Efficiently computing the likelihoods of cyclically interdependent risk scenarios

详细信息    查看全文

• 作者：Steve Muller^a ; ^b ; ^c ; ^{steve.muller@itrust.lu" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Carlo Harpes^a ; ^{harpes@itrust.lu" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Yves Le Traon^b ; ^{yves.letraon@uni.lu" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Sylvain Gombault^c ; ^{sylvain.gombault@telecom-bretagne.eu" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Jean-Marie Bonnin^c ; ^{jm.bonnin@telecom-bretagne.eu" class="auth_mail" title="E-mail the corresponding author}Author Vitae
• 关键词：Cyclic dependencies ; Cyclic causal graphs ; Risk analysis ; Risk assessment ; Quantitative assessment ; Dependency graph
• 刊名：Computers & Security
• 出版年：2017
• 出版时间：January 2017
• 年：2017
• 卷：64
• 期：Complete
• 页码：59-68
• 全文大小：1147 K

文摘

Quantitative risk assessment provides a holistic view of risk in an organisation, which is, however, often biased by the fact that risk shared by several assets is encoded multiple times in a risk analysis. An apparent solution to this issue is to take all dependencies between assets into consideration when building a risk model. However, existing approaches rarely support cyclic dependencies, although assets that mutually rely on each other are encountered in many organisations, notably in critical infrastructures. To the best of our knowledge, no author has provided a provably efficient algorithm (in terms of the execution time) for computing the risk in such an organisation, notwithstanding that some heuristics exist.

This paper introduces the dependency-aware root cause (DARC) model, which is able to compute the risk resulting from a collection of root causes using a poly-time randomised algorithm, and concludes with a discussion on real-time risk monitoring, which DARC supports by design.