Cyber-Risk Informatics
Description
More details
Other editions
Additional editions
Person
Content
Prologue xiv
Reviews xv
Preface xxi
Acknowledgments and Dedication xxix
About the Author xxxi
1 Metrics, Statistical Quality Control, and Basic Reliability in Cyber-Risk 1
1.1 Deterministic and Stochastic Cyber-Risk Metrics 1
1.2 Statistical Risk Analysis 2
1.2.1 Introduction to Statistical Hypotheses 2
1.2.2 Decision Rules 3
1.2.3 One-Tailed Tests 4
1.2.4 Two-Tailed Tests 4
1.2.5 Decision Errors 6
1.2.6 Applications to One-Tailed Tests Associated with Both Type I and Type II Errors 7
1.2.7 Applications to Two-Tailed Tests (Normal Distribution Assumption) 11
1.3 Acceptance Sampling in Quality Control 16
1.3.1 Introduction 16
1.3.2 Definition of an Acceptance Sampling Plan 16
1.3.3 The OC Curve 16
1.4 Poisson and Normal Approximation to Binomial in Quality Control 19
1.4.1 Approximations to Binomial Distribution 19
1.4.2 Approximation of Binomial to Poisson Distribution 19
1.4.3 Approximation to Normal Distribution 20
1.4.4 Comparisons of Normal and Poisson Approximations to the Binomial 21
1.5 Basic Statistical Reliability Concepts and Mc Simulators 21
1.5.1 Fundamental Equations for Reliability, Hazard, and Statistical Notions 23
1.5.2 Fundamentals for Reliability Block Diagramming and Redundancy 27
1.5.3 Solving Basic Reliability Questions by Using Student-Friendly Pedagogical Examples 30
1.5.4 MC Simulators for Commonly Used Distributions in Reliability 47
1.6 Discussions and Conclusion 52
1.7 Exercises 52
References 60
2 Complex Network Reliability Evaluation and Estimation in Cyber-Risk 61
2.1 Introduction 61
2.2 Overlap Technique to Calculate Complex Network Reliability 62
2.2.1 Network State Enumeration and Example 1 63
2.2.2 Generating Minimal Paths and Example 2 64
2.2.3 Overlap Method Algorithmic Rules and Example 3 68
2.3 The Overlap Method: Monte Carlo and Discrete Event Simulation 70
2.4 Multistate System Reliability Evaluation 71
2.4.1 Simple Series System with Single Derated States 73
2.4.2 Active Parallel System 73
2.4.3 Simple Series-Parallel System 74
2.4.4 A Simple Series-Parallel System with Multistate Components 75
2.4.5 A Combined System: Power Plant Example 76
2.4.6 Large Network Examples Using Multistate Overlap Technique 77
2.5 Weibull Time Distributed Reliability Evaluation 78
2.5.1 Motivation behind Weibull Probability Modeling 78
2.5.2 Weibull Parameter Estimation Methodology 79
2.5.3 Overlap Algorithm Applied to Weibull Distributed Components 80
2.5.4 Estimating Weibull Parameters 80
2.5.5 Fifty-Two-Node Weibull Example for Estimating Weibull Parameters 85
2.5.6 A Weibull Network Example from an Oil Rig System 90
2.6 Discussions and Conclusion 90
Appendix 2.A Overlap Algorithm and Example 93
2.A.1 Algorithm 93
2.A.2 Example 95
2.7 Exercises 101
References 103
3 Stopping Rules for Reliability and Security Tests in Cyber-Risk 105
3.1 Introduction 105
3.2 Methods 107
3.2.1 Lgm by Verhulst 108
3.2.2 Compound Poisson Model 110
3.3 Examples Merging Both Stopping Rules: Lgm and Cpm 114
3.3.1 The DR5 Data Set Example 114
3.3.2 The Dr4 Data Set Example 118
3.3.3 The Supercomputing Cloud Historical Failure Data-Case Study 119
3.3.4 Appendix for Section 3.3 121
3.4 Stopping Rule for Testing in the Time Domain 131
3.4.1 Review of Compound Poisson Process and Stopping Rule 131
3.4.2 Empirical Bayes Analysis for the Poisson^Geometric Stopping Rule 132
3.4.3 Howden's Model for Stopping Rule 135
3.4.4 Computational Example for Stopping-Rule Algorithm in Time Domain 136
3.5 Discussions and Conclusion 139
3.6 Exercises 143
References 144
4 Security Assessment and Management in Cyber-Risk 147
4.1 Introduction 147
4.1.1 What Other Scoring Methods Are Available? 148
4.2 Security Meter (Sm) Model Design 152
4.3 Verification of the Probabilistic Security Meter (Sm) Method by Monte Carlo Simulation and Math-Statistical Triple-Product Rule 154
4.3.1 The Triple-Product Rule of Uniforms 156
4.3.2 Data Analysis on the Total Residual Risk of the Security Meter Design 158
4.3.3 Triple-Product Rule Discussions 169
4.4 Modifying the SM Quantitative Model for Categorical, Hybrid, and Nondisjoint Data 170
