Decision support approaches for cyber security investment
Decision support approaches for cyber security investment
复制标题
DOI：
10.1016/j.dss.2016.02.012
复制
发表时间：
2016-06-01
影响因子：
7.5
通讯作者：
Smeraldi, Fabrizio
中科院分区：
文献类型：
--
作者：
Fielder, Andrew;Panaousis, Emmanouil;Smeraldi, Fabrizio
在投资网络安全资源时，信息安全经理必须遵循有效的决策策略。我们将此称为网络安全投资挑战。在本文中，我们考虑了安全管理者应对这一挑战的三种可能的决策支持方法。我们考虑基于博弈论、组合优化以及两者混合的方法。我们的建模首先构建一个框架，在该框架中我们可以调查网络安全控制的有效性，以保护存在商品威胁时被视为目标的不同资产。由于博弈论捕捉了内生组织和攻击者决策之间的相互作用，我们考虑安全经理和商品攻击者之间的两人控制博弈，安全经理必须在网络安全控制的不同实施级别之间进行选择，而商品攻击者则需要在不同的攻击目标之间进行选择。纯博弈论方法论是一个包含所有控制和所有威胁的大型博弈。在混合方法中，单个控制博弈的博弈解决方案及其直接成本（例如财务）与背包算法相结合，以得出最佳投资策略。组合优化技术由基于背包的多目标多重选择策略组成。为了比较这些方法，我们构建了一个决策支持工具和一个关于当前政府指导方针的案例研究。这项工作的目的是强调不同网络安全投资方法的优缺点、它们相互作用的好处以及间接成本对网络安全投资的影响。为了进一步验证我们的工作，我们已经证明，我们的决策支持工具提供了与英国政府倡导的关于中小企业网络攻击基本技术保护要求相同的建议。 (c) 2016 年作者。由 Elsevier B.V. 出版
When investing in cyber security resources, information security managers have to follow effective decision making strategies. We refer to this as the cyber security investment challenge. In this paper, we consider three possible decision support methodologies for security managers to tackle this challenge. We consider methods based on game theory, combinatorial optimisation, and a hybrid of the two. Our modelling starts by building a framework where we can investigate the effectiveness of a cyber security control regarding the protection of different assets seen as targets in presence of commodity threats. As game theory captures the interaction between the endogenous organisation's and attackers' decisions, we consider a 2-person control game between the security manager who has to choose among different implementation levels of a cyber security control, and a commodity attacker who chooses among different targets to attack. The pure game theoretical methodology consists of a large game including all controls and all threats. In the hybrid methodology the game solutions of individual control-games along with their direct costs (e.g. financial) are combined with a Knapsack algorithm to derive an optimal investment strategy. The combinatorial optimisation technique consists of a multi-objective multiple choice Knapsack based strategy. To compare these approaches we built a decision support tool and a case study regarding current government guidelines. The endeavour of this work is to highlight the weaknesses and strengths of different investment methodologies for cyber security, the benefit of their interaction, and the impact that indirect costs have on cyber security investment. Going a step further in validating our work, we have shown that our decision support tool provides the same advice with the one advocated by the UK government with regard to the requirements for basic technical protection from cyber attacks in SMEs. (c) 2016 The Authors. Published by Elsevier B.V.