RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security

Michael Krisper; Jürgen Dobaj; Georg Macher; Christoph Schmittner

doi:10.1007/978-3-030-28005-5_4

RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security

Michael Krisper^*, Jürgen Dobaj, Georg Macher, Christoph Schmittner

^*Corresponding author for this work

Institute of Technical Informatics (4480)

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Abstract

In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.

Original language	English
Title of host publication	Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings
Editors	Alastair Walker, Rory V. O’Connor, Richard Messnarz
Publisher	Springer Verlag
Pages	45-56
Number of pages	12
ISBN (Print)	9783030280048
DOIs	https://doi.org/10.1007/978-3-030-28005-5_4
Publication status	Published - Sept 2019
Event	26th European Conference on Systems, Software and Services Process Improvement: EuroSPI 2019 - Edinburgh, United Kingdom Duration: 18 Sept 2019 → 20 Sept 2019

Publication series

Name	Communications in Computer and Information Science
Volume	1060
ISSN (Print)	1865-0929
ISSN (Electronic)	1865-0937

Conference

Conference	26th European Conference on Systems, Software and Services Process Improvement
Country/Territory	United Kingdom
City	Edinburgh
Period	18/09/19 → 20/09/19

Keywords

Attack trees
Cyber physical security
Diamond model
FAIR method
IT-security
Risk assessment
Risk propagation

ASJC Scopus subject areas

General Computer Science
General Mathematics

Fields of Expertise

Information, Communication & Computing

Access to Document

10.1007/978-3-030-28005-5_4

Cite this

Krisper, M., Dobaj, J., Macher, G., & Schmittner, C. (2019). RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security. In A. Walker, R. V. O’Connor, & R. Messnarz (Eds.), Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings (pp. 45-56). (Communications in Computer and Information Science; Vol. 1060). Springer Verlag. https://doi.org/10.1007/978-3-030-28005-5_4

RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security. / Krisper, Michael; Dobaj, Jürgen; Macher, Georg et al.
Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings. ed. / Alastair Walker; Rory V. O’Connor; Richard Messnarz. Springer Verlag, 2019. p. 45-56 (Communications in Computer and Information Science; Vol. 1060).

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Krisper, M, Dobaj, J, Macher, G & Schmittner, C 2019, RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security. in A Walker, RV O’Connor & R Messnarz (eds), Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings. Communications in Computer and Information Science, vol. 1060, Springer Verlag, pp. 45-56, 26th European Conference on Systems, Software and Services Process Improvement, Edinburgh, United Kingdom, 18/09/19. https://doi.org/10.1007/978-3-030-28005-5_4

Krisper M, Dobaj J, Macher G, Schmittner C. RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security. In Walker A, O’Connor RV, Messnarz R, editors, Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings. Springer Verlag. 2019. p. 45-56. (Communications in Computer and Information Science). doi: 10.1007/978-3-030-28005-5_4

Krisper, Michael ; Dobaj, Jürgen ; Macher, Georg et al. / RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security. Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings. editor / Alastair Walker ; Rory V. O’Connor ; Richard Messnarz. Springer Verlag, 2019. pp. 45-56 (Communications in Computer and Information Science).

@inproceedings{23848b1cda8e447abec5ba1e747266c6,

title = "RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security",

abstract = "In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.",

keywords = "Attack trees, Cyber physical security, Diamond model, FAIR method, IT-security, Risk assessment, Risk propagation",

author = "Michael Krisper and J{\"u}rgen Dobaj and Georg Macher and Christoph Schmittner",

year = "2019",

month = sep,

doi = "10.1007/978-3-030-28005-5_4",

language = "English",

isbn = "9783030280048",

series = "Communications in Computer and Information Science",

publisher = "Springer Verlag",

pages = "45--56",

editor = "Alastair Walker and O{\textquoteright}Connor, {Rory V.} and Richard Messnarz",

booktitle = "Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings",

address = "Germany",

note = "26th European Conference on Systems, Software and Services Process Improvement : EuroSPI 2019 ; Conference date: 18-09-2019 Through 20-09-2019",

}

TY - GEN

T1 - RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security

AU - Krisper, Michael

AU - Dobaj, Jürgen

AU - Macher, Georg

AU - Schmittner, Christoph

PY - 2019/9

Y1 - 2019/9

N2 - In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.

AB - In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.

KW - Attack trees

KW - Cyber physical security

KW - Diamond model

KW - FAIR method

KW - IT-security

KW - Risk assessment

KW - Risk propagation

UR - http://www.scopus.com/inward/record.url?scp=85072983274&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-28005-5_4

DO - 10.1007/978-3-030-28005-5_4

M3 - Conference paper

AN - SCOPUS:85072983274

SN - 9783030280048

T3 - Communications in Computer and Information Science

SP - 45

EP - 56

BT - Systems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings

A2 - Walker, Alastair

A2 - O’Connor, Rory V.

A2 - Messnarz, Richard

PB - Springer Verlag

T2 - 26th European Conference on Systems, Software and Services Process Improvement

Y2 - 18 September 2019 through 20 September 2019

ER -

RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Fields of Expertise

Access to Document

Other files and links

Fingerprint

Industrial Informatics

AH-DHYAMONT - Control platform for hydro-electric power generation

AH-HyUnify-Erweiterung - Control platform for hydro-electric power generation

26th European Conference on System, Software and Service Process Improvement & Innovation: EuroSPI 2019

Cite this

RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Fields of Expertise

Access to Document

Other files and links

Fingerprint

Projects

Industrial Informatics

AH-DHYAMONT - Control platform for hydro-electric power generation

AH-HyUnify-Erweiterung - Control platform for hydro-electric power generation

Activities

26th European Conference on System, Software and Service Process Improvement & Innovation: EuroSPI 2019

Cite this