Software Diversity for Improved Network Security: Optimal Distribution of Software-Based Shared Vulnerabilities

Orcun Temizkan (), Sungjune Park () and Cem Saydam ()
Additional contact information
Orcun Temizkan: Faculty of Business, Ozyegin University, 34794 Cekmekoy, Istanbul, Turkey
Sungjune Park: Belk College of Business, University of North Carolina at Charlotte, Charlotte, North Carolina 28223
Cem Saydam: Belk College of Business, University of North Carolina at Charlotte, Charlotte, North Carolina 28223

Information Systems Research, 2017, vol. 28, issue 4, 828-849

Abstract: Firms, and other agencies, tend to adopt widely used software to gain economic benefits of scale, which can lead to a software monoculture. This can, in turn, involve the risk of correlated computer systems failure as all systems on the network are exposed to the same software-based vulnerabilities. Software diversity has been introduced as a strategy for disrupting such a monoculture and ultimately decreasing the risk of correlated failure. Nevertheless, common vulnerabilities can be shared by different software products. We thus expand software diversity research here and consider shared vulnerabilities between different software alternatives. We develop a combinatorial optimization model of software diversity on a network in an effort to identify the optimal software distribution that best improves network security. We also develop a simulation model of virus propagation based on the susceptible-infected-susceptible model. This model allows calculation of the epidemic threshold, a measure of network resilience to virus propagation. We then test the effectiveness of the proposed software diversity strategies against the spreading of viruses through a series of experiments.

Keywords: software diversity; shared vulnerabilities; epidemic spreading; epidemic threshold; network security; combinatorial optimization; simulation (search for similar items in EconPapers)
Date: 2017
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://doi.org/10.1287/isre.2017.0722 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:orisre:v:28:y:2017:i:4:p:828-849

Access Statistics for this article

More articles in Information Systems Research from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().