October 2014 Download this article as a PDF

Overview

The TIM Lecture Series is hosted by the Technology Innovation Management (TIM) program at Carleton University in Ottawa, Canada. The lectures provide a forum to promote the transfer of knowledge between university research to technology company executives and entrepreneurs as well as research and development personnel. Readers are encouraged to share related insights or provide feedback on the presentation or the TIM Lecture Series, including recommendations of future speakers.

The sixth TIM lecture of 2014 was held at Carleton University on October 8th, and was presented by George Cybenko, the Dorothy and Walter Gramm Professor of Engineering at Dartmouth College in New Hampshire, United States. In the first part of his lecture, Cybenko provided an overview possible security metrics together with their pros and cons in the context of current IT security practices. In the second part of the lecture, Cybenko presented a modelling and simulation approach that produces meaningful quantitative security metrics as the basis for a more rigorous science of cybersecurity.

Summary

To begin his lecture, Cybenko highlighted the many high-profile cyber-attacks that dominate headlines today, which stand in contrast to massive investments in cybersecurity research and practices, as well as the creation of many cybersecurity companies, over the past 10 to 15 years. Thus, he then challenged the research community – himself included – to demonstrate greater progress over the next 10 years in terms of our capacity to mitigate the impacts of cyber-attacks. And, in introducing the key subject of his lecture, he pointed to the potential for cybersecurity metrics and simulation as a promising avenue to facilitate such progress.

To be effective, cybersecurity metrics should be:

  1. Reproducible: when measuring a particular phenomenon, two people should be able to independently arrive at the same results.
  2. Relevant: organizations must find the metrics operationally relevant and actionable.
  3. A basis for comparison: metrics must facilitate comparisons between architectures, applications, systems, networks, etc.
  4. A basis for claims: metrics must facilitate evaluations of systems and architectures to quantify their suitability to particular applications.

In developing metrics, we must also take into account the computer security lifecycle, which progresses from security concepts (i.e., an understanding of the technology and relevant threats), to architecture (i.e., an abstraction of the design), to implementation (i.e., code, hardware, support, and access), and then to operations (i.e., forensics on past events, real-time monitoring and patching of present conditions, and predicting future events). Metrics must be considered at each step in the lifecycle so that they can be effective once the operations stage is reached.

Next, Cybenko recognized a common skeptical view of security metrics, which, in its extreme form, rejects the need for metrics altogether, arguing that a system is either secure or it is not. However, when challenged to provide an example of a secure system, such skeptics struggle to come up with definitive examples. Thus, in practice, it is worthwhile recognizing a spectrum of computer security and using metrics to try to evaluate just how secure a given system is.

Proposed approaches to cybersecurity metrics include:

  1. Penetration testing: automated tools that run a set of exploits against a network; by definition, penetration tests use only known exploits and cannot assess vulnerabilities or weaknesses that might be revealed by a human attacker.
  2. Red teams: expert hackers hired to assess or attempt to break into a system; however, the perceived protection level is limited to the expenditure on testing (i.e., a company may pay a "Red Team" $X to assess a system, but hackers would expend effort exceeding $X to reach assets of greater value, and much greater human effort may expended for the same cost in countries where the labour rate is much lower).
  3. Compliance: controls and standards for development, software, architecture, etc.; the protection level is only as good as the compliance standards; can redirect an organization's security expenditure away from novel and up-to-date approaches.
  4. Response times: how quickly is a system patched? How quickly does an organization identify and respond to incidents? What is the optimal policy for disclosing vulnerabilities?
  5. Software size, complexity, and constructs: may be indicators of security vulnerability

Each of these approaches has its benefits and shortcomings; however, it may be more useful to think about the field of cybersecurity metrics within the context of risk analysis. Thus, the expected cost of security may be calculated based on the probability and costs of potential losses. For example, in cases where expected losses due to fraud and intrusions exceed the costs of technology updates, the justification for improved technology becomes clear.

Next, in the second part of the lecture, Cybenko presented an alternative, simulation-based approach to cybersecurity metrics, which attempt to quantify cybersecurity. In particular, he focused on the QuERIES methodology, which was also detailed in Cybenko's 2013 article in the TIM Review (Hughes & Cybenko, 2013). The QuERIES methodology quantifies cybersecurity risk following an analogy from physical security, where the "time to compromise" in a system is a measureable performance metric. In cybersecurity, the time it takes an attacker to complete a successful attack against a protected software system provides a similar metric, which can be simulated and then presented in a probability distribution.

