Probabilistic reliability and security risk assessment

Abstract

With advances and globalization of information technology such as big data and cloud computing, topics about potential risks with security vulnerabilities have been brought to the forefront. Considerable efforts have been made to estimate security risks with an unlimited cycle of disclosed vulnerabilities in the form of threats or attacks and management strategies to mitigate these risks. On the other hand, reliability is often considered as one of the most vital factors that affect functioning of critical computing systems. Existing works on risk analysis have mostly focused on either security or reliability, but not both. In addition, the existing approaches for quantifying risks are mostly based on simple multiplications of frequencies and quantitative consequences of hazard occurrence without considering dependencies among the hazards. In this dissertation research, an integrated framework is explored for simultaneously and systematically modeling and quantifying both reliability and security risks of modern technological systems. Under the framework, we advance the state of the art in quantitative security risk assessment by modeling sequential cyber-attacks, where multiple sequence-dependent hazardous actions are performed to launch a successful attack. Continuous-time Markov chain (CTMC) and semi-Markov process (SMP) based methods are proposed to estimate the occurrence probability of a security risk for systems undergoing the sequential cyber-attack. While the CTMC-based method is limited to the exponentially distributed state transition time, the proposed SMP-based approach is applicable to analyzing attacks with arbitrary types of transition time distributions. Both methods are illustrated using case studies where Trojan attacks in the banking application are modeled and analyzed. In this dissertation research, we make another contribution by modeling and analyzing survivability and vulnerability of a cloud RAID (Redundant Array of Independent Disks) stora