Risk management is a process that includes several steps, from vulnerability analysis to the formulation of a risk mitigation plan that selects countermeasures to be adopted. With reference to an information infrastructure, we present a risk management strategy that considers a sequence of hierarchical models, each describing dependencies among infrastructure components. A dependency exists anytime a security-related attribute of a component depends upon the attributes of other components. We discuss how this notion supports the formal definition of risk mitigation plan and the evaluation of the infrastructure robustness. A hierarchical relation exists among models that are analyzed because each model increases the level of details of some components in a previous one. Since components and dependencies are modeled through a hypergraph, to increase the model detail level, some hypergraph nodes are replaced by more and more detailed hypergraphs. We show how critical information for the assessment can be automatically deduced from the hypergraph and define conditions that determine cases where a hierarchical decomposition simplifies the assessment. In these cases, the assessment has to analyze the hypergraph that replaces the component rather than applying again all the analyses to a more detailed, and hence larger, hypergraph. We also show how the proposed framework supports the definition of a risk mitigation plan and discuss some indicators of the overall infrastructure robustness. Lastly, the development of tools to support the assessment is discussed.

Hierarchical Model Based Risk Management of Critical Infrastructures

Assessing the risk posed by Advanced Cyber Threats (APTs) is challenging without understanding the methods and tactics adversaries use to attack an organisation. The MITRE ATT&CK provides information on the motivation, capabilities, interests and tactics, techniques and procedures (TTPs) used by threat actors. In this paper, we leverage these characteristics of threat actors to support informed cyber risk characterisation and assessment. In particular, we utilise the MITRE repository of known adversarial TTPs along with attack graphs to determine the attack probability as well as the likelihood of success of an attack. We further identify attack paths with the highest likelihood of success considering the techniques and procedures of a threat actor. The assessment is supported by a case study of a health care organisation to identify the level of risk against two adversary groups– Lazarus and menuPass.

https://zenodo.org/record/7043877/files/ahmed2022MITRE%20%281%29.pdf

MITRE ATT&CK-driven Cyber Risk Assessment

Risk based approach in scope of cybersecurity threats and requirements

A understanding of the nature of targeted cyber-attack processes is needed to defend against this kind of cyber threats. Generally, the models describing processes of targeted cyber attacks are called in the literature as cyber kill chains or rarely cyber-attacks life cycles. Despite the fact that cyber-attacks have random nature, almost no stochastic models of cyber kill chains bases on the theory of stochastic processes have been proposed so far. This work, attempting to fill this deficiency, proposes to start using Markov processes for modeling some cyber-attack kill chains. In this paper two example theoretical models of cycles of returning cyber-attacks are proposed which have been generally named as the models of cyber kill chains with iterations. Presented models are based on homogeneous continuous time Markov chains.

Markov Models of Cyber Kill Chains with Iterations

The domain of nurse scheduling is a well-researched one. Researchers have been focusing mainly to increase the efficiency of nurses’ allocation while maintaining the nurse satisfaction at an acceptable level. However, most of the existing works focus on optimizing the utilization of nursing staff. In the age of IoT, as more and more researches are carried on in the domain of assisted living, it becomes more important to use NSP for maximizing patient recovery. In our bid to understand the challenging issues of adapting the convention solutions in the assisted living scenario, a thorough state-of-the-art study has been done. This study led us to note the following issues that need to be addressed: – Nurse scheduling solutions mainly aim at assigning the nurses so as to maximize the utilization of available nurses. The solutions mostly lacked consideration for the perspective of patients, viz, their preferences and types of ailments. – Matching nurses’ expertise to patients’ requirements, as well as patients’ preferences with respect to nurse availability is an issue that needs to be better investigated. – The problem of increased size of search space regarding increasing number of patients’ requirements need to be focused in more specific way. The problem is defined as the assignment of a set of available nurses N to a set of patients P, depending on a number of criteria. The identification of parameters and the definition of constraints (soft and hard) is to be considered in such a way so as to maximize patient satisfaction. The cost function also needs to be formulated in terms of these parameters and the goal is to keep the cost at an optimum level. In this talk, the focus will be on discussing some of the relevant techniques used for solving the nurse scheduling problem, including a novel solution specifically aimed to increase patient satisfaction. Adaptive and Reliable Decision Making for Multi-modal Biometric Systems

/pdf/computer-information-systems-and-industrial-management-45px71eybx.pdf

Computer Information Systems and Industrial Management

Risk is an inherent part of the functioning of every organization therefore the risk management should be a natural activity at each level of management. A common mistake in the management process of an organization is separating the security system, including the risk management system, and treating it as an isolated element. The article presents the place and role of the risk management system in the context of safety of the IT resource of an organization. A model of the risk management system was developed as the basic element of the organization management system and function supporting the continued operation in terms of IT safety of modern organizations.

/pdf/risk-management-system-as-the-basic-paradigm-of-the-51dqwiolnw.pdf

Risk management system as the basic paradigm of the information security management system in an organization

The article discusses the problem of risk management in the context of safety of an organization's information assets. Assuming system of information risk management as a basic element of organization management in the aspect of information safety of modern organizations, this document focuses on methods and techniques of qualitative risk estimates. Basic standards and good practice from areas of risk management and ensuring information safety in the organization were recalled.

/pdf/evaluation-of-information-safety-as-an-element-of-improving-16ufqs87ro.pdf

Evaluation of information safety as an element of improving the organization’s safety management

/pdf/metoda-dynamiki-systemowej-w-modelowaniu-zlozonych-systemow-1qbvwrhaxn.pdf

Romuald Hoffmann

Papers

Risk management system as the basic paradigm of the information security management system in an organization

Evaluation of information safety as an element of improving the organization’s safety management

Risk based approach in scope of cybersecurity threats and requirements

Markov Models of Cyber Kill Chains with Iterations

Metoda dynamiki systemowej w modelowaniu złożonych systemów i procesów