Mission assurance policy and risk management in cybersecurity

Çam, Hasan; Mouallem, Pierre

doi:10.1007/s10669-013-9468-z

Cited by 4 publications

(2 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Table 3 presents the number of papers that belong to each subcategory and the respective percentage. [16] proposed a mission assurance policy, that adapts to the dynamic security status of all assets using a Petri net model along with binary or multilevel logic decision, to determine the security status of cyber assets. The main goal of the proposed model was to determine if a mission could be completed.…”

Section: Artificial Intelligence/machine Learningmentioning

confidence: 99%

Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review

Cheimonidis,

Rantos

2023

Future Internet

View full text Add to dashboard Cite

Traditional information security risk assessment (RA) methodologies and standards, adopted by information security management systems and frameworks as a foundation stone towards robust environments, face many difficulties in modern environments where the threat landscape changes rapidly and new vulnerabilities are being discovered. In order to overcome this problem, dynamic risk assessment (DRA) models have been proposed to continuously and dynamically assess risks to organisational operations in (near) real time. The aim of this work is to analyse the current state of DRA models that have been proposed for cybersecurity, through a systematic literature review. The screening process led us to study 50 DRA models, categorised based on the respective primary analysis methods they used. The study provides insights into the key characteristics of these models, including the maturity level of the examined models, the domain or application area in which these models flourish, and the information they utilise in order to produce results. The aim of this work is to answer critical research questions regarding the development of dynamic risk assessment methodologies and provide insights on the already developed methods as well as future research directions.

show abstract

Section: Artificial Intelligence/machine Learningmentioning

confidence: 99%

Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review

Cheimonidis,

Rantos

2023

Future Internet

View full text Add to dashboard Cite

show abstract

“…First, Baiardi and Sgandurra (2013) discuss a simulation-based risk assessment methodology that models adaptive threat agents as well as identifies effective countermeasures. Cam and Mouallem (2013) then describe a model that dynamically models mission assurance through monitoring of cyber assets and includes a risk management scheme to mitigate risks to acceptable levels. Finally, Ezell et al (2013) describe a framework to model the risks and impacts of cyber attacks on traffic control systems.…”

Section: Information Domainmentioning

confidence: 99%

Four domains of cybersecurity: a risk-based systems approach to cyber decisions

2013

View full text Add to dashboard Cite

With pervasive reliance on information technology, the robustness and security of these systems are critical to diverse infrastructure systems and particularly to resilience of industry, military, society, community, etc. As safeguards evolve and are implemented, adversaries develop novel ways to breach information technology systems, access sensitive data, and disrupt critical infrastructure. While significant advances in the field of cybersecurity have been achieved, solutions have focused more on the technical issues at component levels such as threat detection, encryption, and other mitigation procedures and technologies and less on how to address overall cyber-influenced risk and to support decisions at level of large-scale systems.This issue explores the theory, methods, and applications of systems analysis for cybersecurity (including software and hardware and other perspectives) with linkages to other subject areas such as risk management, systems engineering, and strategic decision-making. In particular, there is a need to approach cybersecurity risks from a multi-scale, systems perspective, recognizing the diverse interactions among cyber, physical, and human systems (Lambert et al. 2013). In this direction, our first paper frames the rest of the issue in terms of cyber-resilience, wherein Linkov et al. (2013) discuss how decision-makers require the ability to plan for threats and absorb, recover, and adapt to threats after they occur along the physical, information, cognitive, and social domains in which these systems exist. The remaining articles are organized by these domains respecting that several of the articles cross domains. Physical domainThe physical domain includes hardware and software and networks as building blocks of cyber infrastructure. Gilmore et al. (2013) outline the risks posed by counterfeit electronic parts in the context of hardware security. They discuss a validation strategy based on infrared analysis and blind source separation to authenticate suspected counterfeit parts and stop counterfeits from moving downstream in the supply chain. Information domainMonitoring, information storage, and visualization are features of the information domain. The issue features several articles that focus on risks within the information domain. First, Baiardi and Sgandurra (2013) discuss a simulation-based risk assessment methodology that models adaptive threat agents as well as identifies effective countermeasures. Cam and Mouallem (2013) then describe a model that dynamically models mission assurance through monitoring of cyber assets and includes a risk management scheme to mitigate risks to acceptable levels. Finally, Ezell et al. (2013) describe a framework to model the risks and impacts of cyber attacks on traffic control systems. Cognitive domainInformation should be properly analyzed and sensed as well as used for decision-making in the cognitive domain.

show abstract