A Robust Approach for Mitigating Risks in Cyber Supply Chains

Zheng, Kaiyue; Albert, Laura A.

doi:10.1111/risa.13269

Cited by 28 publications

(18 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Additionally, they address the uncertainty regarding mitigation effectiveness, a widely recognized issue (Boyens et al, ; U.S. Government Accountability Office, ), by proposing a stochastic model variant. Zheng and Albert ()) extend this model to consider worst‐case and conditional variance at risk objectives. However, neither of these papers explicitly consider adaptive adversaries.…”

Section: Introductionmentioning

confidence: 99%

Interdiction models for delaying adversarial attacks against critical information technology infrastructure

Zheng

Albert

2019

Naval Research Logistics

Self Cite

View full text Add to dashboard Cite

Information technology (IT) infrastructure relies on a globalized supply chain that is vulnerable to numerous risks from adversarial attacks. It is important to protect IT infrastructure from these dynamic, persistent risks by delaying adversarial exploits. In this paper, we propose max‐min interdiction models for critical infrastructure protection that prioritizes cost‐effective security mitigations to maximally delay adversarial attacks. We consider attacks originating from multiple adversaries, each of which aims to find a “critical path” through the attack surface to complete the corresponding attack as soon as possible. Decision‐makers can deploy mitigations to delay attack exploits, however, mitigation effectiveness is sometimes uncertain. We propose a stochastic model variant to address this uncertainty by incorporating random delay times. The proposed models can be reformulated as a nested max‐max problem using dualization. We propose a Lagrangian heuristic approach that decomposes the max‐max problem into a number of smaller subproblems, and updates upper and lower bounds to the original problem via subgradient optimization. We evaluate the perfect information solution value as an alternative method for updating the upper bound. Computational results demonstrate that the Lagrangian heuristic identifies near‐optimal solutions efficiently, which outperforms a general purpose mixed‐integer programming solver on medium and large instances.

show abstract

Section: Introductionmentioning

confidence: 99%

Interdiction models for delaying adversarial attacks against critical information technology infrastructure

Zheng

Albert

2019

Naval Research Logistics

Self Cite

View full text Add to dashboard Cite

show abstract

“…Both value-at-risk and expected shortfall measures enable decision-makers to modulate their management according to different risk preferences: α close to 0 being more risk neutral, and α close to 1 more risk conservative [69]. More generally, VaR and ES measures enable the ranking and comparison of risk management options and leave to decision-makers the final decision, depending on their personality and on their political, social and/or budgetary constraints.…”

Section: Main Methodological Outcomes Of the Workmentioning

confidence: 99%

“…No clear-cut recommendation can be given on the choice of α since the latter is a user-defined parameter that reflects the risk attitudes of the decision-maker [69]. Here, value-at-risk and expected shortfall are evaluated for different temporal horizons t (in years).…”

Section: Quantile-based Risk Measuresmentioning

confidence: 99%

Quantile-based individual risk measures for rockfall-prone areas

Farvacque

Eckert

Bourrier

et al. 2021

International Journal of Disaster Risk Reduction

View full text Add to dashboard Cite

In mountain environments, precise rockfall risk evaluation is crucial to reduce death tolls and costs. However, to date, existing rockfall risk assessment procedures remain scarce, as they focus only on existing elements at risk and with the damage expectation as sole risk measure. Here, we propose an approach to evaluate the distribution of damages on an individual basis as a continuous function of space. Furthermore, rockfall risk is evaluated through (i) the damage expectation and based on (ii) the value-at-risk (VAR) and (iii) the expected shortfall (ES). VaR and ES risk measures allow better assessing the risk due to extreme events and accounting for various short-term/long-term constraints faced by stakeholders. This procedure is applied to Le Brocey slope (municipality of Crolles, French Alps), frequently affected by rockfall events, illustrating its potential for land-use planning. Notably, obtained individual risk values can be confronted with acceptability thresholds to perform legal zoning on sound basis. Also, they allow comparison of risk management strategies as function of different behaviors towards risk, budgetary constraints and/or temporal horizons. Hence, the approach provides valuable tools for future land-use planning and decision-making. It could easily be transferred to other hazards as a wider contribution to the determination of the best balance between safety and sustainability.

show abstract

“…Once modern cities rely on interdependent infrastructures and disruptions often propagate through this infrastructure network, researchers in study [35] developed a model that will systematically investigate the mutual influence between the infrastructures and the communities in order to redistribute resources. In review [36], the authors addressed population displacement during natural disasters, offering guidelines for civil infrastructure system models assisting recovery managers and transportation system managers with reducing the length of time people are displaced. In [37], researchers provided important tools and insights for decision-makers on different actions to take to manage risks under uncertainty.…”

Section: Systematic Literature Surveymentioning

confidence: 99%

Disaster Management in Smart Cities

et al. 2021

View full text Add to dashboard Cite

The smart city concept, in which data from different systems are available, contains a multitude of critical infrastructures. This data availability opens new research opportunities in the study of the interdependency between those critical infrastructures and cascading effects solutions and focuses on the smart city as a network of critical infrastructures. This paper proposes an integrated resilience system linking interconnected critical infrastructures in a smart city to improve disaster resilience. A data-driven approach is considered, using artificial intelligence and methods to minimize cascading effects and the destruction of failing critical infrastructures and their components (at a city level). The proposed approach allows rapid recovery of infrastructures’ service performance levels after disasters while keeping the coverage of the assessment of risks, prevention, detection, response, and mitigation of consequences. The proposed approach has the originality and the practical implication of providing a decision support system that handles the infrastructures that will support the city disaster management system—make the city prepare, adapt, absorb, respond, and recover from disasters by taking advantage of the interconnections between its various critical infrastructures to increase the overall resilience capacity. The city of Lisbon (Portugal) is used as a case to show the practical application of the approach.

show abstract

A Robust Approach for Mitigating Risks in Cyber Supply Chains

Cited by 28 publications

References 22 publications

Interdiction models for delaying adversarial attacks against critical information technology infrastructure

Interdiction models for delaying adversarial attacks against critical information technology infrastructure

Quantile-based individual risk measures for rockfall-prone areas

Disaster Management in Smart Cities

Contact Info

Product

Resources

About