Using Analytical Hierarchy and Analytical Network Processes to Create Cyber Security Metrics

Abstract

Authentication, authorization, and accounting are key access control measures that decision makers should consider when crafting a defense against cyber attacks. Two decision theory methodologies were compared.Analytical hierarchy and analytical network processes were applied to cyber security-related decisions to derive a measure of effectiveness for risk evaluation. A network/access mobile security use case was employed to develop a generalized application benchmarking framework. Three communities of interest, which include local area network, wide area network, and remote users, were referenced while demonstrating how to prioritize alternatives within weighted rankings. Subjective judgments carry tremendous weight in the minds of cyber security decision makers. An approach that combines these judgments with quantitative data is the key to creating effective defensive strategies.

Review and insight on the behavioral aspects of cybersecurity

“…MCDM is crucial for several real life problems including cybersecurity. However, the discussion on the usability of decision theory against cyber threats is limited, which indicates the existence of a gap (Wilamowski et al 2017). Often, challenges rise during the evaluation of alternatives in terms of a set of deciding measures.…”

“…There is no doubt that decision making in this paper's context cannot be easily modeled because of dealing with human element and judgement. A wide range of mathematical methods of MCDM for evaluation and validation of alternatives exist, and embedded in, linear programming, integer programming, design of experiments, Bayesian networks (Wilamowski et al 2017). MCDM usually involve three steps when using numerical analysis of the alternatives: (1) identify alternatives to criteria, (2) attach numerical measures to the criteria and impact of alternatives, and (3) rank each alternative after processing numerical values (Triantaphyllou et al 1997).…”

“…We can assume so far that decision making theories can easily give different answers to the same cybersecurity problem, yet they should be used as tools to back a decision as the authors of Triantaphyllou and Mann (1995) suggested. The authors of Wilamowski et al (2017) have studied two theories in decision making: Analytical Hierarchy Process (AHP) and an Analytical Network Process (ANP). They determined that a generalized application benchmark framework could be employed to derive a Measure of Effectiveness (MOE) that relate to the overall operational success criteria (mission performance, safety, availability, and security).…”