A Distributed Network Risk Assessment Method Based on Attack Graph

2012 ◽  
Vol 241-244 ◽  
pp. 2335-2342
Author(s):  
Tian Chi Yang ◽  
Ming Fang ◽  
Qi Feng Shao
Keyword(s):  
Risk Assessment ◽  
Information Security ◽  
Graph Model ◽  
Assessment Method ◽  
Computing Power ◽  
Attack Graph ◽  
Risk Assessment Method ◽  
Key Points ◽  
Attack Path ◽  
Network Risk

Evaluating risk effectively selecting effective defence measures and defending information threats actively are the key points of resolving security problems of information system．Based on the actual requirements and status of risk assessment of information security，we integrate attack graph to apply it in studying risk assessment of information security．Firstly，focused on the uncertainty and complexity of risk assessment of information security，we integrate the technology of vulnerabilities associated with to apply it in studying risk assessment．On the other hand，since the attack path described by attack graph model is suited for the quantity data processing，and poor to the qualitative analyze，and risk is uncertain，the risk factors are quantized by the probability of attack path forming proposed in this dissertation so that the probability of atom attack are pre-treated，a risk assessment method based on attack graph model is proposed．The method Take full advantage of computing power of each host in the network, greatly shorten the attack graph generation time.

scholarly journals The integrated risk analysis and risk assessment method of information security

2014 ◽  
Vol 16 (3) ◽  
Author(s):  
Светлана Владимировна Казмирчук ◽  
Андрей Юрьевич Гололобов
Keyword(s):  
Risk Assessment ◽  
Information Security ◽  
Risk Analysis ◽  
Assessment Method ◽  
Risk Assessment Method ◽  
Integrated Risk ◽  
Integrated Risk Analysis

Genre-Based Approach to Assessing Information and Knowledge Security Risks

2014 ◽  
Vol 10 (2) ◽  
pp. 13-27 ◽  
Author(s):  
Ali Mohammad Padyab ◽  
Tero Päivärinta ◽  
Dan Harnesk
Keyword(s):  
Risk Assessment ◽  
Information Security ◽  
Assessment Method ◽  
Organizational Dynamics ◽  
Future Research ◽  
Security Risk ◽  
Security Risks ◽  
Risk Assessment Method ◽  
Information Security Risk ◽  
Security Risk Assessment

Contemporary methods for assessing information security risks have adopted mainly technical views on information and technology assets. Organizational dynamics of information management and knowledge sharing have gained less attention. This article outlines a new, genre-based, approach to information security risk assessment in order to orientate toward organization- and knowledge-centric identification and analysis of security risks. In order to operationalize the genre-based approach, we suggest the use of a genre-based analytical method for identifying organizational communication patterns through which organizational knowledge is shared. The genre-based method is then complemented with tasks and techniques from a textbook risk assessment method (OCTAVE Allegro). We discuss the initial experiences of three experienced information security professionals who tested the method. The article concludes with implications of the genre-based approach to analyzing information and knowledge security risks for future research and practice.

Cybersecurity risk assessment method of ICS based on attack-defense tree model

2021 ◽  
pp. 1-14
Author(s):  
Shuang Wang ◽  
Lei Ding ◽  
He Sui ◽  
Zhaojun Gu
Keyword(s):  
Risk Assessment ◽  
Control System ◽  
Assessment Method ◽  
Assessment Process ◽  
Industrial Control System ◽  
Tree Model ◽  
Industrial Control ◽  
Interval Probability ◽  
Risk Assessment Method ◽  
Attack Path

Cybersecurity risk assessment is an important means of effective response to network attacks on industrial control systems. However, cybersecurity risk assessment process is susceptible to subjective and objective effects. To solve this problem, this paper introduced cybersecurity risk assessment method based on fuzzy theory of Attack-Defense Tree model and probability cybersecurity risk assessment technology, and applied it to airport automatic fuel supply control system. Firstly, an Attack-Defense Tree model was established based on the potential cybersecurity threat of the system and deployed security equipment. Secondly, the interval probability of the attack path was calculated using the triangular fuzzy quantification of the interval probabilities of the attack leaf nodes and defensive leaf nodes. Next, the interval probability of the final path was defuzzified. Finally, the occurrence probability of each final attack path was obtained and a reference for the deployment of security equipment was provided. The main contributions of this paper are as follows: (1) considering the distribution of equipment in industrial control system, a new cybersecurity risk evaluation model of industrial control system is proposed. (2) The experimental results of this article are compared with other assessment technologies, and the trend is similar to that of other evaluation methods, which proves that the method was introduced in this paper is scientific. However, this method reduces the subjective impact of experts on cybersecurity risk assessment, and the assessment results are more objective and reasonable. (3) Applying this model to the airport oil supply automatic control system can comprehensively evaluate risk, solve the practical problems faced by the airport, and also provide an important basis for the cybersecurity protection scheme of the energy industry.

Sign in / Sign up

Export Citation Format

Share Document