Quantitative Security Risk Assessment of Enterprise Networks

1. Front Matter

   Pages i-xiii

   PDF

2. The Need for Quantifying Security

   • Xinming Ou, Anoop Singhal

   Pages 1-3

3. Attack Graph Techniques

   • Xinming Ou, Anoop Singhal

   Pages 5-8

4. The Common Vulnerability Scoring System (CVSS)

   • Xinming Ou, Anoop Singhal

   Pages 9-12

5. Security Risk Analysis of Enterprise Networks Using Attack Graphs

   • Xinming Ou, Anoop Singhal

   Pages 13-23

6. Conclusion

   • Xinming Ou, Anoop Singhal

   Pages 25-28

Protection of enterprise networks from malicious intrusions is critical to the economy and security of our nation. This article gives an overview of the techniques and challenges for security risk analysis of enterprise networks. A standard model for security analysis will enable us to answer questions such as “are we more secure than yesterday” or “how does the security of one network configuration compare with another one”. In this article, we will present a methodology for quantitative security risk analysis that is based on the model of attack graphs and the Common Vulnerability Scoring System (CVSS). Our techniques analyze all attack paths through a network, for an attacker to reach certain goal(s).

• CVSS
• Security metrics
• attack graph
• enterprise network security
• risk assessment

• , Computing and Information Sciences, Kansas State University, Manhattan, USA

  Xinming Ou

• and Technology (NIST), Computer Security Division, National Institute of Standards, Gaithersburg, USA

  Anoop Singhal

Policies and ethics