The cyber security modeling language (CySeMoL) is a modeling language for enterprise-level system architectures coupled to a probabilistic inference engine. If the computer systems of an enterprise are modeled with CySeMoL, this inference engine can assess the probability that attacks on the systems will succeed. The theory used for the attack-probability calculations in CySeMoL is a compilation of research results on a number of security domains and covers a range of attacks and countermeasures. The theory has previously been validated on a component level. In this paper, the theory is also validated on a system level. A test indicates that the reasonableness and correctness of CySeMoL assessments compare with the reasonableness and correctness of the assessments of a security professional. CySeMoL's utility has been tested in case studies.

/pdf/the-cyber-security-modeling-language-a-tool-for-assessing-2c6rppfc2r.pdf

The Cyber Security Modeling Language: A Tool for Assessing the Vulnerability of Enterprise System Architectures

The strategic importance of knowledge in today’s organisation has been discussed extensively and research has looked at various issues in developing knowledge management systems. Both the characterisation of knowledge and alternate models for understanding the acquisition and use of such knowledge have taken on significant prominence. This is due to the complexities associated with acquiring and representing knowledge, and the varied nature of its use in knowledge work. However, the role of the knowledge workers and the processes that guide their knowledge work as they meet the knowledge goals of an organisation have received little attention. This paper proposes a knowledge audit (an assessment of the way knowledge processes meet an organisation’s knowledge goals) methodology to understand the “gaps” in the needs of a knowledge worker before one develops KM systems. The methodology also uses “process change” research to help build a socio-technical environment critical for knowledge work. The audit methodology is applied to a particular case and the implementation of the audit recommendations is discussed. Future implications of such an audit are also discussed.

/pdf/knowledge-management-audit-a-methodology-and-case-study-4h6g7np56l.pdf

Knowledge Management Audit - a methodology and case study

Human experts employed in validation exercises for knowledge-based systems (KBSs) often have limited time and availability. Furthermore, they often have different opinions from each other as well as from themselves over time. We address this situation by introducing the use of validation knowledge used in prior validation exercises for the same KBS. We present a validation knowledge base (VKB) that is the collective best experience of several human experts. The VKB is constructed and maintained across various validation exercises, and its primary benefits are given as follows: 1) more reliable validation results by incorporating external knowledge and 2) decrease of the experts' workload. We also present the concept of validation expert software agents (VESAs), which represent a particular expert's knowledge. VESA is a software agent corresponding to a specific human expert. It models the validation knowledge and behavior of its human counterpart by analyzing similarities with the responses of other experts. After a learning period, it can be used to temporarily substitute for its corresponding human expert. We also describe experiments with a small prototype system to evaluate the usefulness of these concepts

Toward Reducing Human Involvement in Validation of Knowledge-Based Systems

Information technology (IT) is critical and valuable to our society An important type of IT system is Supervisor Control And Data Acquisition (SCADA) systems These systems are used to control and 

/pdf/a-framework-and-theory-for-cyber-security-assessments-149jg1sfw7.pdf

A framework and theory for cyber security assessments

A decision support system has been under development since 1985 to help speech clinicians diagnose small children who have begun to stutter This paper describes how testing of the system evolved during these nine years Testing included: 1) having an expert use and evaluate it, 2) running test cases, 3) developing a program to detect redundant rules, 4) using the analytic hierarchy process, 5) running a program that checks a knowledge base for consistency and completeness, 6) having five experts independently critique the system, 7) obtaining diagnoses of stuttering from these five experts derived from reports of children who had been evaluated for possible stuttering problems, 8) using the system to expose missing and ambiguous information in 30 clinical reports, and 9) analyzing the dispersion and bias of six experts and the decision support system in diagnosing stuttering When using the final system, three clinicians with widely differing backgrounds produced diagnostic opinions that evidence little variability and were indistinguishable from those of a panel of five experienced clinicians

How the testing techniques for a decision support system changed over eight years

The proliferation of computer-based information systems makes an organization's operations exceedingly vulnerable to several types of risks, including loss of data, unauthorized use of data, errors in recording data, and loss of assets or property. Exposure to such risks is typically mitigated through the institution of internal controls. Since systems designers are often not cognizant of control design strategies, the participation of an auditor has been recommended. To avoid potential auditor independence problems caused by the same set of auditors participating both in the design and evaluation of control strategies, a knowledge-based system for control design has been developed. Ten practicing internal auditors participated in the validation of the knowledge-based system using a variation of the Turing test. This paper reports on the validation procedures: results indicate that the knowledge-based support system can perform at a level comparable to that of internal auditors for the purchasing cycle in business organizations, thereby helping alleviate the auditor independence problem.

Ramu Kannan

Papers

Formal validation of a knowledge-based system using a variation of the Turing test