Efficiently computing the likelihoods of cyclically interdependent risk scenarios. Issue 64 (January 2017)

• Record Type: Journal Article
• Authors: Muller, Steve; Harpes, Carlo; Le Traon, Yves; Gombault, Sylvain; Bonnin, Jean-Marie
• Is Part Of: Computers & security. Issue 64(2017)
• Page Start: 59
• Page End: 68
• Publication Date: 2017-01
• Subjects: Cyclic dependencies -- Cyclic causal graphs -- Risk analysis -- Risk assessment -- Quantitative assessment -- Dependency graph; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2016.09.008
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Quantitative risk assessment provides a holistic view of risk in an organisation, which is, however, often biased by the fact that risk shared by several assets is encoded multiple times in a risk analysis. An apparent solution to this issue is to take all dependencies between assets into consideration when building a risk model. However, existing approaches rarely support cyclic dependencies, although assets that mutually rely on each other are encountered in many organisations, notably in critical infrastructures. To the best of our knowledge, no author has provided a provably efficient algorithm (in terms of the execution time) for computing the risk in such an organisation, notwithstanding that some heuristics exist. This paper introduces the dependency-aware root cause (DARC) model, which is able to compute the risk resulting from a collection of root causes using a poly-time randomised algorithm, and concludes with a discussion on real-time risk monitoring, which DARC supports by design.