Exploring How Component Factors and Their Uncertainty Affect Judgements of Risk in Cyber-Security

Ellerby, Zack; McCulloch, Josie; Wilson, Melanie; Wagner, Christian

Abstract

Subjective judgements from experts provide essential information when assessing and modelling threats in respect to cyber-physical systems. For example, the vulnerability of individual system components can be described using multiple factors, such as complexity, technological maturity, and the availability of tools to aid an attack. Such information is useful for determining attack risk, but much of it is challenging to acquire automatically and instead must be collected through expert assessments. However, most experts inherently carry some degree of uncertainty in their assessments. For example, it is impossible to be certain precisely how many tools are available to aid an attack. Traditional methods of capturing subjective judgements through choices such as high, medium or low do not enable experts to quantify their uncertainty. However, it is important to measure the range of uncertainty surrounding responses in order to appropriately inform system vulnerability analysis. We use a recently introduced interval-valued response-format to capture uncertainty in experts' judgements and employ inferential statistical approaches to analyse the data. We identify key attributes that contribute to hop vulnerability in cyber-systems, and demonstrate the value of capturing the uncertainty around these attributes. We find that this uncertainty is not only predictive of uncertainty in the overall vulnerability of a given system component, but also significantly informs ratings of overall component vulnerability itself. We propose these methods and associated insights can be employed in real world situations, including cyber-physical systems, which are becoming increasingly complex and integrated into society, making them particularly susceptible to uncertainty in assessment.

Citation

Ellerby, Z., McCulloch, J., Wilson, M., & Wagner, C. (2020). Exploring How Component Factors and Their Uncertainty Affect Judgements of Risk in Cyber-Security. In Critical Information Infrastructures Security: 14th International Conference, CRITIS 2019, Linköping, Sweden, September 23–25, 2019, Revised Selected Papers (31-42). https://doi.org/10.1007/978-3-030-37670-3_3

• Conference Name: CRITIS 2019 : 14th International Conference on Critical Information Infrastructures Security
• Conference Location: Linköping, Sweden
• Start Date: Sep 23, 2019
• End Date: Sep 25, 2019
• Acceptance Date: Dec 19, 2019
• Online Publication Date: Dec 20, 2019
• Publication Date: 2020
• Deposit Date: Apr 22, 2020
• Publicly Available Date: Dec 21, 2020
• Publisher: Springer Verlag
• Pages: 31-42
• Series Title: Lecture Notes in Computer Science
• Series Number: 11777
• Series ISSN: 1611-3349
• Book Title: Critical Information Infrastructures Security: 14th International Conference, CRITIS 2019, Linköping, Sweden, September 23–25, 2019, Revised Selected Papers
• ISBN: 9783030376697
• DOI: https://doi.org/10.1007/978-3-030-37670-3_3
• Public URL: https://nottingham-repository.worktribe.com/output/2406821
• Publisher URL: https://link.springer.com/book/10.1007/978-3-030-37670-3