Data leakage triage: quantitative measure of effectiveness of containment plan

Abstract

Increasingly organisations' deployed security defences are challenged by persistent malware attacks. There are many risks induced by successful malicious assaults against an organisation. One of the significant risks is data leakage. This risk has significant impacts to organisations and nations. To mitigate the likely occurrence of such risk, adequate preparation and response are needed. Epidemiological modelling of such malware outbreaks can aid in the development of mitigation plans. Most of these models used the number of infected hosts or time duration to analyse malware behaviours or the effectiveness of response plan. This paper proposes an extension of the agent-based malware containment model AMCM to provide a quantitative measurement of the amount of data leakage from malware infected hosts in order to evaluate the effectiveness of the response containment plan. It is believed that this form of measurement will enhance the preparation of incident response plans to deal with malware outbreak.