A novel Risk Assessment and Optimisation Model for a multi-objective network security countermeasure selection problem

Decision Support Systems

Volumn 53, Issue 3, 2012, Pages 599-610

  Viduto, Valentina ^a   Maple, Carsten ^a   Huang, Wei ^a   López Peréz, David ^b  

^a UNIVERSITY OF BEDFORDSHIRE   (United Kingdom)

^b KING'S COLLEGE LONDON   (United Kingdom)

Author keywords

Countermeasure selection problem; Financial decision support; Multi objective optimisation; Risk assessment; Tabu search

Indexed keywords

BUDGET CUTS; DATA LOSS; EFFICIENT FRONTIER; FINAL DECISION; FINANCIAL COSTS; FINANCIAL DECISION SUPPORT; HIGH DEMAND; MULTI OBJECTIVE; NONDOMINATED SOLUTIONS; OPTIMISATION MODELS; SECURITY COUNTERMEASURES; SECURITY MEASURE; SELECTION PROBLEMS; SYSTEM KNOWLEDGE;

DECISION SUPPORT SYSTEMS; MULTIOBJECTIVE OPTIMIZATION; RISK ASSESSMENT; TABU SEARCH;

NETWORK SECURITY;

EID: 84862573944     PISSN: 01679236     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.dss.2012.04.001     Document Type: Article

References (37)

1. R. Anderson, P. Feldman, S. Gerwehr, B. Houghton, R. Mesic, J. Pinder, J. Rothenberg, and J. Chiesa Securing the U.S. Defense Information Infrastructure: A Proposed Approach 1999 RAND Santa Monica, CA
2. A. Asosheh, B. Dehmoubed, and A. Khani A new quantitative approach for information security risk assessment International Conference on Computer Science and Information Technology 2009 222 227
3. S. Bistarelli, F. Fioravanti, and P. Peretti Defense trees for economic evaluation of security investments ARES 2006 416 423 (Pubitemid 44732672)
4. R. Dewri, N. Poolsappasit, I. Ray, and D. Whitley Optimal security hardening using multi-objective optimization on attack tree models of networks ACM Conference on Computer and Communications Security 2007 204 213
5. DTI Information Security Breaches Survey Tech. rep 2004 Department of Trade and Industry
6. M. Gendreau An introduction to tabu search International series in operations research and management science 57 2003 37 54
7. F. Glover, and M. Laguna Tabu Search 1997 Kluwer Academic Publishers Norwell, MA, USA
8. M. Gupta, J. Rees, A. Chaturvedi, and J. Chi Matching information security vulnerabilities to organizational security profiles: a genetic algorithm approach Decision Support Systems 41 2006 592 603 (Pubitemid 43233889)
9. IBM Software online catalog http://www-01.ibm.com/software/info/app/ ecatalog 2011 Accessed before 1st of October 2011
10. ISO/IEC 17799:2005 Information technology - code of practice for information security management 2005
11. ISO/IEC 27001:2005 Information technology - Security techniques - Information security management systems - Requirements 2005 International Organisation for Standardization
12. J. Legriel, C. Le Guernic, S. Cotton, and O. Maler Approximating the pareto front of multi-criteria optimization problems Tools and Algorithms for the Construction and Analysis of Systems Vol. 6015 2010 Springer Berlin/Heidelberg 69 83
13. D. López-Peréz, Interference avoidance in macrocell-femtocell self-organizing networks: models and optimization, Ph.D. thesis, University of Bedfordshire (2010).
14. F. Luna, A.J. Nebro, and E. Alba A globus-based distributed enumerative search algorithm for multi-objective optimization Tech. rep 2004 Departamento de Lenguajes y Ciencias de la Computacion, University of Malaga
15. H. Lv Research on network risk assessment based on attack probability International Workshop on Computer Science and Engineering 2 2009 376 381
16. C. Maple, and A. Phillips UK Security Breach Investigations Report, 7Safe 2010
17. C. Maple, and V. Viduto A visualisation technique for the identification of security threats in networked systems Information Visualisation 2010 551 556
18. P. Mell, K. Scarfone, and S. Romanosky A complete guide to the common vulnerability scoring system version 2.0 Tech. rep 2007
19. Microsoft Corporation Microsoft Security Response Center Security Bulletin Severity Rating System http://technet.microsoft.com/en-us/security/ bulletin/rating 2002 Accessed before 1st of February 2011
20. T. Neubauer, C. Stummer, and E. Weippl Workshop-based multiobjective security safeguard selection International Conference on Availability, Reliability and Security 2006 366 373 (Pubitemid 44732666)
21. T. Neubauer, A. Ekelhart, and S. Fenz Interactive selection of ISO 27001 controls under multiple objectives SEC 2008 477 492
22. J. Newsome, D. Brumley, and D.X. Song Vulnerability-specific execution filtering for exploit prevention on commodity software NDSS 2006
23. NIST National vulnerability database, automating vulnerability management, security measurement and compliance checking http://nvd.nist.gov/ home.cfm Accessed before 1st of December 2010.
24. S. Noel, S. Jajodia, B. O'Berry, and M. Jacobs Efficient minimum-cost network hardening via exploit dependency graphs ACSAC 2003 86 95
25. PTA A practical threat analysis case study: next generation call accounting 2005 accessed before 10 May 2011
26. Softerra Softerra LDAP administrator http://www.ldapbrowser.com/purchase. htm 2011 Accessed before 1st of October 2011
27. G. Stoneburner, A. Goguen, and A. Feringa Risk Management Guide for Information Technology Systems Special Publication SP800-30 2002
28. Symantec SSL certificates https://www.verisign.co.uk/ssl Accessed before 1st of October 2011
29. M. Templeman, M. Beishon, L. Malachowski, A. Wilson, T. Nash, and L. Robertson Information security - best practice measures for protecting your business Tech. rep 2005 Department of Trade and Industry
30. US CERT US-CERT Vulnerability Note Field Descriptions http://www.kb.cert.org/vuls/html/fieldhelp 2006 Accessed before 10th of December 2010
31. US-CERT Introduction to recommended practices http://www.us-cert.gov/ control-systems/practices/ Accessed before 1st of April 2011
32. S. Vadera, C. Potter, and A. Beard Information Security Breaches Survey Tech. rep 2008 PriceWaterHouseCoopers
33. Verizon 2008 Data Breach Investigations Report Tech. rep 2008 Verizon Business RISK Team
34. V. Viduto, C. Maple, and W. Huang An analytical evaluation of network security modelling techniques applied to manage threats, International Conference on Broadband, Wireless Computing Communication and Applications 2010 117 123
35. V. Viduto, C. Maple, and W. Huang Managing threats by the use of visualisation techniques International Journal of Space based and Situated Computing 1 2/3 2011 204 212 10.1504/IJSSC.2011.040347
36. L. Wang, S. Noel, and S. Jajodia Minimum-cost network hardening using attack graphs Computer Communications 29 2006 3812 3824 (Pubitemid 44751132)
37. E. Zitzler, M. Laumanns, and S. Bleuler A tutorial on evolutionary multiobjective optimization X. Gandibleux, Metaheuristics for Multiobjective Optimisation, Lecture Notes in Economics and Mathematical Systems 2004 Springer