Optimizing Investments in Cyber Hygiene for Protecting Healthcare Users
Cyber hygiene measures are often recommended for strengthening an organization’s security posture, especially for protecting against social engineering attacks that target the human element. However, the related recommendations are typically the same for all organizations and their employees, regardless of the nature and the level of risk for different groups of users. Building upon an existing cybersecurity investment model, this paper presents a tool for optimal selection of cyber hygiene safeguards, which we refer as the Optimal Safeguards Tool (OST). The model combines game theory and combinatorial optimization (0-1 Knapsack) taking into account the probability of each user group to being attacked, the value of assets accessible by each group, and the efficacy of each control for a particular group. The model considers indirect cost as the time employees could require for learning and trainning against an implemented control. Utilizing a game-theoretic framework to support the Knapsack optimization problem permits us to optimally select safeguards’ application levels minimizing the aggregated expected damage within a security investment budget.
We evaluate OST in a healthcare domain use case. In particular, on the Critical Internet Security (CIS) Control group 17 for implementing security awareness and training programs for employees belonging to the ICT, clinical and administration personnel of a hospital. We compare the strategies implemented by OST against alternative common-sense defending approaches for three different types of attackers: Nash, Weighted and Opportunistic. Our results show that Nash defending strategies are consistently better than the competing strategies for all attacker types with a minor exception where the Nash defending strategy, for a specific game, performs at least as good as other common-sense approaches. Finally, we illustrate the alternative investment strategies on different Nash equilibria (called plans) and discuss the optimal choice using the framework of 0-1 Knapsack optimization.
KeywordsCybersecurity Cyber hygiene Healthcare Optimization Training and awareness CIS control Game theory
We thank the reviewers for their valuable feedback and comments.
Emmanouil Panaousis is partially supported by the European Commission as part of the CUREX project (H2020-SC1-FA-DTS-2018-1 under grant agreement No. 826404). The work of Christos Laoudias has been partially supported by the CUREX project (under grant agreement No. 826404), by the European Union’s Horizon 2020 research and innovation programme (under grant agreement No. 739551 (KIOS CoE)), and from the Republic of Cyprus through the Directorate General for European Programmes, Coordination and Development.
- 1.Mohammadi, F., Panou, A., Ntantogian, C., Karapistoli, E., Panaousis, E., Xenakis, C.: CUREX: seCUre and pRivate hEalth data eXchange. In: IEEE/WIC/ACM International Conference on Web Intelligence, vol. 24800, pp. 263–268 (2019)Google Scholar
- 5.Solans Fernández, O., et al.: Shared medical record, personal health folder and health and social integrated care in catalonia: ICT services for integrated care. In: Rinaldi, G. (ed.) New Perspectives in Medical Records. T, pp. 49–64. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-28661-7_4CrossRefGoogle Scholar
- 8.Loukas, G.: Cyber-Physical Attacks: A Growing Invisible Threat. Butterworth-Heinemann, Oxford (2015)Google Scholar
- 13.Furnell, S., Sanders, P., Warren, M.: Addressing information security training and awareness within the european healthcare community. Stud. Health Technol. Inform. 43, 707–711 (1997)Google Scholar
- 14.Heartfield, R., Loukas, G.: A taxonomy of attacks and a survey of defence mechanisms for semantic social engineering attacks. ACM Comput. Surv. 48(3), 37 (2016)Google Scholar
- 16.Wash, R., Cooper, M.M.: Who provides phishing training?: facts, stories, and people like me. In Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems, p. 492. ACM (2018)Google Scholar
- 19.Fielder, A., Panaousis, E., Malacaria, P., Hankin, C., Smeraldi, F.: Game Theory Meets Information Security Management. In: Cuppens-Boulahia, N., Cuppens, F., Jajodia, S., Abou El Kalam, A., Sans, T. (eds.) SEC 2014. IAICT, vol. 428, pp. 15–29. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-642-55415-5_2CrossRefzbMATHGoogle Scholar
- 24.Whitman, M.E., Mattord, H.J.: Principles of Information Security. Cengage Learning, Boston (2011)Google Scholar
- 25.Smeraldi, F., Malacaria, P.: How to spend it: optimal investment for cyber security. In: Proceedings of the 1st International Workshop on Agents and CyberSecurity, p. 8. ACM (2014)Google Scholar
- 28.Nash, J.F.: Equilibrium points in n-person games. In: Proceedings of the National Academy of Sciences, pp. 48–49 (1950)Google Scholar