SaTC: CORE: Medium: An Optimization Framework for Identifying Dynamic Risk Management Practices

University Of Wisconsin-Madison, Madison WI

Investigators

Abstract

It is enormously challenging for organizations to protect information technology (IT) systems from the myriad of risks and vulnerabilities that exist. Organizations can reduce these vulnerabilities by implementing security controls to protect critical IT systems from risk and responding to alerts from reports and logs. Nonetheless, major challenges in protecting IT systems involve determining the right combination of these mechanisms to deploy in a resource-constrained environment and identifying how to roll out security controls at the right time using the right resources. This project is aimed at increasing the efficiency of using security controls in IT organizations and agencies. It addresses these challenges by introducing and analyzing a new optimization framework to support the choice and implementation of security procedures. The project will contribute to the optimization literature, the field of operations research, and links between operations research and IT security. This project supports forward-looking, dynamic defensive strategies in uncertain environments that have the potential to achieve high levels of security without a corresponding increase in costs. To achieve this goal, this project explores how an optimization framework can be used to prescribe dynamic protection and response policies that protect IT systems, are effective given uncertain future events, and reduce risk in complex environments that span people, processes, and infrastructure. The project adds new models to the literature that draw from integer programming, multi-stage stochastic programming, adversarial risk analysis, and network games. Solving these models is extremely challenging, and therefore, this research explores new algorithmic techniques to identify optimal and near-optimal model solutions. This project advances our understanding of how to dynamically allocate resources to secure IT systems in an uncertain environment. This project integrates research with education to train the future workforce in cybersecurity. A comprehensive plan for broadening participation in computing highlights the researchers' efforts and commitment to diversity and inclusion. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.