4.5 Maintenance Priority Determination for 3 × 3 × 2 Sm 178
4.6 Privacy Meter (PM): How to Quantify Privacy Breach 183
4.6.1 Methodology 184
4.6.2 Privacy Risk-Meter Assessment and Management Examples 185
4.7 Polish Decoding (Decompression) Algorithm 187
4.8 Discussions and Conclusion 189
4.9 Exercises 190
References 199
5 Game-Theoretic Computing in Cyber-Risk 201
5.1 Historical Perspective to Game Theory's Origins 201
5.2 Applications of Game Theory to Cyber-Security Risk 203
5.3 Intuitive Background: Concepts, Definitions, and Nomenclature 204
5.3.1 A Price War Example 205
5.4 Random Selection for Nash Mixed Strategy 208
5.4.1 Random Probabilistic Selection 208
5.4.2 Does Nash Equilibrium (NE) Exist for the Company A/B Problem in Table 5.1? 209
5.4.3 An Example: Matching Pennies 210
5.4.4 Another Game: The Prisoner's Dilemma 210
5.4.5 Games with Multiple NE (Terrorist Game: Bold Strategy Result in Domination) 211
5.5 Adversarial Risk Analysis Models by Banks, Rios, and Rios 213
5.6 An Alternative Model: Sahinoglu's Security Meter for Neumann and Nash Mixed Strategy 215
5.7 Other Interdisciplinary Applications of Risk Meters 220
5.8 Mixed Strategy for Risk Assessment and Management-University Server and Social Network Examples 221
5.8.1 University Server's Security Risk-Meter Example 221
5.8.2 Social Networks' Privacy and Security Risk-Meter (RM) Example 222
5.8.3 Clarification of Risk Assessment and Management Algorithm for Social Networks 224
5.9 Application to Hospital Healthcare Service Risk 226
5.10 Application to Environmetrics and Ecology Risk 229
5.11 Application to Digital Forensics Security Risk 234
5.12 Application to Business Contracting Risk 239
5.13 Application to National Cybersecurity Risk 245
5.14 Application to Airport Service Quality Risk 253
5.15 Application to Offshore Oil-Drilling Spill and Security Risk 257
5.16 Discussions and Conclusion 264
5.17 Exercises 266
References 271
6 Modeling and Simulation in Cyber-Risk 277
6.1 Introduction and a Brief History to Simulation 277
6.2 Generic Theory: Case Studies on Goodness of Fit for Uniform Numbers 278
6.3 Why Crucial to Manufacturing and Cyber Defense 279
6.4 A Cross Section of Modeling and Simulation in Manufacturing Industry 280
6.4.1 Modeling and Simulation of Multistate Production Units and Systems in Manufacturing 281
6.4.2 Two-State SL Probability Model of Units with Closed-Form Solution 283
6.4.3 Extended Three-State SL Probability Model of Up-Down -Derated Units with Mc Simulation 284
6.4.4 Statistical Simulation of Three-State Units to Estimate the Density of Up-Down -Der 289
6.4.5 How to Generate Random Numbers from Sl pdf to Simulate Component and System Behavior 296
6.4.6 Example of Sl Simulation for Modeling Network of 2-in-Simple-Series Two-State (Up-Dn) Units 297
6.4.7 Example of Sl Simulation for Modeling a Network of 7-in-Complex-Topology Two-State (Up-Dn) Units 300
6.5 A Review of Modeling and Simulation in Cyber-Security 301
6.5.1 MC Value-at-Risk Approach by Kim et al. in Cloud Computing 301
6.5.2 MC and DES in Security Meter (Sm) Risk Model 302
6.6 Application of Queuing Theory and Multichannel Simulation to Cyber-Security 306
6.6.1 Example 1: One Recovery-Crew Case for Cyber-Security Queuing Simulation 306
6.6.2 Example 2: Two Recovery-Crew Case for Cyber-Security Queuing Simulation 308
6.7 Discussions and Conclusion 308
Appendix 6.A 311
6.8 Exercises 315
References 335
7 Cloud Computing in Cyber-Risk 339
7.1 Introduction and Motivation 339
7.2 Cloud Computing Risk Assessment 342
7.3 Motivation and Methodology 343
7.3.1 History of Theoretical Developments on CLOUD Modeling 343
7.3.2 Notation 344
7.3.3 Objectives 344
7.3.4 Frequency and Duration Method for the Loss of Load or Service 345
7.3.5 Nbd as a Compound Poisson Model 346
7.3.6 Nbd for the Loss of Load or Loss of Cloud Service Expected 348
7.4 Various Applications to Cyber Systems 349
7.4.1 Small Sample Experimental Systems 349
7.4.2 Large Cyber Systems 353
7.5 Large Cyber Systems Using Statistical Methods 357
7.6 Repair Crew and Product Reserve Planning to Manage Risk Cost Effectively Using Cyberrisksolver Cloud Management Java Tool 359
