Mission-centric Decision Support in Cybersecurity via Bayesian Privilege Attack Graph

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F22%3A00125824" target="_blank" >RIV/00216224:14610/22:00125824 - isvavai.cz</a>

Result on the web

<a href="https://doi.org/10.1002/eng2.12538" target="_blank" >https://doi.org/10.1002/eng2.12538</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1002/eng2.12538" target="_blank" >10.1002/eng2.12538</a>

Result language

angličtina

Original language name

Mission-centric Decision Support in Cybersecurity via Bayesian Privilege Attack Graph

Original language description

We present an approach to decision support in cybersecurity with respect to cyber threats and stakeholders' requirements. We approach situations in which cybersecurity experts need to take actions to mitigate the risks, such as temporarily putting an IT system out of operation, but need to consult them with other stakeholders. We propose a decision support system that uses a mission decomposition model representing the organization's functional and security requirements on its IT infrastructure. Based on the cybersecurity state assessment, i.e., discovery of vulnerabilities and attacker's position, the decision support system calculates the resilience metrics for each IT infrastructure's configuration, i.e., how likely are they to not be disrupted. The calculation is enabled by two novel formal models, Privilege-Exploit Attack Graph and Bayesian Privilege Attack Graph, which reduce complex attack graphs into a comprehensible bipartite graph. Moreover, they illustrate the impact of exploiting the vulnerabilities and attackers gaining the privileges. The system recommends the most resilient mission configurations that are comprehensible to both cybersecurity experts and non-technical stakeholders, who may then choose which configuration to apply. Our approach is illustrated in a case study of a real-world medical information system.

Czech name

—

Czech description

—

Type

J_imp - Article in a specialist periodical, which is included in the Web of Science database

CEP classification

—

OECD FORD branch

10200 - Computer and information sciences

Project

<a href="/en/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Name of the periodical

Engineering Reports

ISSN

2577-8196

e-ISSN

2577-8196

Volume of the periodical

4

Issue of the periodical within the volume

12

Country of publishing house

US - UNITED STATES

Number of pages

25

Pages from-to

„e12538“

UT code for WoS article

000808247600001

EID of the result in the Scopus database

2-s2.0-85143248057