A model for evaluating IT security investments
Communications of the ACM - Has the Internet become indispensable?
Workshop-based Multiobjective Security Safeguard Selection
ARES '06 Proceedings of the First International Conference on Availability, Reliability and Security
Using CP-nets as a guide for countermeasure selection
Proceedings of the 2007 ACM symposium on Applied computing
A Cost-Sensitive Model for Preemptive Intrusion Response Systems
AINA '07 Proceedings of the 21st International Conference on Advanced Networking and Applications
Effective Security Safeguard Selection Process for Return on Security Investment
APSCC '08 Proceedings of the 2008 IEEE Asia-Pacific Services Computing Conference
Risk Analysis and Security Countermeasure Selection
Risk Analysis and Security Countermeasure Selection
A service dependency model for cost-sensitive intrusion response
ESORICS'10 Proceedings of the 15th European conference on Research in computer security
| Hi-index | 0.00 |
As the number of attacks, and thus the number of alerts received by Security Information and Event Management Systems (SIEMs) increases, the need for appropriate treatment of these alerts has become essential. The new generation of SIEMs focuses on the response ability to automate the process of selecting and deploying countermeasures. However, current response systems select and deploy security measures without performing a comprehensive impact analysis of attacks and response scenarios. This paper addresses this limitation by proposing a model for the automated selection of optimal security countermeasures. In addition, the paper compares previous mathematical models and studies their limitations, which lead to the creation of a new model that evaluates, ranks and selects optimal countermeasures. The model relies on the optimization of cost sensitive metrics based on the Return On Response Investment (RORI) index. The optimization compares the expected impact of the attacks when doing nothing with the expected impact after applying countermeasures. A case study of a real infrastructure is deployed at the end of the document to show the applicability of the model over a Mobile Money Transfer Service.