7.6.1 Cloud Resource Management Planning for Employment of Repair Crews 360
7.6.2 Cloud Resource Management Planning by Production Deployment 365
7.7 Remarks for "Physical Cloud" Employing Physical Products (Servers, Generators, Communication Towers, Etc.) 368
7.8 Applications to "Social (Human Resources) Cloud" 372
7.8.1 Numerical Example for Social Cloud (200 Employees Performing) 376
7.8.2 Input Wizard Example for Social Cloud (200 Employees Performing) 379
7.9 Stochastic Cloud System Simulation 379
7.9.1 Introduction and Methodology 381
7.9.2 Numerical Applications for Ss to Verify Non-Ss 385
7.9.3 Details of Probability Distributions Used in Stochastic Simulation 387
7.9.4 Varying Product Repair and Failure Date with Empirical Bayesian Posterior Gamma Approach 393
7.9.5 Varying Link Repair and Failure Using Gamma Distribution 393
7.9.6 Ss Applied to a Power or Cyber Grid 394
7.9.7 Error Checking or Flagging 396
7.10 Cloud Risk Meter Analysis 397
7.10.1 Risk Assessment and Management Clarifications for Figures 7.72 and 7.73 402
7.11 Discussions and Conclusion 405
7.12 Exercises 407
References 416
8 Software Reliability Modeling and Metrics in Cyber-Risk 421
8.1 Introduction, Motivation, and Methodology 421
8.2 History and Classification of Software Reliability Models 422
8.2.1 Time-between-Failures Models 422
8.2.2 Failure-Counting Models 422
8.2.3 Bayesian Model 423
8.2.4 Static (Nondynamic) Models 423
8.2.5 Others 424
8.3 Software Reliability Models in Time Domain 424
8.4 Software Reliability Growth Models 425
8.4.1 Negative Exponential Class of Failure Times 425
8.4.2 J-M De-eutrophication Model (Binomial Type) 425
8.4.3 Moranda's Geometric Model (Poisson Type) 426
8.4.4 Goel-Okumoto Nonhomogeneous Poisson Process (Poisson Type) 427
8.4.5 Musa's Basic Execution Time Model (Poisson Type) 428
8.4.6 Musa-Okumoto Logarithmic Poisson Execution Time Model (Poisson Type) 429
8.4.7 L-V Bayesian Model 431
8.4.8 Sahinoglu's Compound Poisson^Geometric and Poisson^Logarithmic Series Models 433
8.4.9 Gamma, Weibull, and Other Classes of Failure Times 435
8.4.10 Duane Model (Poisson Type) 439
8.5 Numerical Examples Using Pedagogues 440
8.5.1 Example 1 440
8.5.2 Example 2 441
8.6 Recent Trends in Software Reliability 441
8.7 Discussions and Conclusion 442
8.8 Exercises 444
References 445
9 Metrics for Software Reliability Failure-Count Models in Cyber-Risk 451
9.1 Introduction and Methodology on Failure-Count Estimation in Software Reliability 451
9.1.1 Statistical Estimation Models, Computational Formulas, and Examples 452
9.1.2 Interpretations of Numerical Examples and Discussions 464
9.2 Predictive Accuracy to Compare Failure-Count Models 466
9.2.1 Classical Distribution Approach 468
9.2.2 Prior Distribution Approach 469
9.2.3 Applications to Data Sets and Comparisons 472
9.3 Discussions and Conclusion 473
appendix 9.A 477
9.4 Exercises 478
References 482
10 Practical Hands-On Lab Topics in Cyber-Risk 483
10.1 System Hardening 483
10.1.1 General 483
10.1.2 Windows Servers 484
10.1.3 Wireless 484
10.1.4 Firewalls, Routers, and Switches 485
10.2 Email Security 486
10.2.1 Identifying Fake Emails 486
10.2.2 Emotion Responses 486
10.3 MS-DOS Commands 487
10.3.1 Mapping Intel 488
10.4 Logging 492
10.4.1 Policy 493
10.4.2 Understanding Logs 494
10.5 Firewall 495
10.5.1 Traditional Firewalls 495
10.5.2 Ngfs 496
10.5.3 Host-Based Firewalls 496
10.6 Wireless Networks 496
10.7 Discussions and Conclusion 499
Appendix 10.A 500
10.8 Exercises 501
10.8.1 System Hardening 501
10.8.2 Email 501
10.8.3 Ms-Dos 502
10.8.4 Logging 503
10.8.5 Firewall 503
10.8.6 Wireless 505
10.8.7 Comprehensive Exercises 505
10.8.8 Cryptology Projects 507
References 509
What the Cyber-Risk Informatics Textbook and the Author are About? 511
Index 513
REVIEWS
