Decision Support for Mission-Centric Network Security Management

Abstract

In this paper, we propose a decision support process that is designed to help network and security operators in understanding the complexity of a current security situation and decision making concerning ongoing cyber-attacks and threats. The process focuses on enterprise missions and uses a graphbased mission decomposition model that captures the missions, underlying hosts and services in the network, and functional and security requirements between them. Knowing the vulnerabilities and attacker's position in the network, the process employs logical attack graphs and Bayesian network to infer the probability of the disruption of the confidentiality, integrity, and availability of the missions. Based on the probabilities of disruptions, the process suggests the most resilient mission configuration that would withstand the current security situation.

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

“…The toolset is publicly available † , and the implemented algorithms were presented in another previous work. 64 Otherwise, our previous work presents only the basic ideas 64 and places particular tools into context. 2 In this article, we provide a detailed description of our approach in a generic context, not specifically for the incident handling support.…”

“…All the functional requirements have to be satisfied in order to keep the mission operational. 64 The first phase of the decision support system consists of the decomposition of the mission and the definition of its functional and security requirements. An enterprise mission is decomposed into one or more mission-supportive processes, mission-related activities delivered by people through IT services and cyber components.…”

“…The attacker's privileges are the privileges held by the attacker on a controlled system. The security state assessment was partially proposed in our previous work 64 and is discussed in detail in Section 3.2. The third phase, mission resilience recalculation, is triggered by a change in the security situation.…”

“…The resulting model then allows for calculating the probability that an attacker reaches the target privilege, that is, the probability that the security requirements are violated. The third phase was partially proposed in our previous work 64 and is discussed in detail in Section 3.3.…”

“…Finally, we present the algorithm of the resilience calculation that uses both graph models. Our approach to this phase was partially presented in our previous work 64 and is extended here.…”