SaTC: CORE: Medium: An Optimization Framework for Identifying Dynamic Risk Management Practices

对于组织来说，保护信息技术(IT)系统免受存在的无数风险和漏洞的影响是一项巨大的挑战。组织可以通过实施安全控制来保护关键IT系统免受风险，并响应来自报告和日志的警报，从而减少这些漏洞。尽管如此，保护IT系统的主要挑战涉及确定在资源受限的环境中部署这些机制的正确组合，以及确定如何使用正确的资源在正确的时间部署安全控制。该项目旨在提高IT组织和机构使用安全控制的效率。它通过引入和分析一个新的优化框架来支持安全程序的选择和实施来应对这些挑战。该项目将对优化文献、运筹学领域以及运筹学和信息技术安全之间的联系作出贡献。该项目在不确定的环境中支持前瞻性、动态的防御战略，这些战略有可能在不相应增加成本的情况下实现高水平的安全。为了实现这一目标，本项目探索了如何使用优化框架来规定动态保护和响应策略，以保护IT系统、在不确定的未来事件下有效地应对未来事件，并在跨越人员、流程和基础设施的复杂环境中降低风险。该项目在文献中增加了新的模型，这些模型来自整数规划、多阶段随机规划、对抗性风险分析和网络游戏。求解这些模型是极具挑战性的，因此，本研究探索新的算法技术来确定最优和接近最优的模型解。这个项目加深了我们对如何在不确定的环境中动态分配资源以保护IT系统的理解。该项目将研究与教育相结合，以培训未来的网络安全劳动力。一份广泛参与计算的全面计划突出了研究人员对多样性和包容性的努力和承诺。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

It is enormously challenging for organizations to protect information technology (IT) systems from the myriad of risks and vulnerabilities that exist. Organizations can reduce these vulnerabilities by implementing security controls to protect critical IT systems from risk and responding to alerts from reports and logs. Nonetheless, major challenges in protecting IT systems involve determining the right combination of these mechanisms to deploy in a resource-constrained environment and identifying how to roll out security controls at the right time using the right resources. This project is aimed at increasing the efficiency of using security controls in IT organizations and agencies. It addresses these challenges by introducing and analyzing a new optimization framework to support the choice and implementation of security procedures. The project will contribute to the optimization literature, the field of operations research, and links between operations research and IT security. This project supports forward-looking, dynamic defensive strategies in uncertain environments that have the potential to achieve high levels of security without a corresponding increase in costs. To achieve this goal, this project explores how an optimization framework can be used to prescribe dynamic protection and response policies that protect IT systems, are effective given uncertain future events, and reduce risk in complex environments that span people, processes, and infrastructure. The project adds new models to the literature that draw from integer programming, multi-stage stochastic programming, adversarial risk analysis, and network games. Solving these models is extremely challenging, and therefore, this research explores new algorithmic techniques to identify optimal and near-optimal model solutions. This project advances our understanding of how to dynamically allocate resources to secure IT systems in an uncertain environment. This project integrates research with education to train the future workforce in cybersecurity. A comprehensive plan for broadening participation in computing highlights the researchers' efforts and commitment to diversity and inclusion.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.