MultiAttribute Risk Assessment

1
Multi-Attribute Risk Assessment

• Shawn A. Butler
• Computer Science Department
• Carnegie Mellon University
• 16 October 2002

2
Advantages of Multi-Attribute Risk Assessments

• Provides a systematic and repeatable method for
  evaluating risks
• Helps organizations identify and prioritize
  security requirements
• Makes explicit expectations about attack
  consequences
• Provides insights into the affect of uncertainty

3
Some Terminology

• Threats - events, which could lead to an
  information system compromise.
• (Examples denial of service attacks, procedural
  violations, IP spoofing, etc.)
• Attacks -An attack (a) is an instance of a threat
  that results in an information system compromise.
  that has an outcome (Oa)
• Outcome - one or more consequences (Xj).
• Consequence Damage (xj)from a successful attack
• (Examples lost productivity, lost revenue,
  damaged public image, lost lives)

4
(Threat) Denial of Service
(Outcomes) X1 X2 X3 Lost
Productivity Lost Revenue Damaged
Public Image
Attacks (Consequence Values (x 1, x2, x 3)
a1 3 hours 0 none a2 40
hours 20,000 moderate a3 10 hours
500 slight
Outcome
5
Security Architecture Development Process
Security Architecture Development Process
System Design
Available Countermeasures
Security Components
Select Countermeasures
Develop Security Architecture
Requirements
Policies
6
Multi-attribute Risk Assessment Process
Expected Frequency of Attack
Outcomes
S.M. Best Est.
Risks Prioritized
Org Threats
Threats
Most Likely Outcomes
Security Manager Questions
Additive Model
7
The Additive Model
TIa Freqa (?jattributeswj vj(xaj ))

• Check additivity assumptions to see if the
  additive form is valid
• Assess the single-attribute value functions v1,
  v2, , vn
• Assess the weighting factors w1, w2, , wn
• Compute the value of each alternative and rank
  alternatives
• Conduct sensitivity analysis to see how sensitive
  the ranking is to model assumptions

8
Independence Assumptions
Tradeoffs between two consequence values
holding all other consequence values fixed do
not depend on where we hold the other attributes
fixed
9
Assess Single Consequence Value Function
vj(xaj )
1
1
1
0
0
0
xj
xj
xj
Linear
Concave
Convex
10
Weight the Consequences
wj
11
(No Transcript)
12
Compute Value and Rank Alternatives
13
Developing Requirements
14
Threat Indexes as a Percentage of Total Threat
Index
15
(No Transcript)
16
Case Study Results
17
Conclusions

• Multi-attribute Risk Assessments provide insight
  during risk assessment process
• Multi-attribute Risk Assessments can help
  security managers prioritize risks, which leads
  to prioritized requirements
• Inexperienced security managers will be able to
  benefit from information collected from other
  organizations