The QuERIES methodology simulates the value of success to an attacker if they are able to succeed within a particular amount of time. Thus, the value of the asset to an attacker changes over time because there is a cost to continued effort, and at some point, no amount of effort may be worth the value of the target asset. And, this type of risk-analysis approach is used to assess the progression of cyber-attack, it becomes possible to calculate the optimal time for an attacker to abandon an attack based on the cost of the attack and the value of the asset. Ideally, cybersecurity defenses could be sufficiently robust that the attacker's cost of attacking would be prohibitively high, and an attack would not even be initiated.

For a fuller explanation of the QuERIES methodology, see:

Hughes, J., & Cybenko, G. 2013. Quantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity. Technology Innovation Management Review, 3(8): 15–24.
http://timreview.ca/article/712

 

This report was written by Chris McPhee

Share this article:

Cite this article:

Rate This Content: 
No votes have been cast yet. Have your say!

Keywords: cybersecurity, metrics, modelling, simulation

Comments

http://bit.ly/1P41Awa undangan pernikahan klub bola
http://www.sentrabesibaja.com/welded-beam-castellated-beam-queen-king-cr... Agen Welded Beam T beam King Queen Cross Castellated Beam
http://bit.ly/1P41Awa undangan pernikahan cetak
http://www.jualbesibajamurah.com/harga-besi-profil-cnp-gording-kanal-c-b... Pabrik besi cnp baja
http://www.sentrabesibaja.com/plat-besi-baja-hitam/ Agen Plat Besi Hitam
https://goo.gl/XZ6zpY undangan pernikahan
http://www.sentrabesibaja.com/besi-siku-baja/ Agen Jual Besi Siku Baja
http://www.sentrabesibaja.com/bondek-cor-sni/ Agen Bondek Cor
http://www.sentrabesibaja.com/atap-spandek/ Agen Atap Spandek Sni
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-psi-uli... Toko besi beton psi Ulir Polos
http://www.pusatbesibaja.co.id/harga-besi-profil-cnp-gording-kanal-c-baj... Distributor besi cnp baja
http://www.pusatbesibaja.com/harga-besi-profil-cnp-gording-kanal-c-baja-... Distributor besi cnp baja
http://bit.ly/1P41Awa undangan pernikahan klasik
http://www.jualbesibajamurah.com/harga-besi-profil-h-beam-kanal-h-baja-p... Distributor besi h beam baja
http://www.sentrabesibaja.com/plat-kapal-marine/ Agen Plat Kapal Bki Krakatau Steel
http://www.undangancinta.com undangan pernikahan amplop surat
http://www.sentrabesibaja.com/besi-unp-baja-kanal-u/ Agen Besi Unp Baja Profil Kanal
http://ironsteelcenter.com/stainless-steel-ss-sus-304-210-316-310-301-st... Distributor Stainless steel
http://www.sentrabesibaja.com/plat-bordes-kembang/ Agen Plat Bordes Kembang
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-perwira... Toko besi beton perwira
https://sagalayavillage.com/2017/09/07/sewa-villa-puncak-bukit-danau-clu... sewa villa puncak
http://www.pusatbesibaja.co.id/harga-besi-profil-cnp-gording-kanal-c-baj... Harga besi cnp baja
http://www.pusatbesibaja.com/harga-besi-profil-cnp-gording-kanal-c-baja-... Harga besi cnp baja
http://bit.ly/1P41Awa undangan pernikahan cantik elegan
http://www.jualbesibajamurah.com/harga-besi-profil-h-beam-kanal-h-baja-p... Harga besi h beam baja
http://www.fabrikasikonstruksi.com jasa konstruksi baja
http://www.undangancinta.com undangan pernikahan simple
http://www.sentrabesibaja.com/besi-cnp-baja-kanal-c-gording/ Agen Besi Cnp Profil Baja Gording
http://ironsteelcenter.com/stainless-steel-ss-sus-304-210-316-310-301-st... Supplier Stainless steel
http://www.jualbesibajamurah.com/harga-besi-profil-cnp-gording-kanal-c-b... Distributor besi cnp baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-pas-uli... Toko besi beton PAS
