STAST-2012

Presentation given at STAST 2012 conference in Cambridge, MA on June 29, 2012.

Transcript

1. Optimal Security Investments in Networks of Varying Size and Topology Alan Nochenson C.F. Larry Heimann Slides for a paper presented at: Socio-Technical Aspects of Security and Trust 2012 Harvard University, Cambridge, MA
2. The problem of interdependent security
3. Previous research Kunreuther and Heal (2003) Model internal and external risks faced by a set of airlines sharing airport facilities
4. Previous research Kunreuther and Heal (2003) Model internal and external risks faced by a set of airlines sharing airport facilities Heal and Kunreuther (2003) Revises previous model to account for heterogeneous populations
5. Previous research Kunreuther and Heal (2003) Model internal and external risks faced by a set of airlines sharing airport facilities Heal and Kunreuther (2003) Revises previous model to account for heterogeneous populations Grossklags, et al. (2008) Expand by adding additional security games, such as weakest-link and total-effort games
6. Previous research Kunreuther and Heal (2003) Model internal and external risks faced by a set of airlines sharing airport facilities Heal and Kunreuther (2003) Revises previous model to account for heterogeneous populations Grossklags, et al. (2008) Expand by adding additional security games, such as weakest-link and total-effort games Johnson, et al. (2010) Examine how infection probabilities can be reasonably estimated
7. Previous research Kunreuther and Heal (2003) Model internal and external risks faced by a set of airlines sharing airport facilities Heal and Kunreuther (2003) Revises previous model to account for heterogeneous populations Grossklags, et al. (2008) Expand by adding additional security games, such as weakest-link and total-effort games Johnson, et al. (2010) Examine how infection probabilities can be reasonably estimated Heimann and Nochenson (2012) Introduces loss profiles to capture differing degrees of loss suffered upon failure
8. The case for virus protection Alice A = worth of Alice’s computer C = cost of full protection p = probability of suffering loss
9. The case for virus protection Alice
10. The case for virus protection Alice
11. Two players Bob
12. Two players Bob
13. Generalizing to n players Network with n players The utility for player i
14. Player value and network size Mancur Olson’s classic work on group behavior provides insight on people’s behavior in computer networks ... 1. Heterogeneous networks are more likely to be protected 2. Larger networks end up with less total protection
15. Impact of network topology Star Network
16. Impact of network topology Fully Connected Network
17. Other network topologies Ring Network Tree Network Bus Network
18. Future research • More work on topology and security decisions • Intelligent attackers
19. Questions? These slides are available online at: https://speakerdeck.com/u/profh/p/stast-2012 Speaker Deck