Attack tree-based evaluation of physical protection systems vulnerability

The paper deals with attack tree-based evaluation of vulnerability. The Attack tree method was originally developed for the purpose of security modeling in the area of information technologies, but gradually it came to spread also in different areas. Particularly in recent years this analytical method has been dynamically developed, and theoretical boundary conditions for its practical application have been worked out. The paper explains the basic principles of the method, tracks its historical development and describes the present state of method theoretical development and the possibilities of its practical implementation. Special attention is paid to analyzing the possibilities of using this method for the evaluation of the vulnerability of physical protection complex systems. The paper specifies both potential benefits of applying the method, and also limitations the method itself or present knowledge in this area can have. The authors of the paper also propose a couple of ways.

[1]  Zdenek Vintr,et al.  Does appropriate software support for target identification exist? , 2011, 2011 Carnahan Conference on Security Technology.

[2]  L. A. Cox,et al.  Risk analysis of complex and uncertain systems , 2009 .

[3]  Makis Stamatelatos,et al.  Fault tree handbook with aerospace applications , 2002 .

[4]  Geoffrey S. French,et al.  Defining and Assessing Vulnerability of Infrastructure to Terrorist Attack , 2011 .

[5]  David J. Parish,et al.  Unified P arametrizable Attack Tree , 2011 .

[6]  Ronald R. Yager.  OWA trees and their role in security modeling using attack trees , 2006, Inf. Sci..

[7]  Igor Nai Fovino,et al.  Integrating cyber attacks within fault trees , 2009, Reliab. Eng. Syst. Saf..

[8]  Jie Wang,et al.  Unified Parametrizable Attack Tree , 2011 .

[9]  Clifton A. Ericson,et al.  Hazard Analysis Techniques for System Safety , 2005 .

[10]  G. Manimaran,et al.  PENET: A practical method and tool for integrated modeling of security attacks and countermeasures , 2009, Comput. Secur..

[11]  G. G. M. Cojazzi,et al.  On the use of non-coherent fault trees in safety and security studies , 2008, Reliab. Eng. Syst. Saf..

[12]  Paul Jones,et al.  Secrets and Lies: Digital Security in a Networked World , 2002 .

[13]  王锐兵,et al.  口岸用辐射监测设备性能要求——IAEA Nuclear Security Series No．1简介 , 2009 .

[14]  Richard F. Paige,et al.  Fault trees for security system design and analysis , 2003, Comput. Secur..

[15]  Barry Charles Ezell,et al.  Infrastructure Vulnerability Assessment Model (I‐VAM) , 2007, Risk analysis : an official publication of the Society for Risk Analysis.

[16]  Sjouke Mauw,et al.  Foundations of Attack Trees , 2005, ICISC.

[17]  Mary Lynn Garcia,et al.  The Design and Evaluation of Physical Protection Systems , 2001 .

[18]  Stefano Bistarelli,et al.  Defense trees for economic evaluation of security investments , 2006, First International Conference on Availability, Reliability and Security (ARES'06).

[19]  Jan Willemson,et al.  Rational Choice of Security Measures Via Multi-parameter Attack Trees , 2006, CRITIS.

[20]  Clifton A. Ericson,et al.  Hazard Analysis Techniques for System Safety: Ericson/Hazard Analysis Techniques for System Safety , 2005 .