Selecting security control portfolios: a multi-objective simulation-optimization approach

Abstract

Organizations' information infrastructures are exposed to a large variety of threats. The most complex of these threats unfold in stages, as actors exploit multiple attack vectors in a sequence of calculated steps. Deciding how to respond to such serious threats poses a challenge that is of substantial practical relevance to IT security managers. These critical decisions require an understanding of the threat actors -including their various motivations, resources, capabilities, and points of access -as well as detailed knowledge about the complex interplay of attack vectors at their disposal. In practice, however, security decisions are often made in response to acute short-term requirements, which results in inefficient resource allocations and ineffective overall threat mitigation. The decision support methodology introduced in this paper addresses this issue. By anchoring IT security managers' decisions in an operational model of the organization's information infrastructure, we provide the means to develop a better understanding of security problems, improve situational awareness, and bridge the gap between strategic security investment and operational implementation decisions. To this end, we

Multi-Criteria Selection of Capability-Based Cybersecurity Solutions

“… Business impact/disruption, anticipated loss, profit reduction, fines, reputation, decline in stock price, damage [17]- [23]  Risk tolerance [12], [19], [24]; Budget [19]  Legal and regulatory [22]  Self-imposed constraints [22] Asset  Importance/value [13], [24]- [27]  Assessed risk [12], [24]  Probability of breach, event, or successful attack [13], [24], [26], [28], [29] Threat  Anticipated [25], [27], [30], [31]  Most significant [25]  Residual risk [23], [32]; Incident data [17] Control  Cost, general [12], [13], [30], [32], [18], [20]- [23], [26]- [28]  Purchase/setup [17], [24], [25], [33]- [35]  Number of controls as a proxy for cost [36]  Difficulty of implementation [25]  Operation, training, and maintenance cost [17], [24], [25],…”

“…These decisions are complex, inexact, and involve multiple stakeholders with diverse interests. Moreover, there is no "one size fits all" approach because, for example, information environments, business dependence on those environments, relevant cyber threats, risk tolerance levels, and security budgets vary from one organization to the next [13].…”

Decision support for selecting information security controls

“…According to the article (Kiesling et al, 2016), organizations and their infrastructures are exposed to constant threats, and deciding the better way to respond to them is a difficult task for IT security managers. For that very reason, the work aims to combine the concept of security with a simulation of an infrastructure capable of fighting attacks and providing decision support components.…”

“…In order to create a model capable of dealing with attacks, it is necessary to have knowledge beyond technology, because psychological, sociological or economic parameters should not be forgotten. To conclude, Kiesling et al (2016) argue that in the future a method must be integrated that simulates the impact of attacks on an organization's business process.…”

A variable neighborhood search simheuristic for project portfolio selection under uncertainty

“…Huang (2007) treats the project parameters as uncertain and combines a genetic algorithm with random fuzzy simulation in order to account for this. An interesting application combining discrete-event simulation with a genetic algorithm to select security control portfolios is discussed in Kiesling et al (2016). In the context of an IT infrastructure subject to a number of threats, the authors focus on selecting the best policy from efficient combinations of security controls.…”