Attack-Potential-Based Survivability Modeling for High-Consequence Systems

Authors:
J. McDermott
Affiliations:
Naval Research Laboratory
Venue:
IWIA '05 Proceedings of the Third IEEE International Workshop on Information Assurance
Year:
2005

Citing 0
Cited 3

Quantified security is a weak hypothesis: a critical survey of results and assumptions

NSPW '09 Proceedings of the 2009 workshop on New security paradigms workshop
Risks and Benefits of Signaling Information System Characteristics to Strategic Attackers

Journal of Management Information Systems
Survivability computation of networked information systems

CIS'05 Proceedings of the 2005 international conference on Computational Intelligence and Security - Volume Part II

Quantified Score

Hi-index	0.00

Visualization

Abstract

Previous quantitative models of security or survivability have been defined on a range of probable intruder behavior. This measures survivability as a statistic such as mean time to breach. This kind of purely stochastic quantification is not suitable for high-consequence systems. For high-consequence systems the quantified survivability should be based on the most competent intruders the system is likely to face. We show how to accomplish this with a contingency analysis based on variations in intruder attack-potential. The quantitative results are then organized and presented according to intruder attack potential. Examples of the technique are presented using stochastic process algebra. An interesting result for diverse replication is included in the examples.