrishnan, S., Dhall, S.K.: Measurement and Analysis of Worm Propagation on Internet Network Topology. In: IEEE ICCCN 2004 Technical Program, pp. 495–500 (October 2004)Google Scholar
  13. 13.
    Ahuja, R.K., Orlin, J.B.: Graph and Network Optimization,
  14. 14.

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Fu-Hong Yang
    • 1
  • Chi-Hung Chi
    • 1
  • Lin Liu
    • 1
  1. 1.School of SoftwareTsinghua UniversityBeijingChina

Personalised recommendations