The Cyber-Risk Informatics is a sequel to Dr. Sahinoglu's earlier Wiley text of 2007 and is a reinforcement of his popularized risk metric approach to assessing and managing security and reliability of cyber components and networks at large. His Cyber-Risk assurance modeling, employing math statistically sound metric approaches, from Healthcare to Cloud Computing to name a few themes that he has implemented is not to be encountered in today's many case study-based textbooks. I certainly take pride in writing a new foreword this time 8 full years later for his follow-up as I was pleased to personally recommend back in 2011 to prepare a new manuscript to incorporate all of his new findings and journal publications. The inaction of not creating this text otherwise would have left a serious void and waste of resources to reach our new generation of risk (fire) fighters to quench the widely prevalent network (forest) breaches (arsons) as the metaphor goes, if you will.
It is my distinct pleasure to highly recommend this book of multi- and transdisciplinary nature equipped with numerical methods and directly related to software application provided for the readers and students as a gluing medium to synergize all the necessary components of research from Testing to Simulation and from Security Assessment to Cloud Computing and hands-on lab practices. His goal to emphasize the strong link between the academic and corporate worlds that complement one another is well justified. I strongly recommend anyone eager to learn new depths in Cyber-Risk modeling to visit this museum of knowledge that will become a scientific classic to refer to in the decades ahead.
In Memoriam: The academic world with great sadness has lost Professor CV Ramamoorthy on March 9, 2016 to eternity at 90; however his spectacular deeds and unforgettable selfless enlightenments of all scholars around the world will never get lost, and his ever-smiling countenance full of wisdom will always be remembered endlessly at every occasion. A good man and gentleman, who helped many when they were in down times, has proudly made his journey. He was a gentle guide and kind mentor to countless and will be dearly missed. May he rest in peace!
Posthumously To: Dearest Professor Ramamoorthy, This book would have been in your masterful palms adorned and enriched with your natural, humbling observance had you in good health prevailed since the book's prompt delivery was arranged to be sent to you by WILEY. You still will receive it. I would be remiss if I did not quote your timeless and wonderfully crafted e-mail related to the essence of a textbook you encouraged me to compose when you said this project was a must-do. Forever Gratefully!
Dear Prof. Mehmet,
Wonderful information. The topic you are discussing is most important and timely. Please compose an excellent text into an easy to follow sequence of the critical ideas in your presentation-for the layman, to a graduate engineer, and a practicing entrepreneur or financial banker. As I mentioned before, you have the God-given talent in conveying in a very comprehensible form the complex ideas people often find difficult to simplify. I am forwarding this recommendation to John Wiley publisher, Dr. Brett Kurzman of John Wiley to entice you to develop this project. Warmest Regards. Sincerely / RAM
C. V. Ramamoorthy, M.S./Ph.D., Harvard University in EE and Applied Math (Computer Science) Distinguished Professor (Emeritus) of Computer Sciences and Electrical Engineering at the University of California at Berkeley, California. His awards are not limited to IEEE Life Fellow, SDPS Fellow and SR Research Fellow of the ICC Institute at the University of Texas, Austin; Honorary Doctorate in Taiwan and many universities around the world; Editor-in-Chief of IEEE Transactions on Software Engineering and International Journal of Software Engineering and Artificial Intelligence and IEEE Transactions on Knowledge and Data Engineering; Coeditor-in-Chief of the International Journal of Systems Integration and of the Journal of the Society of Design and Process Science; Distinguished Scholar Award, Society for Design & Process Science, 1995; IEEE Richard E. Merwin Award, 1993; IEEE Computer Society Meritorious Service Award, 1991; IEEE Computer Society Taylor Booth Award, 1990; IEEE Computer Society Outstanding Award, 1987; IEEE Centennial Medal, 1984; Fellow, IEEE, 1978; IEEE Computer Society, Special Education Award, 1978; IEEE Computer Society, Honor Roll Award, 1974; Admiral Grace Hopper Chair, Naval Postgraduate School and others.
