Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Game-Theoretic Approach for Security Control Selection

Dylan Léveillé, Jason Jaskolka

TL;DR

A game-theoretic approach for selecting effective combinations of security controls based on expected attacker profiles and a set budget is proposed and valid control combinations for selection are generated using an algebraic formalism to account for dependencies among selected controls.

Abstract

Selecting the combination of security controls that will most effectively protect a system's assets is a difficult task. If the wrong controls are selected, the system may be left vulnerable to cyber-attacks that can impact the confidentiality, integrity and availability of critical data and services. In practical settings, it is not possible to select and implement every control possible. Instead considerations, such as budget, effectiveness, and dependencies among various controls, must be considered to choose a combination of security controls that best achieve a set of system security objectives. In this paper, we propose a game-theoretic approach for selecting effective combinations of security controls based on expected attacker profiles and a set budget. The control selection problem is set up as a two-person zero-sum one-shot game. Valid control combinations for selection are generated using an algebraic formalism to account for dependencies among selected controls. We demonstrate the proposed approach on an illustrative financial system used in government departments under four different scenarios. The results illustrate how a security analyst can use the proposed approach to guide and support decision-making in the control selection activity when developing secure systems.

A Game-Theoretic Approach for Security Control Selection

TL;DR

A game-theoretic approach for selecting effective combinations of security controls based on expected attacker profiles and a set budget is proposed and valid control combinations for selection are generated using an algebraic formalism to account for dependencies among selected controls.

Abstract

Selecting the combination of security controls that will most effectively protect a system's assets is a difficult task. If the wrong controls are selected, the system may be left vulnerable to cyber-attacks that can impact the confidentiality, integrity and availability of critical data and services. In practical settings, it is not possible to select and implement every control possible. Instead considerations, such as budget, effectiveness, and dependencies among various controls, must be considered to choose a combination of security controls that best achieve a set of system security objectives. In this paper, we propose a game-theoretic approach for selecting effective combinations of security controls based on expected attacker profiles and a set budget. The control selection problem is set up as a two-person zero-sum one-shot game. Valid control combinations for selection are generated using an algebraic formalism to account for dependencies among selected controls. We demonstrate the proposed approach on an illustrative financial system used in government departments under four different scenarios. The results illustrate how a security analyst can use the proposed approach to guide and support decision-making in the control selection activity when developing secure systems.

Paper Structure

This paper contains 18 sections, 5 equations, 3 figures, 8 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. The Proposed Approach
  4. Identify Applicable Atomic Controls
  5. Assign Effectiveness to Atomic Controls
  6. Assign Cost to Atomic Controls
  7. Specify and Generate Valid Control Combinations
  8. Construct the Game Matrix
  9. Play the Game
  10. Illustrative Example
  11. Identify Applicable Atomic Controls
  12. Assign Effectiveness to Atomic Controls
  13. Assign Cost to Atomic Controls
  14. Specify and Generate Valid Control Combinations
  15. Construct the Game Matrix
  16. ...and 3 more sections

Figures (3)

  • Figure 1: An overview of the proposed game-theoretic approach for security control selection
  • Figure 2: Finding the suggested controls for an attacker profile with multiple ordered attacker objectives
  • Figure 3: An overview of the Firebird system architecture

Theorems & Definitions (5)

  • Definition 1: Security Control Algebra
  • Definition 2: Requirement Relation Hofner2011
  • Definition 3: Cost of a Proper Security Control Combination
  • Definition 4: Budget Rule
  • Definition 5: Effectiveness of a Proper Security Control Combination