A game theoretic approach to cyber security risk management. (April 2018)

• Record Type: Journal Article
• Authors: Musman, Scott; Turner, Andrew
• Other Names: Kott Alexander guest-editor.
• Is Part Of: Journal of defense modeling and simulation. Volume 15:Number 2(2018:Apr.)
• Page Start: 127
• Page End: 146
• Publication Date: 2018-04
• Subjects: Cyber security risk management -- game theory -- investment portfolio analysis -- mission assurance -- return on investment -- risk mitigation -- system topology modeling; Military art and science -- Computer simulation -- Periodicals; 355.0011305
• DOI: 10.1177/1548512917699724
• Languages: English
• ISSNs: 1548-5129

Abstract

This paper describes the Cyber Security Game (CSG). Cyber Security Game is a method that has been implemented in software that quantitatively identifies cyber security risks and uses this metric to determine the optimal employment of security methods for any given investment level. Cyber Security Game maximizes a system's ability to operate in today's contested cyber environment by minimizing its mission risk. The risk score is calculated by using a mission impact model to compute the consequences of cyber incidents and combining that with the likelihood that attacks will succeed. The likelihood of attacks succeeding is computed by applying a threat model to a system topology model and defender model. Cyber Security Game takes into account the widespread interconnectedness of cyber systems, where defenders must defend all multi-step attack paths and an attacker only needs one to succeed. It employs a game theoretic solution using a game formulation that identifies defense strategies to minimize the maximum cyber risk (MiniMax). This paper discusses the methods and models that compose Cyber Security Game . A limited example of a Point of Sale system is used to provide specific demonstrations of Cyber Security Game models and analyses.