TY - GEN
T1 - Managing business health in the presence of malicious attacks
AU - Zonouz, Saman A.
AU - Sharma, Aashish
AU - Ramasamy, Harigovind V.
AU - Kalbarczyk, Zbigniew T
AU - Pfitzmann, Birgit
AU - McAuliffe, Kevin
AU - Iyer, Ravishankar K
AU - Sanders, William H
AU - Cope, Eric
PY - 2011
Y1 - 2011
N2 - Business metrics play a critical role in determining the best system-level configuration to achieve an organizational business-level goal. We present a framework for reasoning about business-level implications of malicious attacks affecting information technology (IT) systems that underlie various business processes. Through an exemplar web-based retail company scenario, we demonstrate how to quantify both the relative value of the individual business processes, and the relative cost to the business caused by breach of key security properties. The framework allows for mapping business-level metrics to IT system-level metrics, and uses a combination of those metrics to recommend optimal response actions and to guide recovery from security attacks. We validate the framework against three high-impact attack classes common in such web-based retail company situations.
AB - Business metrics play a critical role in determining the best system-level configuration to achieve an organizational business-level goal. We present a framework for reasoning about business-level implications of malicious attacks affecting information technology (IT) systems that underlie various business processes. Through an exemplar web-based retail company scenario, we demonstrate how to quantify both the relative value of the individual business processes, and the relative cost to the business caused by breach of key security properties. The framework allows for mapping business-level metrics to IT system-level metrics, and uses a combination of those metrics to recommend optimal response actions and to guide recovery from security attacks. We validate the framework against three high-impact attack classes common in such web-based retail company situations.
UR - http://www.scopus.com/inward/record.url?scp=80052167190&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=80052167190&partnerID=8YFLogxK
U2 - 10.1109/DSNW.2011.5958856
DO - 10.1109/DSNW.2011.5958856
M3 - Conference contribution
AN - SCOPUS:80052167190
SN - 9781457703751
T3 - Proceedings of the International Conference on Dependable Systems and Networks
SP - 9
EP - 14
BT - 2011 IEEE/IFIP 41st International Conference on Dependable Systems and Networks Workshops, DSN-W 2011
T2 - 2011 IEEE/IFIP 41st International Conference on Dependable Systems and Networks Workshops, DSN-W 2011
Y2 - 27 June 2011 through 30 June 2011
ER -