Selecting security control portfolios: a multi-objective simulation-optimization approach

Elmar Kiesling (), Andreas Ekelhart (), Bernhard Grill (), Christine Strauss and Christian Stummer
Additional contact information
Elmar Kiesling: Vienna University of Technology
Andreas Ekelhart: Secure Business Austria
Bernhard Grill: Secure Business Austria

EURO Journal on Decision Processes, 2016, vol. 4, issue 1, No 6, 85-117

Abstract: Abstract Organizations’ information infrastructures are exposed to a large variety of threats. The most complex of these threats unfold in stages, as actors exploit multiple attack vectors in a sequence of calculated steps. Deciding how to respond to such serious threats poses a challenge that is of substantial practical relevance to IT security managers. These critical decisions require an understanding of the threat actors—including their various motivations, resources, capabilities, and points of access—as well as detailed knowledge about the complex interplay of attack vectors at their disposal. In practice, however, security decisions are often made in response to acute short-term requirements, which results in inefficient resource allocations and ineffective overall threat mitigation. The decision support methodology introduced in this paper addresses this issue. By anchoring IT security managers’ decisions in an operational model of the organization’s information infrastructure, we provide the means to develop a better understanding of security problems, improve situational awareness, and bridge the gap between strategic security investment and operational implementation decisions. To this end, we combine conceptual modeling of security knowledge with a simulation-based optimization that hardens a modeled infrastructure against simulated attacks, and provide a decision support component for selecting from efficient combinations of security controls. We describe the prototypical implementation of this approach, demonstrate how it can be applied, and discuss the results of an in-depth expert evaluation.

Keywords: IT security analysis; Multi-objective portfolio selection; Interactive decision support; Simulation; Genetic algorithm; 68U20; 68U35; 90B50; 90C27; 91B32 (search for similar items in EconPapers)
Date: 2016
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
http://link.springer.com/10.1007/s40070-016-0055-7 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:eurjdp:v:4:y:2016:i:1:d:10.1007_s40070-016-0055-7

Ordering information: This journal article can be ordered from
http://www.springer. ... search/journal/40070

DOI: 10.1007/s40070-016-0055-7

Access Statistics for this article

EURO Journal on Decision Processes is currently edited by Vincent Mousseau

More articles in EURO Journal on Decision Processes from Springer, EURO - The Association of European Operational Research Societies
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().