http://www.pusatbesibaja.co.id/harga-besi-profil-cnp-gording-kanal-c-baj... Jual besi cnp baja
http://www.pusatbesibaja.com/harga-besi-profil-cnp-gording-kanal-c-baja-... Jual besi cnp baja
http://bit.ly/1P41Awa undangan pernikahan custom
http://www.jualbesibajamurah.com/harga-besi-profil-h-beam-kanal-h-baja-p... Jual besi h beam baja
http://www.pusatbesibaja.co.id www.pusatbesibaja.co.id
http://www.undangancinta.com undangan pernikahan murah
http://www.sentrabesibaja.com/besi-hollow-hitam-galvaniz/ Agen Besi Hollow
http://ironsteelcenter.com/stainless-steel-ss-sus-304-210-316-310-301-st... Agen Stainless steel
http://www.jualbesibajamurah.com/harga-besi-profil-cnp-gording-kanal-c-b... Harga besi cnp baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-master-... Toko besi beton master steel ms
http://www.pusatbesibaja.co.id/harga-besi-profil-cnp-gording-kanal-c-baj... Supplier besi cnp baja
http://www.pusatbesibaja.com/harga-besi-profil-cnp-gording-kanal-c-baja-... Supplier besi cnp baja
http://bit.ly/1P41Awa undangan pernikahan cute
http://www.jualbesibajamurah.com/harga-besi-profil-h-beam-kanal-h-baja-p... Supplier besi h beam baja
http://www.pusatbesibaja.com www.pusatbesibaja.com https://sagalayavillage.com sewa villa puncak
http://www.undangancinta.com undangan pernikahan unik
http://www.sentrabesibaja.com/besi-wiremesh/ Agen Wiremesh
http://ironsteelcenter.com/stainless-steel-ss-sus-304-210-316-310-301-st... Toko Stainless steel
http://www.jualbesibajamurah.com/harga-besi-profil-cnp-gording-kanal-c-b... Jual besi cnp baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-ksty-ul... Toko besi beton ksty
http://www.pusatbesibaja.co.id/harga-besi-profil-cnp-gording-kanal-c-baj... Toko besi cnp baja
http://www.pusatbesibaja.com/harga-besi-profil-cnp-gording-kanal-c-baja-... Toko besi cnp baja
http://bit.ly/1P41Awa undangan pernikahan coklat
http://www.jualbesibajamurah.com/harga-besi-profil-h-beam-kanal-h-baja-p... Toko besi h beam baja
http://www.jualbesibajamurah.com www.jualbesibajamurah.com
http://bit.ly/1P41Awa undangan pernikahan biasa
http://www.sentrabesibaja.com/pipa-besi-baja-sch-80-schedule/ Agen Besi Pipa Baja Schedule 80
http://ironsteelcenter.com/stainless-steel-ss-sus-304-210-316-310-301-st... Jual Stainless steel
http://www.jualbesibajamurah.com/harga-besi-profil-cnp-gording-kanal-c-b... Supplier besi cnp baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-krakata... Toko besi beton krakatau steel
http://www.pusatbesibaja.co.id/harga-besi-profil-cnp-gording-kanal-c-baj... Agen besi cnp baja
http://www.pusatbesibaja.com/harga-besi-profil-cnp-gording-kanal-c-baja-... Agen besi cnp baja
http://bit.ly/1P41Awa undangan pernikahan cantik dan murah
http://www.jualbesibajamurah.com/harga-besi-profil-h-beam-kanal-h-baja-p... Agen besi h beam baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-sni-uli... Agen besi beton Sni Ulir Polos polos ulir
http://bit.ly/1P41Awa undangan pernikahan bunga
http://www.sentrabesibaja.com/pipa-besi-baja-sch-40-schedule/ Agen Besi Pipa Baja Schedule 40
http://ironsteelcenter.com/stainless-steel-ss-sus-304-210-316-310-301-st... Harga Stainless steel
http://www.jualbesibajamurah.com/harga-besi-profil-cnp-gording-kanal-c-b... Toko besi cnp baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-jcac-ul... Toko besi beton jcac
http://www.pusatbesibaja.co.id/harga-besi-profil-cnp-gording-kanal-c-baj... Pabrik besi cnp baja
http://www.pusatbesibaja.com/harga-besi-profil-cnp-gording-kanal-c-baja-... Pabrik besi cnp baja
http://bit.ly/1P41Awa undangan pernikahan casual
http://www.jualbesibajamurah.com/harga-besi-profil-h-beam-kanal-h-baja-p... Pabrik besi h beam baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-sii-uli... Agen besi beton sii
