This paper describes the Cyber Security Game (CSG). Cyber Security Game is a method that has been implemented in software that quantitatively identifies cyber security risks and uses this metric to determine the optimal employment of security methods for any given investment level. Cyber Security Game maximizes a system’s ability to operate in today’s contested cyber environment by minimizing its mission risk. The risk score is calculated by using a mission impact model to compute the consequences of cyber incidents and combining that with the likelihood that attacks will succeed. The likelihood of attacks succeeding is computed by applying a threat model to a system topology model and defender model. Cyber Security Game takes into account the widespread interconnectedness of cyber systems, where defenders must defend all multi-step attack paths and an attacker only needs one to succeed. It employs a game theoretic solution using a game formulation that identifies defense strategies to minimize the maximum cyber risk (MiniMax). This paper discusses the methods and models that compose Cyber Security Game . A limited example of a Point of Sale system is used to provide specific demonstrations of Cyber Security Game models and analyses.
MusmanS.Assessing prescriptive improvements to a system’s cyber security and resilience. In: Proceedings of 2016 IEEE System Conference, Orlando Fl, 18–21 April 2016, pp.952–958. Piscataway, NJ: IEEE Conference Publications.
2.
MusmanSTeminA.A cyber mission impact assessment tool. In: Proceedings of 2016 IEEE System Conference, Orlando Fl, 18–21 April 2016, pp.952–958. Piscataway, NJ: IEE Conference Publications.
United States Senate Committee on Commerce, Science, and Transportation. A “kill chain” analysis of the 2013 target data breach. Washington, DC: United States Senate, 2014.
6.
National Bureau of Standards. Guideline for automatic data processing risk analysis. National Bureau of Standards, 1979.
7.
Soo HooK. How much is enough? A risk management approach to computer security. In: Workshop on the economics of information security, Stanford, CA, 2000.
8.
BuckshawDLParnellGSUnkenholzWLet al. Mission Oriented Risk and Design Analysis of Critical Information Systems. Mil Op Res2005; 2: 19–38.
9.
National Research Council, Department of Homeland Security. Bioterrorism risk assessment: A call for change. Washington, DC: National Academies Press, 2008.
10.
MerrickJParnellGSA comparative analysis of PRA and intelligent adversary methods for counterterrorism risk management. Risk Analysis2011; 31(9): 1488–1510. DOI: 10.1111/j.1539-6924.2011.01590.x.
11.
AndersonR.Why information security is hard-an economic perspective. In: Proceedings of the 17th Annual Computer Security Applications Conference (ACSAC ’01), Sheraton New Orleans Louisiana, USA, 10–14 December 2001, pp. 358–365. Washington, DC, USA: IEEE Computer Society.
12.
AyyubBMMcGillWLKaminskiyM.Critical asset and portfolio risk analysis: An all-hazards framework. Risk Analysis2007; 27: 789–801.
de Barros BarretoACostaPCGYanoET. A semantic approach to evaluate the impact of. In: Proceedings of the 7th international conference on semantic technologies for intelligence, defense, and security (STIDS 2012), Fairfax, VA, USA, 23–26 October 2012. http://ceur-ws.org/Vol-966/.
23.
WattersJMorrisseySBodeauDet al. The risk-to-mission assessment process (riskmap): A sensitivity analysis and an extension to treat confidentiality issues. Institute for Information Infrastructure. McLean, VA: The MITRE Corporation, 2009.
24.
TeminAMusmanS.A language for capturing cyber impact effects. MITRE Technical Report MTR-10344. Washington DC: MITRE Corporation, 2010.
25.
SommestadTNordströmL.Modeling security of power communication systems using defense graphs and influence diagrams. 2009; 24. Piscataway, NJ: IEEE
26.
GarveyPRPatelSH. Analytical frameworks to assess the effectiveness and economic-returns of cybersecurity investments. In: Military communications conference (MILCOM), 2014 IEEE, Baltimore, MD, 2014. Piscataway, New Jersey: IEEE Conference Publications.
27.
MusmanSTannerMTeminAet al. Computing the impact of cyber attacks on missions. In: 2011 IEEE international systems conference (SysCon), Montreal, QC, 2011. Piscataway, NJ: IEEE Conference Publications.
