VALIDATING A CYBER SECURITY RISK-INFORMED DECISION MODEL: WISHES AND REALITY

摘要

Cyber security is a field in which it is especially difficult to obtain experts' insights and gather data. This paper discusses the challenges of development and validation of a cyber security risk-informed decision model. Model validation is necessary to ensure that a model reflects the system being represented and is crucial for users of the model to trust it. However, sound and convincing validation is difficult to achieve. Reasons include unavailability of experts to give their insights, or unavailability of data. Validation is even more challenging in the field of cyber security, in which there is a mistrust regarding anyone who is attempting to capture experts' insights or obtaining data. In this paper, we highlight the challenges of model validation and present our approach to achieve validation, although imperfect, of a cyber security decision model. This validation is based on three years of collaboration with the Director of Security at the University of Maryland (UMD), on interviews and surveys of experts, and on security data collected at UMD.