http://www.undangancinta.com undangan pernikahan artis
http://www.sentrabesibaja.com/pipa-besi-hitam-medium-galvaniz/ Agen Pipa Besi Hitam Medium
http://ironsteelcenter.com/stainless-steel-ss-sus-304-210-316-310-301-st... Pabrik Stainless steel
http://www.jualbesibajamurah.com/harga-besi-profil-cnp-gording-kanal-c-b... Agen besi cnp baja
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-interwo... Toko besi beton interworld steel is
http://www.pusatbesibaja.co.id/harga-besi-profil-h-beam-kanal-h-baja-dis... Distributor besi h beam baja
http://www.pusatbesibaja.com/harga-besi-profil-h-beam-kanal-h-baja-toko-... Distributor besi h beam baja
http://bit.ly/1P41Awa undangan pernikahan contoh
http://www.jualbesibajamurah.com/harga-plat-besi-baja-hitam-produsen-sup... Distributor plat besi hitam
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-psi-uli... Agen besi beton psi Ulir Polos
http://www.undangancinta.com undangan pernikahan modern
http://www.sentrabesibaja.com/besi-baja-i-wf-profil/ Agen Besi Wf
http://ironsteelcenter.com/baja-ringan/harga-jual-baja-ringan-supplier-p... Distributor Baja Ringan
http://www.gudangbesibaja.com/harga-wiremesh-sni-jual-distributor-pabrik Distributor Wiremesh Besi
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-gunung-... Toko besi beton gunung garuda
http://www.pusatbesibaja.co.id/harga-besi-profil-h-beam-kanal-h-baja-dis... Harga besi h beam baja
http://www.pusatbesibaja.com/harga-besi-profil-h-beam-kanal-h-baja-toko-... Harga besi h beam baja
http://bit.ly/1P41Awa undangan pernikahan chinese
http://www.jualbesibajamurah.com/harga-plat-besi-baja-hitam-produsen-sup... Harga plat besi hitam
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-perwira... Agen besi beton perwira
http://www.undangancinta.com undangan pernikahan artis
http://www.sentrabesibaja.com/besi-baja-hbeam-profil/ Agen Besi H beam
http://ironsteelcenter.com/baja-ringan/harga-jual-baja-ringan-supplier-p... Supplier Baja Ringan
http://www.gudangbesibaja.com/harga-wiremesh-sni-jual-distributor-pabrik Harga Wiremesh Besi
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-delco-p... Toko besi beton delcoprima
http://www.pusatbesibaja.co.id/harga-besi-profil-h-beam-kanal-h-baja-dis... Jual besi h beam baja
http://www.pusatbesibaja.com/harga-besi-profil-h-beam-kanal-h-baja-toko-... Jual besi h beam baja
http://bit.ly/1P41Awa undangan pernikahan cantik
http://www.jualbesibajamurah.com/harga-plat-besi-baja-hitam-produsen-sup... Jual plat besi hitam
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-pas-uli... Agen besi beton PAS
https://goo.gl/XZ6zpY undangan pernikahan casual
http://www.sentrabesibaja.com/besi-beton-ulir-polos-sni/ Agen Besi Beton
http://ironsteelcenter.com/baja-ringan/harga-jual-baja-ringan-supplier-p... Agen Baja Ringan
http://www.gudangbesibaja.com/harga-wiremesh-sni-jual-distributor-pabrik Jual Wiremesh Besi
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-cakra-s... Toko besi beton cakra steel cs
http://www.pusatbesibaja.co.id/harga-besi-profil-h-beam-kanal-h-baja-dis... Supplier besi h beam baja
http://www.pusatbesibaja.com/harga-besi-profil-h-beam-kanal-h-baja-toko-... Supplier besi h beam baja
http://bit.ly/1P41Awa undangan pernikahan bunga
http://www.jualbesibajamurah.com/harga-plat-besi-baja-hitam-produsen-sup... Supplier plat besi hitam
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-master-... Agen besi beton master steel ms
https://goo.gl/XZ6zpY undangan pernikahan animasi
http://www.sentrabesibaja.com/ www.sentrabesibaja.com
http://ironsteelcenter.com/baja-ringan/harga-jual-baja-ringan-supplier-p... Toko Baja Ringan
http://www.gudangbesibaja.com/harga-wiremesh-sni-jual-distributor-pabrik Supplier Wiremesh Besi
