企业如何量化和分析其工业物联网网络中的(多方)APT网络风险暴露?

IF 2.5 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS ACM Transactions on Management Information Systems Pub Date : 2023-10-19 DOI:10.1145/3605949
Ranjan Pal, Rohan Xavier Sequeira, Xinlong Yin, Sander Zeijlemaker, Vineeth Kotala
{"title":"企业如何量化和分析其工业物联网网络中的(多方)APT网络风险暴露?","authors":"Ranjan Pal, Rohan Xavier Sequeira, Xinlong Yin, Sander Zeijlemaker, Vineeth Kotala","doi":"10.1145/3605949","DOIUrl":null,"url":null,"abstract":"Industrial Internet of Things (IIoT) networks (e.g., a smart grid industrial control system) are increasingly on the rise, especially in smart cities around the globe. They contribute to meeting the day-to-day needs (e.g., power, water, manufacturing, transportation) of the civilian society, alongside making societal businesses more efficient, productive, and profitable. However, it is also well known that IoT devices often operate on poorly configured security settings. This increases the chances of occurrence of (nation-sponsored) stealthy spread-based APT malware attacks in IIoT networks that might go undetected over a considerable period of time. Such attacks usually generate a negative first-party QoS impact with financial consequences for companies owning such IIoT network infrastructures. This impact spans (i.e., aggregates) space (i.e., the entire IIoT network or a sub-network) and time (i.e., duration of business disruption), and is a measure of significant interest to managers running their businesses atop such networks. It is of little use to network resilience boosting managers if they have to wait for a cyber-attack to happen to gauge this impact. Consequently, one of the questions that intrigues us is: can managers estimate this first-party impact prior to APT cyber-attack(s) causing financial damage to companies? In this paper, we propose the first computationally efficient and quantitative network theory framework to (a) characterize this first-party impact apriori as a statistical distribution over multiple attack configurations in a family of malware-driven APT cyber-attacks specifically launched on businesses running atop IIoT networks, (b) accurately compute the statistical moments (e.g., mean) of the resulting impact distribution, and (c) tightly bound the accuracy of worst-case risk estimate of such a distribution - captured through the tail of the distribution, using the Conditional Value at Risk (CVaR) metric. In relation to (a) above, our methodology extends the seminal Factor Analysis of Information Risk (FAIR) cyber-risk quantification methodology that does not explicitly account for network interconnections among system-risk contributing variables. We validate the effectiveness of our theory using trace-driven Monte Carlo simulations based upon test-bed experiments conducted in the FIT IoT-Lab. We further illustrate quantitatively that even if spread-based APT cyber-attacks induce a statistically light-tailed first-party cyber-loss distribution on an IIoT networked enterprise in the worst case, the aggregate multi-party cyber-risk distribution incurred by the same enterprise in supply-chain ecosystems could be heavy-tailed. This will pose significant market scale-up challenges to cyber-security improving commercial cyber (re-)insurance businesses. We subsequently propose managerial action items to mitigate the first-party cyber-risk exposure emanating from any given IIoT driven enterprise.","PeriodicalId":45274,"journal":{"name":"ACM Transactions on Management Information Systems","volume":null,"pages":null},"PeriodicalIF":2.5000,"publicationDate":"2023-10-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":"{\"title\":\"How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk Exposure in their Industrial IoT Network?