Correlated failures, software diversification and information security risk management.

摘要

This dissertation introduces mechanisms that can help mitigate, transfer and absorb risks associated with failure of information systems. Since information systems form an integral part of our society, from e-commerce to e-voting, I believe it is essential to develop mechanisms that ensure their resilience. In this dissertation, I highlight the problem of correlated failure of information systems that occurs mainly due to the homogeneity of the existing hardware and software infrastructure. I then analyze this problem from the point of view of a firm, an insurer and attackers.;This dissertation is organized into five chapters. The first chapter introduces the problem of information security and its various facets. Chapter 2 addresses this problem from the perspective of a typical firm attempting to ensure resilience of its systems in the face of outside attacks. Chapter 3 looks at it from the view point of an insurer providing cyber-insurance to such firms. Chapter 4 studies correlation in attacks based on empirical data and compares the effectiveness of various defensive techniques in tackling it. Finally, Chapter 5 focuses on the strategy of attackers, which often is the root cause of failure of information systems.