Skip to main content
SpringerLink
Log in

Quantitative Information Security Risk Estimation Using Probabilistic Attack Graphs

  • Conference paper
  • First Online:
Risk Assessment and Risk-Driven Quality Assurance (RISK 2016)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 10224))

Included in the following conference series:

Abstract

This paper proposes an approach, called pwnPr3d, for quantitatively estimating information security risk in ICT systems. Unlike many other risk analysis approaches that rely heavily on manual work and security expertise, this approach comes with built-in security risk analysis capabilities. pwnPr3d combines a network architecture modeling language and a probabilistic inference engine to automatically generate an attack graph, making it possible to identify threats along with the likelihood of these threats exploiting a vulnerability. After defining the value of information assets to their organization with regards to confidentiality, integrity and availability breaches, pwnPr3d allows users to automatically quantify information security risk over time, depending on the possible progression of the attacker. As a result, pwnPr3d provides stakeholders in organizations with a holistic approach that both allows high-level overview and technical details.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    http://www.cnn.com/2016/02/03/politics/cyberattack-ukraine-power-grid/.

  2. 2.

    http://money.cnn.com/2012/09/27/technology/bank-cyberattacks/.

  3. 3.

    Pwn is originally a misspelling of the word own, in information security signifying the compromise of a computer system.

References

  1. Alberts, C.J., Dorofee, A.: Managing Information Security Risks: The OCTAVE Approach. Addison-Wesley Longman Publishing Co., Inc. (2002)

    Google Scholar 

  2. Armin, J., Thompson, B., Ariu, D., Giacinto, G., Roli, F., Kijewski, P.: 2020 cybercrime economic costs: No measure no solution. In 10th International Conference on Availability, Reliability and Security (ARES), pp. 701–710. IEEE (2015)

    Google Scholar 

  3. Cherkassky, B.V., Goldberg, A.V., Radzik, T.: Shortest paths algorithms: theory and experimental evaluation. Math. Program. 73(2), 129–174 (1996)

    Article  MathSciNet  MATH  Google Scholar 

  4. Chu, M., Ingols, K., Lippmann, R., Webster, S., Boyer, S.: Visualizing attack graphs, reachability, and trust relationships with navigator. In: Proceedings of the 7th International Symposium on Visualization for Cyber Security, pp. 22–33. ACM (2010)

    Google Scholar 

  5. European Commission. Towards a general policy on the fight against cyber crime (2007). http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52007DC0267. Accessed 5 March 2017

  6. Cooper, D.: The australian and new zealand standard on risk management, as/nzs 4360: 2004. Tutorial Notes: Broadleaf Capital International Pty Ltd, pp. 128–151 (2004)

    Google Scholar 

  7. ECB. Recommendations for the security of internet payments (2015). https://www.ecb.europa.eu/pub/pdf/other/recommendationssecurityinternetpaymentsoutcomeofpcfinalversionafterpc201301en.pdf, Accessed 5 March 2017

  8. FFIEC. Supplement to authentication in an internet banking environment (2011). https://www.fdic.gov/news/news/financial/2011/fil11050.pdf. Accessed 5 March 2017

  9. W. E. Forum. Industry agenda. partnering for cyber resilience - towards the quantification of cyber threats, January 2015. http://www3.weforum.org/docs/WEFUSA_QuantificationofCyberThreats_Report2015.pdf. Accessed 5 March 2017

  10. Frigault, M., Wang, L., Singhal, A., Jajodia, S.: Measuring network security using dynamic Bayesian network. In: Proceedings of the 4th ACM Workshop on Quality of Protection, pp. 23–30. ACM (2008)

    Google Scholar 

  11. Goodyear, M., Goerdel, H.T., Portillo, S., Williams, L.: Cybersecurity management in the states: The emerging role of chief information security officers. Available at SSRN 2187412 (2010)

    Google Scholar 

  12. Holm, H.: A large-scale study of the time required to compromise a computer system. IEEE Trans. Dependable Secure Comput. 11(1), 2–15 (2014)

    Article  Google Scholar 

  13. Holm, H., Shahzad, K., Buschle, M., Ekstedt. M.: P cysemol: predictive, probabilistic cyber security modeling language. IEEE Trans. Dependable Secure Comput. 12(6), 626–639 (2015)

    Google Scholar 

  14. Homer, J., Zhang, S., Ou, X., Schmidt, D., Du, Y., Rajagopalan, S.R., Singhal, A.: Aggregating vulnerability metrics in enterprise networks using attack graphs. J. Comput. Secur. 21(4), 561–597 (2013)

    Article  Google Scholar 

  15. Hoo, K.J.S.: How much is enough? A risk management approach to computer security. Stanford University Stanford, Calif (2000)