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-bjku-ul... Toko besi beton bjku
http://www.pusatbesibaja.co.id/harga-besi-profil-h-beam-kanal-h-baja-dis... Toko besi h beam baja
http://www.pusatbesibaja.com/harga-besi-profil-h-beam-kanal-h-baja-toko-... Toko besi h beam baja
http://bit.ly/1P41Awa undangan pernikahan bentuk dompet
http://www.jualbesibajamurah.com/harga-plat-besi-baja-hitam-produsen-sup... Toko plat besi hitam
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-ksty-ul... Agen besi beton ksty
https://goo.gl/XZ6zpY undangan pernikahan murah
http://www.sentrabesibaja.com/welded-beam-castellated-beam-queen-king-cr... Toko Welded Beam T beam King Queen Cross Castellated Beam
http://ironsteelcenter.com/baja-ringan/harga-jual-baja-ringan-supplier-p... Jual Baja Ringan
http://www.gudangbesibaja.com/harga-wiremesh-sni-jual-distributor-pabrik Toko Wiremesh Besi
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-banci-u... Toko besi beton Sni Ulir Polos
http://www.pusatbesibaja.co.id/harga-besi-profil-h-beam-kanal-h-baja-dis... Agen besi h beam baja
http://www.pusatbesibaja.com/harga-besi-profil-h-beam-kanal-h-baja-toko-... Agen besi h beam baja
http://bit.ly/1P41Awa undangan pernikahan buatan sendiri
http://www.jualbesibajamurah.com/harga-plat-besi-baja-hitam-produsen-sup... Agen plat besi hitam
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-krakata... Agen besi beton krakatau steel
http://bit.ly/1P41Awa undangan pernikahan biru
http://www.sentrabesibaja.com/bondek-cor-sni/ Toko Bondek Cor
http://ironsteelcenter.com/baja-ringan/harga-jual-baja-ringan-supplier-p... Harga Baja Ringan
http://www.gudangbesibaja.com/harga-wiremesh-sni-jual-distributor-pabrik Agen Wiremesh Besi
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-ais-uli... Toko besi beton ais
http://www.pusatbesibaja.co.id/harga-besi-profil-h-beam-kanal-h-baja-dis... Pabrik besi h beam baja
http://www.pusatbesibaja.com/harga-besi-profil-h-beam-kanal-h-baja-toko-... Pabrik besi h beam baja
http://bit.ly/1P41Awa undangan pernikahan batik
http://www.jualbesibajamurah.com/harga-plat-besi-baja-hitam-produsen-sup... Pabrik plat besi hitam
http://www.jualbesibetonhargapabrikmurah.com/category/besi-beton-jcac-ul... Agen besi beton jcac
http://www.undangancinta.com undangan pernikahan arab
http://www.sentrabesibaja.com/atap-spandek/ Toko Atap Spandek Sni
http://ironsteelcenter.com/baja-ringan/harga-jual-baja-ringan-supplier-p... Pabrik Baja Ringan
http://www.gudangbesibaja.com/harga-wiremesh-sni-jual-distributor-pabrik Pabrik Wiremesh Besi
http://www.jualbesibetonhargapabrikmurah.com/ Toko besi beton
https://goo.gl/ncgJmF Jual Jaket Parka http://bit.ly/2lS1aOh Jual Jaket Parka
https://goo.gl/ncgJmF Jaket Parka http://bit.ly/2lS1aOh Jaket Parka
http://www.undangancinta.com undangan pernikahan kalender
http://www.undangancinta.com undangan pernikahan bahasa inggris islam
http://www.undangancinta.com undangan pernikahan islami
http://www.undangancinta.com undangan pernikahan unik dan murah
http://www.undangancinta.com undangan pernikahan modern
http://www.undangancinta.com undangan pernikahan online
http://www.undangancinta.com undangan pernikahan
http://www.undangancinta.com undangan pernikahan amplop surat
http://www.undangancinta.com undangan pernikahan simple
http://www.undangancinta.com undangan pernikahan murah
http://www.undangancinta.com undangan pernikahan unik
http://www.undangancinta.com undangan pernikahan artis
http://www.undangancinta.com undangan pernikahan modern
http://www.undangancinta.com undangan pernikahan artis
http://www.undangancinta.com undangan pernikahan arab
https://goo.gl/GaKHyC undangan pernikahan
http://bit.ly/1P41Awa undangan pernikahan

LINK 10

Add new comment

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.