Defense trees for economic evaluation of security investments
Authors:
- 1 January 2006
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 8 pp.-423
Abstract
In this paper we present a mixed qualitative and quantitative approach for evaluation of information technology (IT) security investments. For this purpose, we model security scenarios by using defense trees, an extension of attack trees with attack countermeasures and we use economic quantitative indexes for computing the defender's return on security investment and the attacker's return on attack. We show how our approach can be used to evaluate effectiveness and economic profitability of countermeasures as well as their deterrent effect on attackers, thus providing decision makers with a useful tool for performing better evaluation of IT security investments during the risk management process.Keywords
This publication has 8 references indexed in Scilit:
- Assessing the risk of using vulnerable components2008
- Incentive-based modeling and inference of attacker intent, objectives, and strategies2003
- The economics of information security investmentACM Transactions on Information and System Security, 2002
- Attack Modeling for Information Security and Survivability2001
- Handbook of Information Security ManagementEDPACS, 1998
- Possibility Theory1988
- A Comparison of Commercial and Military Computer Security Policies1987
- Fuzzy sets as a basis for a theory of possibilityFuzzy Sets and Systems, 1978