Selection Of Security Countermeasures Research Articles

Using an Event Data Taxonomy to Represent the Impact of Cyber Events as Geometrical Instances

Visualization and simulation models used for the evaluation and selection of security countermeasures need accurate data to compute the impact of cyber events (e.g., malicious and benign actions). The information required to build appropriate impact models depends directly on the nature of the system. The information dealt by water supply systems, for instance, is particularly different from the information obtained by energy, telecommunication, transportation, or finance systems. It is, therefore, important to properly classify the data of security events according to the nature of the system. This paper proposes an event data taxonomy based on the system’s criticality, the geographical location of the target, the time at which the information is obtained by the attacker, and the nature of the data. A use case on the impact assessment of events originated in a critical infrastructure is presented to show the applicability of the proposed taxonomy.

Selecting optimal countermeasures for attacks against critical systems using the attack volume model and the RORI index

The impact quantification of attacks and security countermeasures is an active research in the information and communications technology domain. Supporters of the Return On Investment (ROI), and all its variants, propose quantitative models that estimate their parameters based on expert knowledge, statistical data, simulation and risk assessment tools. Although results are used for relative comparisons, a great level of subjectivity is considered while estimating each parameter composing the model. In single attack scenarios, the use of cost sensitive metrics allows the evaluation and selection of security countermeasures. However, for attack attacks against critical infrastructures, this approach is not accurate enough to determine the impact of the equipment(s), subject(s), and/or action(s) that take part in a security incident. This paper proposes, therefore, a geometrical model that represents the volume of systems, attacks and countermeasures based on a three-dimensional coordinate system (i.e., user, channel, and resource). As a result, volumes are related to risks, making it possible to select optimal countermeasures against complex attacks based on a cost-sensitive metric. A case study on a critical infrastructure control process is provided at the end of the paper to show the applicability of our model in a scenario with two attacks.

A novel risk assessment and optimisation model for a multi-objective network security countermeasure selection problem

Budget cuts and the high demand in strengthening the security of computer systems and services constitute a challenge. Poor system knowledge and inappropriate selection of security measures may lead to unexpected financial and data losses. This paper proposes a novel Risk Assessment and Optimisation Model (RAOM) to solve a security countermeasure selection problem, where variables such as financial cost and risk may affect a final decision. A Multi-Objective Tabu Search (MOTS) algorithm has been developed to construct an efficient frontier of non-dominated solutions, which can satisfy organisational security needs in a cost-effective manner.

Review of Risk Analysis and Security Countermeasure Selection

Review of Risk Analysis and Security Countermeasure Selection