CT-ISG: Compound Exposure Analysis: Security Metrics and Applications

此网络信任项目调查复合暴露图以及网络和对手模型的使用，以此作为跨越这些领域的综合信息安全风险管理架构的基础。了解企业网络威胁的性质和严重程度对于有效预防和应对至关重要。网络管理员和安全专业人员必须拥有衡量风险、制定补救计划和制定成熟的风险管理流程的工具。该项目通过开发可扩展分析和复合暴露的技术，设计和验证安全风险指标，并构建在简化的风险评估过程中绑定分析工具和指标的软件引擎，解决了这些国家关注的领域。这个项目的智力价值在于项目团队的实力和所解决问题的重要性。PI和其他相关人员都可以为该项目提供重要的专业知识，这是一个高风险和困难的项目，但也具有很高的回报潜力。该项目有可能在掌握复杂系统的脆弱性方面提供技术进步，并提供防御机制。该项目更广泛的影响在于教育和外联活动，这些活动在学术、工业和政府合作伙伴之间建立关系，以部署和评估所开发的技术。该项目通过既定的指导计划，积极吸收本科生和代表性不足群体成员的参与。研究工具和成果被战略性地纳入信息保障课程和课程，以提供最新和有效的信息安全风险管理教育和培训模式。

This Cyber Trust project investigates the use of compound exposure graphs, and network and adversary models as the foundation a comprehensive information security risk management architecture that spans these domains. Understanding the nature and severity of threats to enterprise networks is critical for effective prevention and response. Network administrators and security professionals must have tools to measure risk and devise remediation plans and to develop a mature risk management process. The project addresses these areas of national concern by developing techniques for scalable analysis and compound exposures, designing and validating security risk metrics, and constructing a software engine that binds analytical tools and metrics in a facilitated risk assessment process. The intellectual merit of this project lies in both the strength of the project team and the significance of the problem addressed. The PI and others involved all have significant expertise to offer to the project, which is high risk and difficult but also has high potential for return. The project has the potential to provide technological advances in grasping the vulnerability of complex systems and provide defense mechanisms. The broader impacts of the project lie in education and outreach activities that build relationships between academic, industrial, and government partners to deploy and evaluate the technologies that are developed. The project actively incorporates participation of undergraduate students and members of underrepresented groups via established mentoring programs. Research tools and results are strategically integrated into the information assurance courses and curriculum to provide current and effective models of information security risk management education and training.