The critical status of cybersecurity in today's connected world is self-evident from countless unwanted security breaches in all walks of life. The Cyber-Risk Informatics has many interesting discussions and illustrative examples that will present students and other researchers an overview to understand the importance of this area. Furthermore, this book, in addition to examples, presents several computational and intellectual challenges to students and other researchers in this area. The new text on cyber assurance modeling proceeds with a good foundation in mathematics and statistics and culminates to game-theoretic risk computing (including the sensory networks), as well as simulation-based best practices and continues with the popular topic, such as Cloud Computing, in terms of its performance characteristics. This text finally offers the students and researchers a chance to learn enough about the hands-on lab practices to help land a decent cybersecurity job. These building blocks click well with synergy while carefully executed through plenty of examples and screenshots. It is a useful reference text for students and researchers taking courses in search for cybersecurity metrics and risk management methods given the lack of technical resources in this area.
S. S. Iyengar, Ph.D., Director and Ryder Professor, Department of Computer Science FIU School of Computing and Information Sciences, Miami, FL. His awards are not limited to IEEE Fellow, ACM Fellow, AAAS Fellow, and National Academy of Inventors Fellow; Recipient of Florida Innovation Award; The Association of Scientists and Developers and Faculty Award (India); Distinguished Service Award (LSU); Distinguished Research Award (China); IEEE Computer Society Technical Achievement Award; IEEE Computer Society Meritorious Award; IEEE Computer Society Golden Core Membership; LSU Prestigious Distinguished Research Master Award; IEEE Distinguished Visitor, NASA Faculty Fellow; Editor to 16 IEEE and other journals; authored 20 books from sensors to robotics with 5 patents and numerous grants.
In my daily dealings as a director of a cybersecurity center of national importance and as an academician, I have felt the need for a book that gives me foundations and tools to deal with important issues on risk assessment in cybersecurity. Not only I but my many peers across the country have felt the void of a pedagogical resource that combines building blocks of quantitative concepts and practice of risk assessment. This much needed book fills a void in the cybersecurity field. The field of cybersecurity has advanced at a very rapid pace, but the theory and pedagogical components have not kept pace with this advance. This is perhaps the first book that first gives the fundamentals of risk assessment, much needed statistical foundations, network principles, reliability, game-theoretic foundations, etc. and presents it an easy-to-understand manner without compromising the rigor of the field. The book will be very useful to layman and practitioners in the cybersecurity arena, especially in regard to the hands-on lab exercises, as in Chapter 10 and full Java-assisted applets in the Cyber-Risk Solver website with a solution set.
I know that this book will be on my desk within easy reach. I can find no other person better qualified than Professor Mehmet Sahinoglu to address the very important areas of quantitative risk assessment. Professor Sahinoglu brings the best of his academic expertise and 35 years of experience in the field to present a unique balance of theory, practice, and research in this book. The pedagogical components including examples and lab exercises make this book unique and exemplary.
Vir V. Phoha, Ph.D., formerly Director of Center for Secure Cyberspace, College of Engineering, Louisiana Tech University, Ruston, LA; currently Professor of Electrical Engineering and Computer Science, L.C. Smith College of Engineering and Computer Science, Syracuse University, Syracuse, NY.
This may be the first book of its kind in a long time-one that brings real engineering and science back into the world of Cyber-Risk assessments. One of the growing challenges in the world of security today is simply to arrive at a concrete definition of risk. There are literally thousands of books written on or related to the subject of risk in the cybersecurity world. However, finding a book that describes risk in quantitative terms is nearly impossible. The modern practice of determining Cyber-Risk is instead left to the philosophical whims of qualitative deductions and long lists of gadgets and software that will surely make you cyber secure. In a time when computing power is at an all-time high, we find ourselves facing a dearth of knowledge with regard to understanding how much risk we are actually exposed to in our systems. So the question remains, "Does anybody really know what Cyber-Risks we are...
