Abstract
Security assessments are an integral part of organisations’ strategies for protecting their digital assets and critical IT infrastructure. In this paper we propose a game-theoretic modelling of a particular form of security assessment – one which addresses the question “are we compromised?”. We do so by extending the recently proposed game “FlipIt”, which itself can be used to model the interaction between defenders and attackers under the Advanced Persistent Threat (APT) scenario. Our extension gives players the option to “test” the state of the game before making a move. This allows one to study the scenario in which organisations have the option to perform periodic security assessments of such nature, and the benefits they may bring.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Bejtlich, R.: Testimony before the USCC Hearing on “Developments in China’s Cyber and Nuclear Capabilities” (March 26, 2012), http://www.uscc.gov/hearings/2012hearings/written_testimonies/hr12_03_26.php
Billo, C.G.: Cyber warfare: An analysis of the means and motivations of selected nation states. Technical report, Institute for Security Technology Studies at Darthmouth College (2004)
Böhme, R., Félegyházi, M.: Optimal Information Security Investment with Penetration Testing. In: Alpcan, T., Buttyán, L., Baras, J.S. (eds.) GameSec 2010. LNCS, vol. 6442, pp. 21–37. Springer, Heidelberg (2010)
Böhme, R., Moore, T.: The iterated weakest link: A model of adaptive security investment. In: Workshop on the Economics of Information Security, WEIS (2009)
Chabrow, E.: Identifying undetected breaches identifying undetected breaches: How data scientists analyze big data to spot vulnerabilities (April 20, 2012), http://www.bankinfosecurity.co.uk/interviews/identifying-undetected-breaches-i-1542
Coviello, A.: Open letter to RSA customers (March 17, 2011), http://www.rsa.com/node.aspx?id=3872
Gordon, L.A., Loeb, M.P.: The economics of information security investment. ACM Transactions in Information System Security 5(4), 438–457 (2002)
Kunreuther, H., Heal, G.: Interdependent Security. Journal of Risk and Uncertainty 26(2), 231–249 (2007)
Langner, R.: Stuxnet: Dissecting a cyber warfare weapon. IEEE Security & Privacy 9(3), 49–51 (2011)
Manshaei, M.H., Zhu, Q., Alpcan, T., Basar, T., Hubaux, J.: Game Theory Meets Network Security and Privacy. Technical report, EPFL (2010)
National Institute of Standards and Technology. Technical Guide to Information Security Testing and Assessment. Special Publication 800–115 (2008)
National Institute of Standards and Technology. Recommended security controls for federal information systems and organizations. Special Publication 800–53 (2009)
Raya, M., Shokri, R., Hubaux, J.: On the tradeoff between trust and privacy in wireless ad hoc networks. In: Proceedings of the Third ACM Conference on Wireless Network Security, WiSec 2010, pp. 75–80. ACM, New York (2010)
van Dijk, M., Juels, A., Oprea, A., Rivest, R.L.: Flipit: The game of “stealthy takeover”. Cryptology ePrint Archive, Report 2012/103 (2012)
Vijayan, J.: Breach, undetected since 2005, exposes data on Kingston customers (July 17, 2007), http://www.computerworld.com/s/article/9027220/Breach_undetected_since_05_exposes_data_on_Kingston_customers
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Pham, V., Cid, C. (2012). Are We Compromised? Modelling Security Assessment Games. In: Grossklags, J., Walrand, J. (eds) Decision and Game Theory for Security. GameSec 2012. Lecture Notes in Computer Science, vol 7638. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-34266-0_14
Download citation
DOI: https://doi.org/10.1007/978-3-642-34266-0_14
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-34265-3
Online ISBN: 978-3-642-34266-0
eBook Packages: Computer ScienceComputer Science (R0)