Algorithmic Aspects of Risk Management

Abstract. Risk analysis has been used to manage the security of systems for several decades. However, its use has been limited to offline risk computation and manual response. In contrast, we use risk computation to drive changes in an operating system’s security configuration. This allows risk management to occur in real time and reduces the window of exposure to attack. We posit that it is possible to protect a system by reducing its functionality temporarily when it is under siege. Our goal is to minimize the tension between security and usability by trading them dynamically. Instead of statically configuring a system, we aim to monitor the risk level, using it to drive the tradeoff between security and utility. The advantage of this approach is that it provides users with the maximum possible functionality for any predefined level of risk tolerance. Risk management can be framed as an exercise in managing the constraints on edge and vertex weights of a tripartite graph, with ...

• Type: Journal
• Year: 2011
• Where: BIRTHDAY
• Authors: Ashish Gehani, Lee Zaniewski, K. Subramani
• Keywords: Applied Computing, BIRTHDAY 2011, Optimal Risk Management, Vertex Weights, Vulnerable Resource