28.
NoelSLudwigJJainPet al., Analyzing Mission Impacts of Cyber Actions (AMICA). In: KottAlexander (ed.) Workshop proceedings, Istanbul, Turkey, June 2015, pp.80–86. Adelphi, MD: US Army Research Laboratory.
29.
MusmanSTeminATannerMet al. Evaluating the impact of cyber attacks on missions. In: Proceedings of the 5th International Conference on Information Warfare and Security, Dayton, OH, US, 8–9 April 2010. Reading: Academic Publishing Limited.
30.
CarinLCybenkoGHughesJ.Cybersecurity strategies: The QuERIES methodology. Computer2008; 41: 20–26.
31.
LingyuWJajodiaSSinghalAet al. k-zero day safety: Measuring the security risk of networks against unknown attacks. In: IEEE transactions on dependable and secure computing, 11 June 2013, pp.30–44. Piscataway, New Jersey: IEEE.
32.
RoySEllisCShivaSet al. A survey of game theory as applied to network security. In: 43rd Hawaii international conference on system sciences (HICSS), Koloa, 5–8 January 2010, Piscataway, NJ: IEEE Conference Publication.
33.
AlpcanTBasarT. A game theoretic approach to decision and analysis in network intrusion detection. In: 42nd IEEE international conference on decision and control (IEEE Cat. No.03CH37475), Maui, Hi9–12 December 2003, Vol. 3, pp.2595–2600. IEEE Conference Publications. http://ieeexplore.ieee.org/document/1273013/.
34.
NguyenKAlpcanTBasarT. Stochastic games for security in networks with interdependent nodes. In: International conference on game theory for networks, Istanbul, Turkey, 13–15 May 2009. Piscataway, NJ: IEEE Conference Publications.
35.
JormakkaJJolsaJ.Modelling information warfare as a game. J Inf Warfare2005; 4: 12–25.
36.
SallhammarKKnapskogS. Using game theory in stochastic models for quantifying security. In: Proceedings of Nordsec 2004, Espoo, Finland, 4–5 November 2004.
37.
CavusogluHRaghunathanSYueWT.Decision-theoretic and game-theoretic approaches to IT security investment: Impact of information systems on market structure and function: Developing and testing theories. Journal of Management Information SystemsFall, 2008; 25(2): 281–304.
38.
KunreutherHHealG.Interdependent security. Journal of Risk and Uncertainty2003; 26: 231–249. DOI: 10.1023/A:1024119208153.
39.
GordonLLoebM.The economics of investment in information security. Journal ACM Transactions on Information and System Security (TISSEC)November2002; 5(4): 438–457.
40.
Bang-JensenJGutinGYeoA.When the greedy algorithm fails. Discrete Optimization2014; 1(2): 121–127.
41.
MusmanSTannerMElsaesserEet al. A systems engineering approach to crown jewels estimation and mission assurance decision making. In: Proceedings of the IEEE symposium on computational intelligence in cyber security, Paris, France, 11–15 April 2011. IEEE Conference Publications. http://ieeexplore.ieee.org/document/5949403/.
42.
HulthenR. Communicating the economic value of security investments; value at security Risl. In: WEIS 2008 – Seventh workshop on economics of information security, Hanover, N.H., 2008.
43.
FreundJJonesJ. Measuring and managing information risk: A FAIR approach. Oxford: Butterworth-Heinemann.
44.
MusmanSMusmanS. Using cyber impacts to assess cyber risk mitigation on point of sale systems using CMIA and CMIA. MITRE Technical Report, MTR160339, 2016.
45.
MusmanSMusmanS . Applying the cyber security game to a point of sale system. In: MadniAMBoehmB (eds) Proceedings of the 15th annual conference on systems engineering research disciplinary convergence: Implications for systems engineering research, Redondo Beach, CA, 23–25 March 2017.
46.
OlsonDLMoshkovichHMSchellenbergerRMechitovAI.Consistency and accuracy in decision aids: Experiments with four multiattribute systems. Decision Sciences1995; 26(6): 723–747.
