Quantitative Evaluation of Risk for Investment Efficient Strategies in Cybersecurity: The QuERIES Methodology

Organizations in both the private and public sectors have been struggling to determine the appropriate investments to make for protecting their critical intellectual property. As a result, cybersecurity investment strategies at the macro level (overall strategic investment in systemor enterprise-wide protection) and the micro level (how to allocate the tactical security elements across components of a system or enterprise) have typically been implemented without guidance from a rigorous, quantitative risk assessment and mitigation methodology. Simple questions such as "Are we investing enough?", "What security will have the most impact?" and "How much better is our security now?" are currently difficult to answer [Sanders et al. 2006]. Quantitative Evaluation of Risk for Investment Efficient Strategies (QuERIES) is a novel computational approach to quantitative cybersecurity risk assessment that was designed to answer such questions. It is based on rigorous and quantitative techniques drawn from computer science, game theory, control theory and economics. Preliminary experiments have corroborated the QuERIES methodology, suggest-