1. Author: Tadeusz Sawik Decision Support Systems Volume 55, Issue 1, April 2013, Pages 156–164 Adviser: Frank, Yeong-Sung Lin Presenter: Yi-Cin Lin

2. Introduction Problem description Model  Single-objective approach  Bi-objective approach Computational examples Conclusion

3. Introduction Problem description Model  Single-objective approach  Bi-objective approach Computational examples Conclusion

4. The various actions developed to prevent intrusions or to mitigate the impact of successful breaches are called controls or countermeasures. Countermeasures Limit physical access Block access or protect privacy over networks Recovery

5. In practice, even the most sophisticated countermeasures cannot be expected to completely block attacks. This paper deals with the optimal selection of countermeasures in IT security planning to prevent or mitigate cyber-threats and a mixed integer programming approach is proposed for the decision making.

6. The problem is formulated as a single- or bi-objective mixed integer program Single-objectiveRisk-neutral Minimize expected cost Risk-averse Minimization of expected worst- case cost

7. The bi-objective trade-off model provides the decision maker with a simple tool for balancing expected and worst-case losses and for shaping of the resulting cost distribution through the selection of optimal subset of countermeasures.

8. Introduction Problem description Models  Single-objective approach  Bi-objective approach Computational examples Conclusion

9. The blocking effectiveness of each countermeasure is assumed to be independent whether or not it is used alone or together with other countermeasures.

10. Notation Total of potential scenarios.

11. Denote by the probability of threat. Notation The probability of attack scenario in the presence of independent threat events is

12. Notation  indicates that countermeasure totally prevents successful attacks of threat.  denotes that countermeasure is totally incapable of mitigating threat.

13. The proportion of successful attacks of threats type that survive all countermeasures in the subset of selected countermeasures is The expected proportion of successful attacks of threat type for the subset of selected countermeasures is

14. Notation The subset of selected countermeasures must satisfy the available budget constraint

15. The decision maker needs to decide which countermeasures to select to minimize losses from surviving occurrences of threats under limited budget for countermeasures implementation.

16. Introduction Problem description Model  Single-objective approach  Bi-objective approach Computational examples Conclusion

17. Model  Single-objective approach  Minimization of expected cost  Minimization of expected worst-case cost (Minimize conditional value-at-risk)  Bi-objective approach

18. In a risk-neutral operating condition the overall quality of the selected countermeasure portfolio can be measured by the expected cost of losses from successful attacks. Single-objectiveRisk-neutral Minimize expected cost SP_E SP_E+B Risk-averse Minimization of expected worst- case cost SP_CV SP_CV+B

19. Notation Countermeasure is selected for implementation if, otherwise.

20. Countermeasure is selected at exactly one level i.e., Notation

21. The proportion of successful attacks of threats type that survive all selected countermeasures is As a result, the expected cost of losses from successful attacks is given by a nonlinear formula

22. Model NSP_E: Minimize Expected Cost (1) Subject to 1. Countermeasure selection constraints

23. Subject to 2.Integrality conditions: The nonlinear integer program NSP_E is computationally hard for solving, even for small size instances of the problem. Computing the nonlinear objective function Recursive procedure by using a set of linear equations

24. The nonlinear objective function (1) can be replaced with a formula

25. In order to compute for each threat, a recursive procedure is proposed below.

26. For each threat and countermeasure can be calculated recursively as follows. The initial condition is The remaining terms

27. In order to eliminate nonlinear terms in the right-hand side of Eq. (10), define an auxiliary variable

28. and, in particular, for

31. Comparison of Eqs. (12) and (15) produces to the following relation

33. The above procedure eliminates all variables for each. Summarizing, the proportion of successful attacks = in For each threat can be calculated recursively, using Eqs. (17), (16) and (13) with replaced by.

