Security Assessment and Management in Cyber‐Risk
Mehmet Şahinoglu · 2016
Quantitative risk measurements are absolutely needed to compare design alternatives and calculate monetary outcomes for mitigating risk. There are very few, if any, quantitative measures in academia or corporate world, other than high, medium, or low classifications. Along with the purely quantitative security meter model as the data allow, we consider a security meter model for qualitative attributes. Prioritization of software maintenance is also achieved by ranking the vulnerabilities through a Bayesian analysis. Further, the imperfections such as the nondisjointness of the vulnerabilities and the threats are treated using laws of probability. The model proposed is practical and simple to use for beginners in the field, but it also provides a math–statistical foundation for risk valuation. The probabilistic assumptions for the Monte Carlo simulation revolve around using a simple uniformly distributed random variable for the input variables by assigning an upper and a lower bound. Further, the triple-product rule math will theoretically verify the SM machinery. Last but not least, game-theoretic risk optimization and mitigation will be implemented to certain multitheme practices selected. These models will be supported by a fine-tuned practical software package, CyberRiskSolver, for computational ease and time-saving convenience to learn faster.