Publications
2012
Kiesling, Elmar; Strauß, Christine; Stummer, Christian
A multi-objective decision support framework for simulation-based security control selection Konferenzbeitrag
In: Proceedings - 2012 7th International Conference on Availability, Reliability and Security, ARES 2012, S. 454–462, 2012, ISBN: 9780769547756, (2012 7th International Conference on Availability, Reliability and Security, ARES 2012 ; Conference date: 20-08-2012 Through 24-08-2012).
Abstract | Links | BibTeX | Schlagwörter: computational modeling, Decision support systems, HBE, human factors, security and protection, Simulation, systems analysis and design
@inproceedings{49b09d127eb448ce9585535e5687f541,
title = {A multi-objective decision support framework for simulation-based security control selection},
author = {Elmar Kiesling and Christine Strauß and Christian Stummer},
doi = {10.1109/ARES.2012.70},
isbn = {9780769547756},
year = {2012},
date = {2012-11-26},
booktitle = {Proceedings - 2012 7th International Conference on Availability, Reliability and Security, ARES 2012},
pages = {454--462},
abstract = {In this paper, we report on our ongoing research on simulation-based information security risk assessment and multi-objective optimization of investment in security controls. We outline a methodological framework that accounts for characteristics of the organization, its information infrastructure, assets to be protected, the particular threat sources it faces, and the decision-makers' risk preferences. This framework comprises (i) ontological modeling of security knowledge, (ii) dynamic attack graph generation techniques, (iii) probabilistic simulation of attacks by goal-driven threat agents, (iv) meta-heuristic identification of efficient portfolios of information security controls, and (v) interactive decision support. These components facilitate novel techniques to infer possible routes of attacks and generate attack graphs based on attackers' motivation, objectives, capabilities, and available modes of entry and to use this inferred knowledge to simulate attacks on an organization's modeled infrastructure. The method supports decision makers evaluating potential security control investments in striking a balance between monetary and non-monetary criteria regarding risks, costs, and benefits. We are currently in the process of developing a prototypical implementation of the framework that will be used to evaluate the approach through application case studies.},
note = {2012 7th International Conference on Availability, Reliability and Security, ARES 2012 ; Conference date: 20-08-2012 Through 24-08-2012},
keywords = {computational modeling, Decision support systems, HBE, human factors, security and protection, Simulation, systems analysis and design},
pubstate = {published},
tppubtype = {inproceedings}
}
In this paper, we report on our ongoing research on simulation-based information security risk assessment and multi-objective optimization of investment in security controls. We outline a methodological framework that accounts for characteristics of the organization, its information infrastructure, assets to be protected, the particular threat sources it faces, and the decision-makers' risk preferences. This framework comprises (i) ontological modeling of security knowledge, (ii) dynamic attack graph generation techniques, (iii) probabilistic simulation of attacks by goal-driven threat agents, (iv) meta-heuristic identification of efficient portfolios of information security controls, and (v) interactive decision support. These components facilitate novel techniques to infer possible routes of attacks and generate attack graphs based on attackers' motivation, objectives, capabilities, and available modes of entry and to use this inferred knowledge to simulate attacks on an organization's modeled infrastructure. The method supports decision makers evaluating potential security control investments in striking a balance between monetary and non-monetary criteria regarding risks, costs, and benefits. We are currently in the process of developing a prototypical implementation of the framework that will be used to evaluate the approach through application case studies.