Abstract
In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.
| Originalsprache | englisch |
|---|---|
| Titel | Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings |
| Redakteure/-innen | Alastair Walker, Rory V. O’Connor, Richard Messnarz |
| Herausgeber (Verlag) | Springer Verlag |
| Seiten | 45-56 |
| Seitenumfang | 12 |
| ISBN (Print) | 9783030280048 |
| DOIs | |
| Publikationsstatus | Veröffentlicht - 1 Jan 2019 |
| Veranstaltung | 26th European Conference on Systems, Software and Services Process Improvement, EuroSPI 2019 - Edinburgh, Großbritannien / Vereinigtes Königreich Dauer: 18 Sep 2019 → 20 Sep 2019 |
Publikationsreihe
| Name | Communications in Computer and Information Science |
|---|---|
| Band | 1060 |
| ISSN (Print) | 1865-0929 |
| ISSN (elektronisch) | 1865-0937 |
Konferenz
| Konferenz | 26th European Conference on Systems, Software and Services Process Improvement, EuroSPI 2019 |
|---|---|
| Land | Großbritannien / Vereinigtes Königreich |
| Ort | Edinburgh |
| Zeitraum | 18/09/19 → 20/09/19 |
Fingerprint
Schlagwörter
ASJC Scopus subject areas
- !!Computer Science(all)
- !!Mathematics(all)
Dies zitieren
RISKEE : A Risk-Tree Based Method for Assessing Risk in Cyber Security. / Krisper, Michael; Dobaj, Jürgen; Macher, Georg; Schmittner, Christoph.
Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings. Hrsg. / Alastair Walker; Rory V. O’Connor; Richard Messnarz. Springer Verlag, 2019. S. 45-56 (Communications in Computer and Information Science; Band 1060).Publikation: Beitrag in Buch/Bericht/Konferenzband › Beitrag in einem Konferenzband › Forschung › Begutachtung
}
TY - GEN
T1 - RISKEE
T2 - A Risk-Tree Based Method for Assessing Risk in Cyber Security
AU - Krisper, Michael
AU - Dobaj, Jürgen
AU - Macher, Georg
AU - Schmittner, Christoph
PY - 2019/1/1
Y1 - 2019/1/1
N2 - In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.
AB - In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.
KW - Attack trees
KW - Cyber physical security
KW - Diamond model
KW - FAIR method
KW - IT-security
KW - Risk assessment
KW - Risk propagation
UR - http://www.scopus.com/inward/record.url?scp=85072983274&partnerID=8YFLogxK
U2 - 10.1007/978-3-030-28005-5_4
DO - 10.1007/978-3-030-28005-5_4
M3 - Conference contribution
SN - 9783030280048
T3 - Communications in Computer and Information Science
SP - 45
EP - 56
BT - Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings
A2 - Walker, Alastair
A2 - O’Connor, Rory V.
A2 - Messnarz, Richard
PB - Springer Verlag
ER -