\",\"authors\":\"Ranjan Pal, Rohan Xavier Sequeira, Xinlong Yin, Sander Zeijlemaker, Vineeth Kotala\",\"doi\":\"10.1145/3605949\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"Industrial Internet of Things (IIoT) networks (e.g., a smart grid industrial control system) are increasingly on the rise, especially in smart cities around the globe. They contribute to meeting the day-to-day needs (e.g., power, water, manufacturing, transportation) of the civilian society, alongside making societal businesses more efficient, productive, and profitable. However, it is also well known that IoT devices often operate on poorly configured security settings. This increases the chances of occurrence of (nation-sponsored) stealthy spread-based APT malware attacks in IIoT networks that might go undetected over a considerable period of time. Such attacks usually generate a negative first-party QoS impact with financial consequences for companies owning such IIoT network infrastructures. This impact spans (i.e., aggregates) space (i.e., the entire IIoT network or a sub-network) and time (i.e., duration of business disruption), and is a measure of significant interest to managers running their businesses atop such networks. It is of little use to network resilience boosting managers if they have to wait for a cyber-attack to happen to gauge this impact. Consequently, one of the questions that intrigues us is: can managers estimate this first-party impact prior to APT cyber-attack(s) causing financial damage to companies? In this paper, we propose the first computationally efficient and quantitative network theory framework to (a) characterize this first-party impact apriori as a statistical distribution over multiple attack configurations in a family of malware-driven APT cyber-attacks specifically launched on businesses running atop IIoT networks, (b) accurately compute the statistical moments (e.g., mean) of the resulting impact distribution, and (c) tightly bound the accuracy of worst-case risk estimate of such a distribution - captured through the tail of the distribution, using the Conditional Value at Risk (CVaR) metric. In relation to (a) above, our methodology extends the seminal Factor Analysis of Information Risk (FAIR) cyber-risk quantification methodology that does not explicitly account for network interconnections among system-risk contributing variables. We validate the effectiveness of our theory using trace-driven Monte Carlo simulations based upon test-bed experiments conducted in the FIT IoT-Lab. We further illustrate quantitatively that even if spread-based APT cyber-attacks induce a statistically light-tailed first-party cyber-loss distribution on an IIoT networked enterprise in the worst case, the aggregate multi-party cyber-risk distribution incurred by the same enterprise in supply-chain ecosystems could be heavy-tailed. This will pose significant market scale-up challenges to cyber-security improving commercial cyber (re-)insurance businesses. We subsequently propose managerial action items to mitigate the first-party cyber-risk exposure emanating from any given IIoT driven enterprise.\",\"PeriodicalId\":45274,\"journal\":{\"name\":\"ACM Transactions on Management Information Systems\",\"volume\":null,\"pages\":null},\"PeriodicalIF\":2.5000,\"publicationDate\":\"2023-10-19\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"ACM Transactions on Management Information Systems\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1145/3605949\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"Q2\",\"JCRName\":\"COMPUTER SCIENCE, INFORMATION SYSTEMS\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"ACM Transactions on Management Information Systems","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/3605949","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q2","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}
引用次数: 0

摘要

工业物联网(IIoT)网络(例如智能电网工业控制系统)正日益兴起,特别是在全球的智能城市中。它们有助于满足民间社会的日常需求(如电力、水、制造、交通),同时使社会企业更高效、更多产、更有利可图。然而,众所周知,物联网设备通常在配置不当的安全设置下运行。这增加了在工业物联网网络中发生(国家赞助的)基于传播的隐蔽APT恶意软件攻击的机会,这些攻击可能在相当长的一段时间内未被发现。此类攻击通常会对拥有此类IIoT网络基础设施的公司产生负面的第一方QoS影响和财务后果。这种影响跨越(即聚合)空间(即整个工业物联网网络或子网)和时间(即业务中断的持续时间),并且是在此类网络上运行业务的管理人员的重要利益衡量标准。如果管理者必须等到网络攻击发生后才衡量其影响,那么提高网络弹性对他们来说就没什么用了。因此,我们感兴趣的一个问题是:在APT网络攻击给公司造成财务损失之前,管理人员能否估计这种第一方影响?在本文中,我们提出了第一个计算高效和定量的网络理论框架,以(a)将这种第一方影响先验描述为专门针对运行在IIoT网络上的企业发起的恶意软件驱动的APT网络攻击系列中多个攻击配置的统计分布,(b)准确计算由此产生的影响分布的统计矩(例如,平均值)。(c)严格约束这种分布的最坏情况风险估计的准确性-通过分布的尾部捕获,使用条件风险值(CVaR)度量。关于上述(a),我们的方法扩展了开创性的信息风险因素分析(FAIR)网络风险量化方法,该方法没有明确考虑系统风险贡献变量之间的网络互连。我们使用基于FIT物联网实验室进行的试验台实验的轨迹驱动蒙特卡罗模拟验证了我们理论的有效性。我们进一步定量地说明,即使在最坏的情况下,基于传播的APT网络攻击导致IIoT联网企业的第一方网络损失分布在统计上是轻尾的,但同一企业在供应链生态系统中产生的多方网络风险分布可能是重尾的。这将对网络安全、改善商业网络(再)保险业务构成重大的市场规模挑战。随后,我们提出了管理行动项目,以减轻任何给定工业物联网驱动企业产生的第一方网络风险。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
查看原文
分享 分享
微信好友 朋友圈 QQ好友 复制链接
本刊更多论文
How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk Exposure in their Industrial IoT Network?
