Enterprise architecture models for cyber security analysis

Enterprise architecture is a rising discipline that is gaining increasing interest in both industry and academia. It pays attention to the fact that effective management of business and IT needs take a holistic view of the enterprise. Enterprise architecture is based on graphical models as a vehicle for system analysis, design, and communication. Enterprise architecture is also a potential support for control systems management. Unfortunately, when it comes to security analyses, the architectural languages available are not adapted to provide support for this. This presentation focus on research performed as part of the EU seventh framework program VIKING (Vital Infrastructure, Networks, Information and Control Systems Management) and the Swedish Centre of Excellence in Electric Power Engineering, EKC2. The research is focusing on developing and adapting security analyses frameworks to architectural languages on a level where information about control systems' configuration is scarce and thus incomplete and partly unreliable.

[1]  Mathias Ekstedt,et al.  Cyber Security Risks Assessment with Bayesian Defense Graphs and Architectural Models , 2009 .

[2]  Mathias Ekstedt,et al.  Combining Defense Graphs and Enterprise Architecture Models for Security Analysis , 2008, 2008 12th International IEEE Enterprise Distributed Object Computing Conference.

[3]  Finn V. Jensen,et al.  Bayesian Networks and Decision Graphs , 2001, Statistics for Engineering and Information Science.

[4]  Robert Lagerström,et al.  Enterprise architecture analysis with extended influence diagrams , 2007, Inf. Syst. Frontiers.

[5]  Marianne M. Swanson,et al.  Recommended Security Controls for Federal Information Systems , 2005 .

[6]  Ronald A. Howard,et al.  Influence Diagrams , 2005, Decis. Anal..

[7]  Ida Hogganvik,et al.  A Graphical Approach to Security Risk Analysis , 2007 .

[8]  Christopher J. Alberts,et al.  Managing Information Security Risks: The OCTAVE Approach , 2002 .

[9]  John A. Zachman,et al.  A Framework for Information Systems Architecture , 1987, IBM Syst. J..

[10]  Richard E. Neapolitan,et al.  Learning Bayesian networks , 2007, KDD '07.

[11]  Stefano Bistarelli,et al.  Defense trees for economic evaluation of security investments , 2006, First International Conference on Availability, Reliability and Security (ARES'06).

[12]  Erik Johansson,et al.  A Tool for Enterprise Architecture Analysis , 2007, 11th IEEE International Enterprise Distributed Object Computing Conference (EDOC 2007).

[13]  Michael D. Smith,et al.  Computer security strength and risk: a quantitative approach , 2004 .

[14]  Ross D. Shachter.  Probabilistic Inference and Influence Diagrams , 1988, Oper. Res..

[15]  Andreas L. Opdahl,et al.  Eliciting security requirements with misuse cases , 2000, Proceedings 37th International Conference on Technology of Object-Oriented Languages and Systems. TOOLS-Pacific 2000.

[16]  Jan Jürjens,et al.  Secure systems development with UML , 2004 .

[17]  D. Dolezilek,et al.  Communications Technologies and Practices to Satisfy NERC Critical Infrastructure Protection (CIP) , 2006, 2006 Power Systems Conference: Advanced Metering, Protection, Control, Communication, and Distributed Resources.

[18]  Ruth Breu,et al.  Quantitative Assessment of Enterprise Security System , 2008, 2008 Third International Conference on Availability, Reliability and Security.

[19]  Ross D. Shachter.  Evaluating Influence Diagrams , 1986, Oper. Res..

[20]  David A. Basin,et al.  SecureUML: A UML-Based Modeling Language for Model-Driven Security , 2002, UML.

[21]  Wenke Lee,et al.  Attack plan recognition and prediction using causal networks , 2004, 20th Annual Computer Security Applications Conference.

[22]  Yu Liu,et al.  Network vulnerability assessment using Bayesian networks , 2005, SPIE Defense + Commercial Sensing.