A framework for evaluating security risk in system design

Abstract

Design and development of ubiquitous computer network systems has become increasingly difficult as technology continues to grow. From the introduction of new technologies to the discovery of existing threats, weaknesses, and vulnerabilities there is a constantly changing landscape of potential risks and rewards. The cyber security community, and industry at large, is learning to account for these increasing threats by including protections and mitigations from the beginning of the design V process. However, issues still come from limitations in time for thoroughly exploring a potential design space and the knowledge base required to easily account for potential vulnerabilities in each. To address this problem we propose the G-T-S framework, which is an automated tool that allows a user to provide a set of inputs relating to the desired design space and returns a monetary security risk evaluation of each. This methodology first generates a series of potential designs, then dissects their contents to associate possible vulnerabilities to device elements, and finally evaluates the security risk poised to a central asset of importance. We exemplify the tools, provide methodologies for required background research, and discuss the results in evaluating a series of IoT Home models using the GTS framework. Through implementation of our framework we simplify the information an individual will require to begin the design process, lower the bar for entry to perform evaluating security risk, and present the risk as an easily understood monetary metric.

The OSATE Slicer: Graph-Based Reachability for Architectural Models.

“…The flow of malicious data and control through a system are also of interest to system modelers; recent work has also demonstrated the viability of AADL for the generation of attack trees, e.g., TAMSAT (Wortman & Chandy 2022). Attack trees are similar to fault trees except they focus on malicious activities rather than component failures or unintended occurrences.…”

Research on an evaluation index system of critical emergency management capability based on machine learning in a complex scientific environment

“…The feature extraction method in DRL extracts the essential features, factors, and patterns relevant to the indexing system. DRL evaluates emergency management systems' content and the indexing accuracy (Wortman and Chandy, 2020). A deep neural network (DNN) is also used in the evaluation, which helps to predict the exact features of an indexing system.…”

“…DNN maximizes the accuracy in evaluation that enhances the performance and efficiency ratio of systems. DNN also reduces latency and error range in the evaluation process, thereby improving the feasibility of emergency management systems (Wortman and Chandy, 2020;Ning et al, 2022). Multiple linear regression (MLR) is used in emergency management to identify the exact indexing patterns for different processes.…”