34. Model SP_E: Minimize Expected Cost (5) subject to 1. Countermeasure selection constraints Eqs. (2) and (3).

35. Subject to 2. Surviving threats balance constraints (17) (16) (15)

36. Subject to 3. Non-negativity and integrality conditions: (4)

37. Adviser: Frank, Yeong-Sung Lin Presenter: Yi-Cin Lin

38. In a risk-neutral operating condition the overall quality of the selected countermeasure portfolio can be measured by the expected cost of losses from successful attacks. Single-objectiveRisk-neutral Minimize expected cost SP_E SP_E+B Risk-averse Minimization of expected worst- case cost SP_CV SP_CV+B

39. Model  Single-objective approach  Minimization of expected cost  Minimization of expected worst-case cost (Minimize conditional value-at-risk)  Bi-objective approach

41. Value-at-Risk (VaR) At a 100α% confidence level is the targeted cost of the portfolio such that for 100α% of the scenarios, the outcome will not exceed VaR, i.e., in 100(1−α)% of the scenarios, the outcome may exceed VaR.

42. Conditional Value-at-Risk (CVaR) At a 100α% confidence level is the approximate or exact expected cost of the portfolio in the worst 100(1−α)% of the cases. We allow 100(1−α)% of the outcomes to exceed VaR, and the mean value of these outcomes is represented by CVaR.

43. The decision maker controls the risk of high losses caused by operational disruptions by choosing the confidence level α. The greater the confidence level α, the more risk aversive is the decision maker and the smaller percent of the highest cost outcomes is focused on.

44. The risk aversive decision maker wants to minimize the expected worst-case costs exceeding VaR, by minimizing CVaR, given available budget B for selected countermeasures.

45. Notation Model SP_CV: Minimize

46. Subject to 1. Countermeasure selection constraints: Eqs. (2)–(3). 2. Surviving threats balance constraints: Eqs. (18)–(21). 3. Risk constraints: 4. Non-negativity and integrality conditions: Eqs. (22)–(24)

47. Models SP_E and SP_CV can be enhanced for simultaneous optimization of the expenditures on countermeasures and the cost of losses from successful attacks.  Removed constraints (3) 

48. Model SP_E+B Minimize Required Budget and Expected Cost subject to Eqs. (2), (18)–(24) and (28)

49. Model SP_CV+B Minimize Required Budget and CVaR subject to Eqs. (2) and (18)–(28)

50. Introduction Problem description Model  Single-objective approach  Bi-objective approach Computational examples Conclusion

51. In the single objective approach the countermeasure portfolio is selected by minimizing either the expected loss (plus the required budget) or the expected worst-case loss (plus the required budget).

52. The expected cost function that aims at optimizing an average performance of IT security system, virtually neglects the worst-case losses. CVaR that aims at optimizing worst-case performance, focuses on the low probability, high loss outcomes.

53. Model WSP Minimize Subject to Eqs. (2), (5) and (18)–(28)

54. Decision maker controls  Risk of high losses by choosing the confidence level α  trade-off between expected and worst- case losses by choosing the trade-off parameter λ.

55. Introduction Problem description Model  Single-objective approach  Bi-objective approach Computational examples Conclusion

56. The data set is similar to the one presented in [20], which was based on the threat set reported on IT security forum EndpointSecurity.org

57. =, the number of threats and the number of countermeasures, were equal to 10, and the corresponding number of potential attack scenarios, was equal to 1024.

60. Selection of countermeasures Effectiveness of blocking different threats Implementation costs Probability of potential attack scenarios

67. Figs. 1–4 indicate that the probability measure is concentrated in finitely many points, which is typical for the scenario- based optimization under uncertainty.

68. For the bi-objective approach, the subsets of nondominated solutions were computed by parameterization on λ∈{0.01,0.10,0.25,0.50,0.75,0.90,0.99} the weighted-sum program WSP.

71. For problem sizes with more types of threats and countermeasures the scenario-based mixed integer programs proposed may become intractable using Gurobi, if sufficient memory for a branch-and-cut procedure is not available.

72. The computational experiments prove that for a limited number of attack scenarios considered, the optimal risk- averse portfolio can be found within CPU seconds, using the Gurobi solver for mixed integer programming.

73. A critical issue that needs to be considered before any practical application of the proposed models is attempted, however, is the estimation of probabilities and the resulting losses associated with each type of threats and countermeasures.

74. In practice, threat likelihood estimates are provided by security experts (e.g., [24]) and complete distributional information is not available. However, the proposed scenario-based approach does not require such a complete information to be available and only assumes independence of different threat events.

75. Thanks for your listening!