    Google Scholar 

  16. Howard, M., LeBlanc, D.: Writing secure code, 2nd edn. (2002)

    Google Scholar 

  17. E. ISO. Iec 27005: 2011 (en) information technology-security techniques-information security risk management switzerland. ISO/IEC (2011)

    Google Scholar 

  18. Johnson, P., Vernotte, A., Ekstedt, M., Lagerström, R.: pwnpr3d: an attack-graph-driven probabilistic threat-modeling approach. In: 11th International Conference on Availability, Reliability and Security (ARES). IEEE (2016)

    Google Scholar 

  19. Jonsson, E., Olovsson, T.: A quantitative model of the security intrusion process based on attacker behavior. IEEE Trans. Softw. Eng. 23(4), 235–245 (1997)

    Article  Google Scholar 

  20. Kaspersky. The great bank robbery: Carbanak cybergang steals $1bn from 100 financial institutions worldwide (2015). http://usa.kaspersky.com/about-us/press-center/press-releases/2015/great-bank-robbery-carbanak-cybergang-steals-1-billion-100-fina. Accessed 5 March 2017

  21. Lund, M.S., Solhaug, B., Stølen, K.: Model-Driven Risk Analysis: The CORAS Approach. Springer Science & Business Media, Heidelberg (2010)

    MATH  Google Scholar 

  22. Meta object facility (MOF) 2.5 core specification (2015). http://www.omg.org/spec/MOF/2.5/

  23. S. NIST. 800–30. Risk management guide for information technology systems, pp. 800–30 (2002)

    Google Scholar 

  24. Noel, S., Elder, M., Jajodia, S., Kalapa, P., O’Hare, S., Prole, K.: Advances in topological vulnerability analysis. In: Conference For Homeland Security, CATCH 2009. Cybersecurity Applications Technology, pp. 124–129, March 2009

    Google Scholar 

  25. Noel, S., Jajodia, S., Wang, L., Singhal, A.: Measuring security risk of networks using attack graphs. Int. J. Next Gener. Comput. 1(1), 135–147 (2010)

    Google Scholar 

  26. Nyanchama, M.: Enterprise vulnerability management and its role in information security management. Inform. Syst. Secur. 14(3), 29–56 (2005)

    Article  Google Scholar 

  27. Ponemon Institute. Cost of cyber crime report (2013)

    Google Scholar 

  28. Poolsappasit, N., Dewri, R., Ray, I.: Dynamic security risk management using Bayesian attack graphs. IEEE Trans. Dependable Secure Comput. 9(1), 61–74 (2012)

    Article  Google Scholar 

  29. Soomro, Z.A., Shah, M.H., Ahmed, J.: Information security management needs more holistic approach: a literature review. Int. J. Inf. Manage. 36(2), 215–225 (2016)

    Article  Google Scholar 

  30. Verizon. Data breach investigations report (2014)

    Google Scholar 

  31. Xie, P., Li, J.H., Ou, X., Liu, P., Levy, R.: Using Bayesian networks for cyber security analysis. In: 2010 IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 211–220. IEEE (2010)

    Google Scholar 

Download references

Acknowledgments

The work presented in this paper has received funding from the European Unions Seventh Framework Programme for research, technological development and demonstration under grant agreement no. 607109 as well as the Swedish Civil Contingencies Agency (MSB) through the research centre on Resilient Information and Control Systems (RICS).

Author information

Authors and Affiliations

  1. KTH Royal Institute of Technology, Stockholm, Sweden

    Pontus Johnson, Alexandre Vernotte, Mathias Ekstedt & Robert Lagerström

  2. Foreseeti AB, Stockholm, Sweden

    Dan Gorton

Authors
  1. Pontus Johnson
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Alexandre Vernotte
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Dan Gorton
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Mathias Ekstedt
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Robert Lagerström
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Alexandre Vernotte .

Editor information

Editors and Affiliations

  1. Fraunhofer FOKUS CC SQC, Berlin, Germany

    Jürgen Großmann

  2. Department of Computer Science, Universität Innsbruck, Innsbruck, Austria

    Michael Felderer

  3. SINTEF ICT, Oslo, Norway

    Fredrik Seehusen

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Cite this paper

Johnson, P., Vernotte, A., Gorton, D., Ekstedt, M., Lagerström, R. (2017). Quantitative Information Security Risk Estimation Using Probabilistic Attack Graphs. In: Großmann, J., Felderer, M., Seehusen, F. (eds) Risk Assessment and Risk-Driven Quality Assurance. RISK 2016. Lecture Notes in Computer Science(), vol 10224. Springer, Cham. https://doi.org/10.1007/978-3-319-57858-3_4

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-57858-3_4

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-57857-6

  • Online ISBN: 978-3-319-57858-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation