Analysing the Performance of Security Solutions to Reduce Vulnerability Exposure Window

Abstract

In this paper we present a novel approach of using mathematical models and stochastic simulations to guide and inform security investment and policy change decisions. In particular, we investigate vulnerability management policies, and explore how effective standard patch management and emergency escalation based policies are, and how they can be combined with earlier, pre-patch mitigation measures to reduce the potential exposure window.The paper describes the model we constructed to represent typical vulnerability management processes in large organizations, which captures the external threat environment and the internal security processes and decision points. We also present the results from the experimental simulations, and show how changes in security solutions and policies, such as speeding up patch deployment and investing in early mitigation measures, affect the overall exposure window in terms of the time it takes to reduce the potential risk.We believe that this type of mathematical modelling and simulation-based approach provides a novel and useful way of considering security investment decisions, which is quite distinct from traditional risk analysis.

Decision support for systems security investment

“…Recent work by the present authors and others (see, for example, [3,5,6,13,27]) has begun to develop a new methodology for addressing this problem that integrates two main approaches. On the one hand, we employ executable mathematical models of the underlying system captured within its dynamic threat and economic environments.…”

“…The experience of security managers and researchers (e.g., [1,3,5,11,27]) suggests that accounting-based approaches to addressing this problem, employing return-on-investment-type calculations, cannot adequately address the operational and dynamic aspects of the analysis that is required. Indeed, very few business or IT stakeholders have a good understanding of how security choices affect business outcomes.…”

Fixed Costs, Investment Rigidities, and Risk Aversion in Information Security: A Utility-theoretic Approach

“…In the case of risk management and mitigation of vulnerability, this is a utility-of-action problem, which has been explored extensively in applied, commercial, contexts in [8,9,24], work which has directly informed the present paper. To demonstrate this issue appropriately in a timing framework, we treat system vulnerabilities as being stochastic discount factors that erode the attributes of a system.…”

Optimizing Network Patching Policy Decisions

“…Within the years 2002-2009 we have found several, though sketchy, publicly-announced instances of working exploits for Cisco vulnerabilities 3 . These exploits related to vulnerabilities for which a patch had been released over a year earlier by the vendor.…”

“…We have previously developed a model of the patch management processes to explore the risk exposure window across Wintel environment in an organization [3]. We have adapted this model for network environment by introducing new features such as slower patching rate through patch uptake function and allowing longer patch assessment and preparation time.…”