University of Surrey

Test tubes in the lab Research in the ATI Dance Research

Decision support approaches for cyber security investment

Fielder, A, Panaousis, Emmanouil, Malacaria, P, Hankin, C and Smeraldi, F (2016) Decision support approaches for cyber security investment Decision Support Systems, 86. pp. 13-23.

[img]
Preview
Text
1-s2.0-S0167923616300239-main.pdf - Version of Record

Download (555kB) | Preview

Abstract

When investing in cyber security resources, information security managers have to follow effective decisionmaking strategies. We refer to this as the cyber security investment challenge.In this paper, we consider three possible decision support methodologies for security managers to tackle this challenge. We consider methods based on game theory, combinatorial optimisation, and a hybrid of the two. Our modelling starts by building a framework where we can investigate the effectiveness of a cyber security control regarding the protection of different assets seen as targets in presence of commodity threats. As game theory captures the interaction between the endogenous organisation’s and attackers’ decisions, we consider a 2-person control game between the security manager who has to choose among different implementation levels of a cyber security control, and a commodity attacker who chooses among different targets to attack. The pure game theoretical methodology consists of a large game including all controls and all threats. In the hybrid methodology the game solutions of individual control-games along with their direct costs (e.g. financial) are combined with a Knapsack algorithm to derive an optimal investment strategy. The combinatorial optimisation technique consists of a multi-objective multiple choice Knapsack based strategy. To compare these approaches we built a decision support tool and a case study regarding current government guidelines. The endeavour of this work is to highlight the weaknesses and strengths of different investment methodologies for cyber security, the benefit of their interaction, and the impact that indirect costs have on cyber security investment. Going a step further in validating our work, we have shown that our decision support tool provides the same advice with the one advocated by the UK government with regard to the requirements for basic technical protection from cyber attacks in SMEs.

Item Type: Article
Divisions : Faculty of Engineering and Physical Sciences > Computing Science
Authors :
NameEmailORCID
Fielder, AUNSPECIFIEDUNSPECIFIED
Panaousis, Emmanouile.panaousis@surrey.ac.uk0000-0001-7306-4062
Malacaria, PUNSPECIFIEDUNSPECIFIED
Hankin, CUNSPECIFIEDUNSPECIFIED
Smeraldi, FUNSPECIFIEDUNSPECIFIED
Date : 19 March 2016
Identification Number : 10.1016/j.dss.2016.02.012
Copyright Disclaimer : © 2016 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).
Uncontrolled Keywords : Cyber security investments decision support Game theory Optimisation
Depositing User : Melanie Hughes
Date Deposited : 27 Sep 2017 14:31
Last Modified : 27 Sep 2017 15:16
URI: http://epubs.surrey.ac.uk/id/eprint/842414

Actions (login required)

View Item View Item

Downloads

Downloads per month over past year


Information about this web site

© The University of Surrey, Guildford, Surrey, GU2 7XH, United Kingdom.
+44 (0)1483 300800