Sensitivity of Importance Metrics for Critical Digital Services Graph to Service Operators’ Self-Assessment Errors

Mariusz Kamola

doi:10.1155/2019/7510809

Abstract

Interdependency of critical digital services can be modeled in the form of a graph with exactly known structure but with edge weights subject to estimation errors. We use standard and custom centrality indexes to measure each service vulnerability. Vulnerability of all nodes in the graph gets aggregated in a number of ways into a single network vulnerability index for services whose operation is critical for the state. This study compares sensitivity of various centralities combined with various aggregation methods to errors in edge weights reported by service operators. We find that many of those combinations are quite robust and can be used interchangeably to reflect various perceptions of network vulnerability. We use graphs of source files’ dependencies for a number of open-source projects, as a good analogy for real critical services graph, which will remain confidential.

Highlights

Correct operation of digital services and infrastructures has since long become critical for societies, and demands coordinated actions for maintenance and incident response. e Directive on Security of Network and Information Systems (NIS [1]), by the European Parliament, provides a framework for coherent implementation of security measures by European Union member states
It should be reminded that research reported here is done in context of a large project aiming to build a nation-wide model of critical services network
While integrity of the resulting graph can be obtained by careful automated inspection of questionnaires filed by service operators, the estimated reported impact between services will be biased and inherently erroneous. erefore, it was worth to study sensitivity of some candidate synthetic metrics of overall network vulnerability with respect to incorrect input

Summary

Introduction

Correct operation of digital services and infrastructures has since long become critical for societies, and demands coordinated actions for maintenance and incident response. e Directive on Security of Network and Information Systems (NIS [1]), by the European Parliament, provides a framework for coherent implementation of security measures by European Union member states. Due to the scale and dynamics of digital networks, e ective and e cient protection of their operation must be assisted by intelligent decision support systems operating at national level. Such systems should be (i) Complete, i.e., possessing information about all critical services in the country (ii) Automated, i.e., minimizing human factor in daily operations as well as in network model construction (iii) Coupled, i.e., exchanging information at international level. Platform (NPC), a R&D project whose goal is to address the rst two of the above issues, i.e., implement and deploy a system supporting security operation centers (SOCs). On the other hand, the national critical services network model is built exactly with this info

Objectives

Methods

Results

Conclusion