No abstract

Adversaries with the appropriate expertise and access can potentially exploit the large attack surface provided by the cyber component of critical infrastructure assets to target operations across the various sectors and significantly impact society. This paper describes a family of cyber risk methodologies known as "mission-based analysis" (MBA) that assist system designers in identifying the threats that pose the highest risk to mission execution and in prioritizing mitigation actions against the threats. This paper describes our experiences applying MBA and discusses its benefits and limitations. Also, it describes future enhancements of MBA and compares the approach with other assurance methodologies.

This paper provides an overview of CyMRisk, an experimental architecture for computing mission risk due to cyber attack. In its current form, the approach employs a simulation of key aspects of a target business/mission process as well as attacker behavior to estimate mission impact due to cyber attacks. In addition, CyMRisk estimates worst case attacker level of effort associated with carrying out such attacks.

No abstract