Leveraging the Multi-Stakeholder Nature of Cyber Security

网络安全（CyS）是一个具有挑战性的，分布式的，多利益相关者的问题。它是分布式的，因为全面评估给定IT系统安全级别的专业知识通常不是在一个位置都可用;例如，公司内IT组件的详细信息在该公司内可用，而操作系统软件漏洞的详细信息可能提供给操作系统制造商，进一步的专家见解可能提供给公共安全机构，如CESG。这是一个多利益相关者的问题，因为许多人类利益相关者，从IT设计人员到具有不同专业知识水平的用户，需要有效地沟通和合作，以提供具有适当水平CyS保证的系统。这个跨学科项目汇集了来自英国诺丁汉大学和美国卡内基梅隆大学的领先学术专家，以及一个强大的综合项目合作伙伴：CESG -英国国家信息保障技术管理局。该项目旨在通过开发一个具有必要科学基础的新型框架来利用CyS的分布式，多人利益相关者的性质，以改善用户对用户定制的CyS信息的访问，作为一个尖端的，数据驱动的在线网络安全决策支持系统（OCYSS）。这种方法旨在直接解决从政府到行业的小型到大型用户对高素质CyS专家的可用性和访问的严重短缺。OCYSS的作用是有效和高效地整合专家和用户的输入，捕获单个组件的通常不确定的漏洞级别以及这些组件的相互作用/组合产生的漏洞，以有效地向用户提供适当，平衡，知情和最新的威胁分析和CyS决策支持。重要的是，OCYSS框架：-通过全面捕获和聚合CyS专家的洞察力和专业知识来评估脆弱性，包括各个系统组件（例如入侵检测，加密）及其交互（例如SSL 3.0和弱密码）的相关不确定性水平，从而消除CyS专家的有限可用性。这些信息由OCYSS集中收集，并定期更新。- 通过为新发现的组件漏洞和组件交互漏洞（以及相关的不确定性）提供直接途径，避免威胁分析和潜在缓解的延迟。由Oracle等制造商和赛门铁克等第三方组织提供。旨在提供用户定制的，全面的和最新的威胁分析和决策支持，并随着新信息的出现而不断更新。OCYSS两阶段输出捕获A）威胁分析输入中的不确定性（例如，随着时间的推移和不同专家对组件漏洞的不确定性）和B）响应于用户的资产排名，对威胁缓解进行直观的收益-成本分析（例如，低价值资产可能不值得为解决低威胁而进行高投资）。超出标准研究项目的范围，该项目不仅旨在提供尖端科学，开发数据科学和HCI的关键进展，而且还提供OCYSS框架的真实世界，开源原型。这使该项目能够针对现实世界的CyS挑战进行卓越的评估和定制，包括在现实世界的环境中部署OCYSS，例如由CESG建议的政府部门。此外，通过这种方法，该项目能够提供开源算法和大量开源软件平台原型，促进学术成果的复制，并大大提高项目成果的商业吸收潜力。

Cyber Security (CyS) is a challenging, distributed, multi-stakeholder problem. It is distributed in the sense that the expertise to comprehensively assess the level of security of a given IT system is commonly not all available in one location; e.g. detail on the IT components within a company is available within that company, while detail on operating system software vulnerability may be available to the OS manufacturer and further expert insight may be available to public security agencies, such as CESG. It is a multi-stakeholder problem because a number of human stakeholders, from IT designers to users with varying levels of expertise, need to effectively communicate and work together in order to deliver systems with an appropriate level of CyS assurance.This interdisciplinary project brings together leading academic experts from the University of Nottingham, UK and Carnegie Mellon University, USA, with a strongly integrated project partner: CESG - the UK's National Technical Authority for Information Assurance. The project is designed to leverage the distributed, multiple human stakeholder nature of CyS by developing a novel framework with the necessary scientific underpinning to improve user access to user-tailored CyS information, operationalised as a cutting-edge, data-driven Online CYber Security decision support System (OCYSS). This approach id designed to directly address an acute shortage of availability and access to highly qualified CyS experts by both small-to-large scale users from government to industry. The role of OCYSS is to effectively and efficiently integrate expert and user inputs, capturing commonly uncertain vulnerability levels of individual components as well as vulnerabilities arising from the interaction/combination of these components, to efficiently deliver appropriate, balanced, informed and up-to-date threat analysis and CyS decision support to users. Importantly, the OCYSS framework:- Addresses the limited availability of CyS experts by comprehensively capturing and aggregating their insight and expertise to assess the vulnerability, including associated levels of uncertainty, of individual system components (e.g. intrusion detection, encryption) and their interactions (e.g. SSL 3.0 and weak password). This information is captured centrally by OCYSS and updated regularly. - Avoids delays in threat analysis and potential mitigation by providing a direct pathway for newly discovered component vulnerabilities & component interaction vulnerabilities (and associated uncertainty) to be rapidly put forward, incl. by manufacturers such as Oracle and third party organisations such as Symantec.- Is designed to deliver user-tailored, comprehensive and up-to-date threat analysis and decision support which is continuously updated as new information becomes available. OCYSS two-stage outputs capture uncertainty in A) the threat analysis inputs (e.g. uncertainty around a component vulnerability over time and by different experts) and B) in intuitive benefit-cost analysis on threat mitigation in response to asset ranking by users (e.g. a low value asset may not warrant a high investment to address a low threat).Going beyond the scope of a standard research project, this project is designed to not only deliver cutting-edge science, developing key advances in data science and HCI, but to also deliver a real-world, open source prototype of the OCYSS framework. This enables the project to conduct an exceptional level of evaluation and tailoring to real-world CyS challenges, including the deployment of OCYSS in real-world contexts such as government departments advised by CESG. Further, through this approach, the project is able to deliver both open source algorithms and a substantial open-source software platform prototype, facilitating the academic reproduction of results, as well as substantially boosting the potential of commercial up-take of the project outcomes.