A framework for evaluating security risk in system design
Tóm tắt
Design and development of ubiquitous computer network systems has become increasingly difficult as technology continues to grow. From the introduction of new technologies to the discovery of existing threats, weaknesses, and vulnerabilities there is a constantly changing landscape of potential risks and rewards. The cyber security community, and industry at large, is learning to account for these increasing threats by including protections and mitigations from the beginning of the design V process. However, issues still come from limitations in time for thoroughly exploring a potential design space and the knowledge base required to easily account for potential vulnerabilities in each. To address this problem we propose the G-T-S framework, which is an automated tool that allows a user to provide a set of inputs relating to the desired design space and returns a monetary security risk evaluation of each. This methodology first generates a series of potential designs, then dissects their contents to associate possible vulnerabilities to device elements, and finally evaluates the security risk poised to a central asset of importance. We exemplify the tools, provide methodologies for required background research, and discuss the results in evaluating a series of IoT Home models using the GTS framework. Through implementation of our framework we simplify the information an individual will require to begin the design process, lower the bar for entry to perform evaluating security risk, and present the risk as an easily understood monetary metric.
Tài liệu tham khảo
Alfakeeh AS, Almalawi A, Alsolami FJ, Abushark YB, Khan AI, Bahaddad AAS, Agrawal A, Kumar R, Khan RA. Hesitant fuzzy-sets based decision-making model for security risk assessment. CMC-Comput Mater Contin. 2022;70:2297–317.
Amoore L. Security and the incalculable. Secur Dialogue. 2014;45(5):423–39.
Bandi C, Salehi S, Hassan R, PD SM, Homayoun H, Rafatirad S. Ontology-driven framework for trend analysis of vulnerabilities and impacts in IoT hardware. In 2021 IEEE 15th international conference on semantic computing (ICSC), IEEE, 2021;211–4.
Bellay J, Forte D, Martin R, Taylor C. Hardware vulnerability description, sharing and reporting: challenges and opportunities. GOMACTech. 2021.
Cybersecurity and infrastructure security agency. ICS advisory (ICSA-14-202-01A). https://www.cisa.gov/uscert/ics/advisories/ICSA-14-202-01A. Accessed 21 June 2022.
de Gusmão APH, Silva MM, Poleto T, e Silva LC, Costa APCS. Cybersecurity risk analysis model using fault tree analysis and fuzzy decision theory. Int J Inform Manag. 2018;43:248–60.
Evaluators IS. Securing hospitals: a research student and blueprint. 2017. https://www.ise.io/wp-content/uploads/2017/07/securing_hospitals.pdf. Accessed 27 Apr 2022.
Feiler PH, Gluch DP, Hudak JJ. The architecture analysis & design language (AADL): an introduction. Technical report, Carnegie-Mellon Univ Pittsburgh PA Software Engineering Inst. 2006.
Ferrante A, Milosevic J, JanjuJanjus̆evic̀ M. A security-enhanced design methodology for embedded systems. In proceedings of international conference on security and cryptography (SECRYPT). 2013:39–50.
Green B, Chen Y. Algorithmic risk assessments can alter human decision-making processes in high-stakes government contexts. Proc ACM Hum Comput Interact. 2021;5(CSCW2):1–33.
Huff P, McClanahan K, Le T, Li Q. A recommender system for tracking vulnerabilities. In the 16th international conference on availability, reliability and security. 2021:1–7.
IBM. Cost of a data breach report. 2022. https://www.ibm.com/security/data-breach. Accessed 27 Apr 2022.
INTEL Corporation. INTEL-SA-00127. https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00127.html. Accessed 21 June 2022.
Kalinin M, Krundyshev V, Zegzhda P. Cybersecurity risk assessment in smart city infrastructures. Machines. 2021;9(4):78.
Lenovo Corporation. Lenovo security advisory LEN-23611. https://support.lenovo.com/us/en/product_security/ps500204-intel-dci-policy-update. Accessed 21 June 2022.
Mauw S, Oostdijk M. Foundations of attack trees. In international conference on information security and cryptology. Springer. 2005:186–98.
Michalec O, Milyaeva S, Rashid A. When the future meets the past: can safety and cyber security coexist in modern critical infrastructures? Big Data Soc. 2022;9(1):20539517221108370.
