TY - GEN

T1 - The complexity of estimating systematic risk in networks

AU - Johnson, Benjamin

AU - Laszka, Aron

AU - Grossklags, Jens

PY - 2014/11/13

Y1 - 2014/11/13

N2 - This risk of catastrophe from an attack is a consequence of a network's structure formed by the connected individuals, businesses and computer systems. Understanding the likelihood of extreme events, or, more generally, the probability distribution of the number of compromised nodes is an essential requirement to provide risk-mitigation or cyber-insurance. However, previous network security research has not considered features of these distributions beyond their first central moments, while previous cyber-insurance research has not considered the effect of topologies on the supply side. We provide a mathematical basis for bridging this gap: we study the complexity of computing these loss-number distributions, both generally and for special cases of common real-world networks. In the case of scale-free networks, we demonstrate that expected loss alone cannot determine the riskiness of a network, and that this riskiness cannot be naively estimated from smaller samples, which highlights the lack/importance of topological data in security incident reporting.

AB - This risk of catastrophe from an attack is a consequence of a network's structure formed by the connected individuals, businesses and computer systems. Understanding the likelihood of extreme events, or, more generally, the probability distribution of the number of compromised nodes is an essential requirement to provide risk-mitigation or cyber-insurance. However, previous network security research has not considered features of these distributions beyond their first central moments, while previous cyber-insurance research has not considered the effect of topologies on the supply side. We provide a mathematical basis for bridging this gap: we study the complexity of computing these loss-number distributions, both generally and for special cases of common real-world networks. In the case of scale-free networks, we demonstrate that expected loss alone cannot determine the riskiness of a network, and that this riskiness cannot be naively estimated from smaller samples, which highlights the lack/importance of topological data in security incident reporting.

UR - http://www.scopus.com/inward/record.url?scp=84939614161&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84939614161&partnerID=8YFLogxK

U2 - 10.1109/CSF.2014.30

DO - 10.1109/CSF.2014.30

M3 - Conference contribution

AN - SCOPUS:84939614161

T3 - Proceedings of the Computer Security Foundations Workshop

SP - 325

EP - 336

BT - Proceedings - 2014 IEEE 27th Computer Security Foundations Symposium, CSF 2014

PB - IEEE Computer Society

T2 - 27th IEEE Computer Security Foundations Symposium, CSF 2014

Y2 - 19 July 2014 through 22 July 2014

ER -