Repository logo
 
Publication

Two-stage Security Controls Selection

2016Journal article Open access
Simple item page
dc.contributor.authorYevseyeva, Iryna
dc.contributor.authorBasto-Fernandes, Vitor
dc.contributor.authorvan Moorsel, Aad
dc.contributor.authorJanicke, Helge
dc.contributor.authorEmmerich, Michael
dc.date.accessioned2025-06-13T15:04:58Z
dc.date.available2025-06-13T15:04:58Z
dc.date.issued2016
dc.description.abstracto protect a system from potential cyber security breaches and attacks, one needs to select efficient security controls, taking into account technical and institutional goals and constraints, such as available budget, enterprise activity, internal and external environment. Here we model the security controls selection problem as a two-stage decision making: First, managers and information security officers define the size of security budget. Second, the budget is distributed between various types of security controls. By viewing loss prevention with security controls measured as gains relative to a baseline (losses without applying security controls), we formulate the decision making process as a classical portfolio selection problem. The model assumes security budget allocation as a two objective problem, balancing risk and return, given a budget constraint. The Sharpe ratio is used to identify an optimal point on the Pareto front to spend the budget. At the management level the budget size is chosen by computing the trade-offs between Sharpe ratios and budget sizes. It is shown that the proposed two-stage decision making model can be solved by quadratic programming techniques, which is shown for a test case scenario with realistic data.por
dc.identifier.citationIryna Yevseyeva, Vitor Basto Fernandes, Aad van Moorsel, Helge Janicke, Michael Emmerich, Two-stage Security Controls Selection, Procedia Computer Science, Volume 100, 2016, Pages 971-978, ISSN 1877-0509, https://doi.org/10.1016/j.procs.2016.09.261
dc.identifier.doi10.1016/j.procs.2016.09.261
dc.identifier.issn1877-0509
dc.identifier.urihttp://hdl.handle.net/10400.8/13232
dc.language.isoeng
dc.peerreviewedyes
dc.publisherElsevier BV
dc.relation.hasversionhttps://www.sciencedirect.com/science/article/pii/S1877050916324309
dc.relation.ispartofProcedia Computer Science
dc.rights.urihttp://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectMulticriteria optimisation
dc.subjectSecurity
dc.subjectSubset selection
dc.subjectSecurity budget
dc.subjectPortfolio optimization
dc.subjectSharpe ratio
dc.titleTwo-stage Security Controls Selection
dc.typejournal article
dspace.entity.typePublication
oaire.citation.endPage978
oaire.citation.startPage971
oaire.citation.titleProcedia Computer Science
oaire.citation.volume100
oaire.versionhttp://purl.org/coar/version/c_970fb48d4fbd8a85
person.familyNameBasto-Fernandes
person.givenNameVitor
person.identifier.ciencia-id581C-52BB-AC4E
person.identifier.orcid0000-0003-4269-5114
person.identifier.ridN-1891-2016
person.identifier.scopus-author-id53363129900
relation.isAuthorOfPublicationfb2d3703-9d6a-4c22-bbc4-9ff14c162feb
relation.isAuthorOfPublication.latestForDiscoveryfb2d3703-9d6a-4c22-bbc4-9ff14c162feb

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
1-s2.0-S1877050916324309-main.pdf
Size:
187.09 KB
Format:
Adobe Portable Document Format
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
1.32 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

ESTG - Artigos em revistas internacionais