MITRE Group. VulDB added as CVE numbering authority (CNA). https://www.cve.org/Media/News/item/news/2021/12/21/VulDB-Added-as-CVE-Numbering. Accessed 21 June 2022.
Mukhopadhyay A, Chatterjee S, Saha D, Mahanti A, Sadhukhan SK. Cyber-risk decision models: to insure it or not? Decis Support Syst. 2013;56:11–26.
National Institute of Standards and Technology. NVD data feeds. 2022. https://nvd.nist.gov/vuln/data-feeds#JSON_FEED. Accessed 24 Oct 2022.
OleumTech. Sx1000-cc2. https://shop.oleumtech.com/products/sx1000-cc2.
Osborne L, Brummond J, Hart R, Zarean M, Conger S. Clarus: concept of operations. Technical report FHWA-JPO-05-072, Federal Highway Administration, US Department of Transportation, October 2005.
Prinetto P, Roascio G. Hardware security, vulnerabilities, and attacks: a comprehensive taxonomy. In ITASEC, 2020:177–89.
Shreeve B, Hallett J, Edwards M, Anthonysamy P, Frey S, Rashid A. “So if mr blue head here clicks the link\(\ldots\)” risk thinking in cyber security decision making. ACM Trans Priv Secur (TOPS). 2020;24(1):1–29.
Slupska J, Dawson Duckworth SD, Ma L, Neff G. Participatory threat modelling: exploring paths to reconfigure cybersecurity. In extended abstracts of the 2021 CHI conference on human factors in computing systems. 2021:1–6.
Smith A. The wealth of nations, vol. 11937. New York: Random House; 1776.
Sonnenreich W, Albanese J, Stout B. Return on security investment (ROSI)—a practical quantitative model. J Res Pract Inf Technol. 2006;38(1):45–56.
Stack B. Here’s how much your personal information is selling for on the dark web. 2017. https://www.experian.com/blogs/ask-experian/heres-how-much-your-personal-information-is-selling-for-on-the-dark-web/. Accessed 27 Apr 2022.
Tatham M. Identity theft statistics. 2018. https://www.experian.com/blogs/ask-experian/identity-theft-statistics/. Accessed 27 Apr 2022.
TechRadar Group. AMD admits Zen 3 processors are vulnerable to Spectre-like side-channel attack. https://www.techradar.com/news/amd-admits-zen-3-processors-are-vulnerable-to-spectre-like-side-channel-attack. Accessed 21 June 2022.
Tehranipoor F, Karimian N, Wortman PA, Chandy JA. Low-cost authentication paradigm for consumer electronics within the internet of wearable fitness tracking applications. In 2018 IEEE international conference on consumer electronics (ICCE), IEEE. 2018:1–6.
Tsaregorodtsev AV, Kravets OJ, Choporov ON, Zelenina AN. Information security risk estimation for cloud infrastructure. Int J Inform Technol Secur. 2018;11:91.
Verizon. Data breach investigations report. 2022. https://www.verizon.com/business/resources/reports/dbir/. Accessed 27 Apr 2022.
VulDB Group. VulDB. https://vuldb.com/. Accessed 21 June 2022.
Wortman P, Chandy J. Translation of AADL model to security attack tree (TAMSAT) to SMART evaluation of monetary security risk. Inform Secur J A Glob Perspect. 2022;5:1–7.
Wortman P, Yan W, Chandy J, Tehranipoor F. P2m-based security model: security enhancement using combined PUF and PRNG models for authenticating consumer electronic devices. IET Comput Digit Techn. 2018;12(6):289–96.
Wortman PA, Chandy JA. Smart: security model adversarial risk-based tool for systems security design evaluation. J Cybersecur. 2020;6(1):tyaa003.
Wortman PA, Tehranipoor F, Chandy JA. An adversarial risk-based approach for network architecture security modeling and design. In 2018 international conference on cyber security and protection of digital services (cyber security). IEEE. 2018;1–8.
Wortman PA, Tehranipoor F, Chandy JA. Exploring the coverage of existing hardware vulnerabilities in community standards. In silicon valley cybersecurity conference, Springer. 2020;87–97.
Wortman PA, Tehranipoor F, Karimian N, Chandy JA. Proposing a modeling framework for minimizing security vulnerabilities in iot systems in the healthcare domain. In 2017 IEEE EMBS international conference on biomedical & health informatics (BHI). IEEE. 2017;185–8.