权益分类	功能权益	普通用户	{{item.name}}会员
{{category.name}}	{{benefitItem.name}}

SaTC: CORE: Medium: An Optimization Framework for Identifying Dynamic Risk Management Practices

SaTC：核心：中：识别动态风险管理实践的优化框架

基本信息

批准号：
2000986
负责人：
Laura Albert
金额：
$ 120万
依托单位：
University of Wisconsin-Madison
依托单位国家：
美国
项目类别：
Standard Grant
财政年份：
2020
资助国家：
美国
起止时间：
2020-10-01 至 2024-09-30
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=2000986&HistoricalAwards=false
关键词：
SaTC CORE Medium Optimization Framework

项目摘要

It is enormously challenging for organizations to protect information technology (IT) systems from the myriad of risks and vulnerabilities that exist. Organizations can reduce these vulnerabilities by implementing security controls to protect critical IT systems from risk and responding to alerts from reports and logs. Nonetheless, major challenges in protecting IT systems involve determining the right combination of these mechanisms to deploy in a resource-constrained environment and identifying how to roll out security controls at the right time using the right resources. This project is aimed at increasing the efficiency of using security controls in IT organizations and agencies. It addresses these challenges by introducing and analyzing a new optimization framework to support the choice and implementation of security procedures. The project will contribute to the optimization literature, the field of operations research, and links between operations research and IT security. This project supports forward-looking, dynamic defensive strategies in uncertain environments that have the potential to achieve high levels of security without a corresponding increase in costs. To achieve this goal, this project explores how an optimization framework can be used to prescribe dynamic protection and response policies that protect IT systems, are effective given uncertain future events, and reduce risk in complex environments that span people, processes, and infrastructure. The project adds new models to the literature that draw from integer programming, multi-stage stochastic programming, adversarial risk analysis, and network games. Solving these models is extremely challenging, and therefore, this research explores new algorithmic techniques to identify optimal and near-optimal model solutions. This project advances our understanding of how to dynamically allocate resources to secure IT systems in an uncertain environment. This project integrates research with education to train the future workforce in cybersecurity. A comprehensive plan for broadening participation in computing highlights the researchers' efforts and commitment to diversity and inclusion.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

对于组织来说，保护信息技术 (IT) 系统免受存在的无数风险和漏洞的影响是一项巨大的挑战。组织可以通过实施安全控制来保护关键 IT 系统免受风险并响应报告和日志中的警报来减少这些漏洞。尽管如此，保护 IT 系统的主要挑战包括确定这些机制的正确组合以在资源受限的环境中部署，以及确定如何在正确的时间使用正确的资源推出安全控制。该项目旨在提高 IT 组织和机构使用安全控制的效率。它通过引入和分析新的优化框架来支持安全程序的选择和实施来应对这些挑战。该项目将为优化文献、运筹学领域以及运筹学和 IT 安全之间的联系做出贡献。该项目支持不确定环境中的前瞻性、动态防御策略，有可能在不相应增加成本的情况下实现高水平的安全性。为了实现这一目标，该项目探讨了如何使用优化框架来制定动态保护和响应策略，以保护 IT 系统，在考虑到不确定的未来事件的情况下有效，并降低跨越人员、流程和基础设施的复杂环境中的风险。该项目在文献中添加了借鉴整数规划、多阶段随机规划、对抗性风险分析和网络博弈的新模型。解决这些模型极具挑战性，因此，本研究探索新的算法技术来识别最佳和接近最佳的模型解决方案。该项目加深了我们对如何在不确定的环境中动态分配资源以保护 IT 系统的理解。该项目将研究与教育相结合，培训未来的网络安全劳动力。一项扩大计算参与的综合计划突显了研究人员对多样性和包容性的努力和承诺。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。