Please use this identifier to cite or link to this item: https://dair.nps.edu/handle/123456789/1442
Title: Decision Support for Cybersecurity Risk Assessment
Authors: Hanan Hibshi
Travis D. Breaux
Keywords: Cybersecurity
Risk
IT
Software
Issue Date: 30-Mar-2017
Publisher: Acquisition Research Program
Citation: Published--Unlimited Distribution
Series/Report no.: Risk Management
SYM-AM-17-064
Abstract: The U.S. DoD transition to a multi-tier, risk management framework aims to streamline information assurance assessments by promoting alignment with NIST information assurance control sets. While these control sets are broadly applicable and comprehensive, those responsible for accreditation will continue to struggle with assessing security risk in dynamically reconfigurable systems. Security analysts rely largely on background knowledge and experience to make security-related decisions. With increasingly dynamic software, analysts need to resolve dependencies among components and understand how those dependencies affect security requirements. Analysts need new decision-support tools based on models that predict how analysts reason about security in distributed systems. We present an approach that formalizes security expert assessments of security requirements nested in scenarios into threat mitigation rules. The assessments are collected empirically using factorial vignettes. The vignette results are statistically analyzed to yield membership functions for a type-2 fuzzy logic system. The corresponding type-2 fuzzy sets encode the interpersonal and intrapersonal uncertainties among security analysts in their decision-making. This work establishes an early foundation for a digital cyber-security decision-support service where an IT professional with any level of security background can benefit from efficiently receiving security assessments and recommendations.
Description: Acquisition Management / Defense Acquisition Community Contributor
URI: https://dair.nps.edu/handle/123456789/1442
Appears in Collections:Annual Acquisition Research Symposium Proceedings & Presentations

Files in This Item:
File SizeFormat 
SYM-AM-17-064.pdf417.82 kBAdobe PDFView/Open


Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.