Selecting security control portfolios: a multi-objective simulation-optimization approach

• DOI: 10.1007/s40070-016-0055-7
• Publication Date: 2016-04-20T06:04:36Z
• Authors: Elmar Kiesling; Andreas Ekelhart; Bernhard Grill; Christine Strauss; Christian Stummer
• Keywords: Statistics and Probability; 330; Applied Mathematics; General Decision Sciences; multi-objective portfolio selection; BWL; 02 engineering and technology; 102016 IT-Sicherheit; simulation; 502050 Business informatics; interactive decision support; 101015 Operations Research; Computational Mathematics; 502050 Wirtschaftsinformatik; 102009 Computer simulation; CMI; IT security analysis; 101015 Operations research; genetic algorithm; 0202 electrical engineering, electronic engineering, information engineering; Business, Management and Accounting (miscellaneous); 102016 IT security; 102009 Computersimulation

Organizations’ information infrastructures are exposed to a large variety of threats. The most complex of these threats unfold in stages, as actors exploit multiple attack vectors in a sequence of calculated steps. Deciding how to respond to such serious threats poses a challenge that is of substantial practical relevance to IT security managers. These critical decisions require an understanding of the threat actors—including their various motivations, resources, capabilities, and points of access—as well as detailed knowledge about the complex interplay of attack vectors at their disposal. In practice, however, security decisions are often made in response to acute short-term requirements, which results in inefficient resource allocations and ineffective overall threat mitigation. The decision support methodology introduced in this paper addresses this issue. By anchoring IT security managers’decisions in an operational model of the organization’s information infrastructure, we provide the means to develop a better understanding of security problems, improve situational awareness, and bridge the gap between strategic security investment and operational implementation decisions. To this end, we combine conceptual modeling of security knowledge with a simulation-based optimization that hardens a modeled infrastructure against simulated attacks, and provide a decision support component for selecting from efficient combinations of security controls. We describe the prototypical implementation of this approach, demon-strate how it can be applied, and discuss the results of an in-depth expert evaluation.