Industrial Internet of Things (IIoT) networks (e.g., a smart grid industrial control system) are increasingly on the rise, especially in smart cities around the globe. They contribute to meeting the day-to-day needs (e.g., power, water, manufacturing, transportation) of the civilian society, alongside making societal businesses more efficient, productive, and profitable. However, it is also well known that IoT devices often operate on poorly configured security settings. This increases the chances of occurrence of (nation-sponsored) stealthy spread-based APT malware attacks in IIoT networks that might go undetected over a considerable period of time. Such attacks usually generate a negative first-party QoS impact with financial consequences for companies owning such IIoT network infrastructures. This impact spans (i.e., aggregates) space (i.e., the entire IIoT network or a sub-network) and time (i.e., duration of business disruption), and is a measure of significant interest to managers running their businesses atop such networks. It is of little use to network resilience boosting managers if they have to wait for a cyber-attack to happen to gauge this impact. Consequently, one of the questions that intrigues us is: can managers estimate this first-party impact prior to APT cyber-attack(s) causing financial damage to companies? In this paper, we propose the first computationally efficient and quantitative network theory framework to (a) characterize this first-party impact apriori as a statistical distribution over multiple attack configurations in a family of malware-driven APT cyber-attacks specifically launched on businesses running atop IIoT networks, (b) accurately compute the statistical moments (e.g., mean) of the resulting impact distribution, and (c) tightly bound the accuracy of worst-case risk estimate of such a distribution - captured through the tail of the distribution, using the Conditional Value at Risk (CVaR) metric. In relation to (a) above, our methodology extends the seminal Factor Analysis of Information Risk (FAIR) cyber-risk quantification methodology that does not explicitly account for network interconnections among system-risk contributing variables. We validate the effectiveness of our theory using trace-driven Monte Carlo simulations based upon test-bed experiments conducted in the FIT IoT-Lab. We further illustrate quantitatively that even if spread-based APT cyber-attacks induce a statistically light-tailed first-party cyber-loss distribution on an IIoT networked enterprise in the worst case, the aggregate multi-party cyber-risk distribution incurred by the same enterprise in supply-chain ecosystems could be heavy-tailed. This will pose significant market scale-up challenges to cyber-security improving commercial cyber (re-)insurance businesses. We subsequently propose managerial action items to mitigate the first-party cyber-risk exposure emanating from any given IIoT driven enterprise.
求助全文
通过发布文献求助,成功后即可免费获取论文全文。 去求助
来源期刊
ACM Transactions on Management Information Systems
ACM Transactions on Management Information Systems COMPUTER SCIENCE, INFORMATION SYSTEMS-
CiteScore
6.30
自引率
20.00%
发文量
60
期刊最新文献
Interpretable Predictive Models for Healthcare via Rational Multi-Layer Perceptrons Mining Multimorbidity Trajectories and Co-Medication Effects from Patient Data to Predict Post–Hip Fracture Outcomes ShennongMGS: An LLM-based Chinese Medication Guidance System Co-occurrence order-preserving pattern mining with keypoint alignment for time series Estimating Future Financial Development of Urban Areas for Deploying Bank Branches: A Local-Regional Interpretable Model
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
已复制链接
已复制链接
快去分享给好友吧!
我知道了
×
扫码分享
扫码分享
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1