Decision support for systems security investment

2010 IEEE/IFIP Network Operations and Management Symposium Workshops, NOMS 2010

Volumn , Issue , 2010, Pages 118-125

  Beresnevichiene, Yolanta ^a   Pym, David ^a   Shiu, Simon ^a  

^a HEWLETT PACKARD LABORATORIES   (United Kingdom)

Author keywords

Decision support; Economics; Information security; Risk management; Systems modelling

Indexed keywords

BUSINESS OBJECTIVES; DECISION SUPPORTS; FIXED BUDGET; INFORMATION SECURITY; IT SUPPORT SERVICES; LARGE ORGANIZATIONS; MULTI-ATTRIBUTE UTILITY; SECURITY INVESTMENTS; SECURITY MANAGER; SECURITY MEASURE; STATE OF THE ART; SYSTEMATIC METHODOLOGY; SYSTEMS MODELLING; SYSTEMS SECURITY;

COMPUTER SUPPORTED COOPERATIVE WORK; DECISION MAKING; DECISION SUPPORT SYSTEMS; ECONOMICS; INVESTMENTS; MANAGERS; RESEARCH; RISK ANALYSIS; RISK MANAGEMENT; SECURITY OF DATA; SECURITY SYSTEMS; TECHNICAL PRESENTATIONS;

MATHEMATICAL MODELS;

EID: 77957917091     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NOMSW.2010.5486590     Document Type: Conference Paper

References (30)

1. th Annual Computer Security Applications Conference, 358-365, New Orleans: IEEE, 2001.
2. Ashenden, D. Information Security Management: "A Human Challenge?" Information Security Technical Report (2008), doi: 10.1016/j.istr.2008.10.006.
3. Beautement, A., Coles, R., Griffin, J., Ioannidis, C., Monahan, B., Pym, D., Sasse, A., Wonham, M.: Modelling the Human and Technological Costs and Benefits of USB Memory Stick Security. In: Managing Information Risk and the Economics of Security, M. Eric Johnson (editor), 141-163. Springer, 2009.
4. Birtwistle, G.: Discrete event modelling on Simula. Springer, 1987.
5. Beres, Y., Griffin, J., Shiu, S., Heitman, M., Markle, D., Ventura, P.: Analysing the Performance of Security Solutions to Reduce Vulnerability Exposure Windows, Proc. Annual Computer Security Applications Conference, 33-42, Anaheim, California: IEEE, 2008.
6. Collinson, M., Monahan, B., Pym, D.: A Discipline of Mathematical Systems Modelling. College Publications, London, 2010 (forthcoming).
7. Collinson, M., Griffin, J., Monahan, B.: Towards a Toolset Framework for Gnosis. Forthcoming HP Labs Technical Report, 2010.
8. Collinson, M., Monahan, B., Pym, D.: A Logical and Computational Theory of Located Resource. Journal of Logic and Computation, 19(6): 1207-1244, 2009. doi:10.1093/logcom/exp021.
9. Collinson, M., Pym, D.: Algebra and logic for resource-based systems modelling. Math. Struct. Comp. Sci. 19:959-1027, 2009.
10. Dawkins, J., Hale, J.: A systematic approach to multi-stage network attack analysis. Proceedings of Second IEEE Int. Information Assurance Workshop, 48-7, April 2004.
11. Gordon, L., Loeb, M.: Managing Cybersecurity Resources. McGraw Hill, 2006.
12. Hersey, J.C., Kunreuther, H.C., Shoemaker, P.J.: Sources of bias in assessment procedures for utility functions. Management Science 28, 936-953, 1982.
13. Ioannidis, C., Pym, D., Williams, J.: Investments and trade-offs in the economics of information security. Proc. Financial Cryptography and Data Security, Dingledine, R. and Golle, P. (editors), LNCS 5628: 148 - 166, Springer, 2009.
14. Jaffrey, J.Y.: Some experimental findings on decision-making under risk and their implications. European Journal of Operational Research 38, 301-306, 1989.
15. Jimenéz, A., Ríos-Insua, S. Mateos, A.: A decision support system for multi-attribute utility evaluation based on imprecise assignments. Dec. Supp. Syst. 36, 65-79, 2003.
16. Jonsson, E., Olovsson, A.: Quantitative Model of the Security Intrusion Process Based on Attacker Behaviour. IEEE Transactions on Software Engineering 23(4), 235 - 245, 1997.
17. Keeney, R.L, Raiffa, H.: Decisions with Multiple Objectives: Preferences and Value Trade-offs. Wiley, New York, 1976.
18. McCord, M., de Neufville, R.: Lottery equivalents: reduction of the certainty effect problem in utility assessment. Management Science 32, 56-61, 1986.
19. Moore, A., Ellison, R., Linger, R.: Attack Modeling for Information Security and Survivability. Carnegie Mellon Software Engineering Institute. Technical Report CMU/SEI-2001-TN-001, 2001.
20. Nicol, D., Sanders, W., Rivedi, K.: Model-based evaluation: from dependability to security. IEEE Transactions on Dependable and Secure Computing 1(1), 48-65, 2004.
21. Pidd, M.: Tools for Thinking: Modelling in Management Science, Wiley, 2003.
22. Pidd, M.: Complementarity in systems modelling. In: Systems Modelling: Theory and Practice (M. Pidd, editor), Wiley, 2004.
23. Pidd, M.: Computer Simulation in Management Science. Fifth Edition, Wiley, 2004.
24. Rasmussen M, Stamp P.: Where Security Reports Reflects Expanded Role And Responsibilities. Forrester 2005.
25. Stamp, P.: Jericho Forum Looks To Bring Network Walls Tumbling Down. Forrester, 8 July, 2005.
26. Varian, H.: A bayesian approach to real estate management. In S.E. Feinberg and A. Zellner, editors, Studies in Bayesian Economics in Honour of L.J. Savage, 195-208, North Holland, 1974.
27. Yearworth, M., Monahan, B., Pym, D.: Predictive Modelling for Security Operations Economics. Presented at the Workshop on the Economics of Securing the Information Infrastructure (WESII), 23 - 24 October, 2006, Washington DC. Available as HP Labs Technical Report HPL-2006-125.
28. Zellner, A.: Bayesian prediction and estimation using asymmetric loss functions. J. American Statistical Association 81:446-451, 1986.
29. Collinson, M., Monahan, B., and Pym, D.: Semantics for Structured Systems Modelling and Simulation. In Proc. Simutools 2010. ICST: ACM Digital Library and EU Digital Library, 2010. ISBN: 78-963-9799-87-5.
30. Gnosis. http://www.hpl.hp.com/research/systems-security/gnosis.html.