Title :
The Cyber Security Modeling Language: A Tool for Assessing the Vulnerability of Enterprise System Architectures
Author :
Sommestad, Teodor ; Ekstedt, Mathias ; Holm, Hannes
Author_Institution :
R. Inst. of Technol., Stockholm, Sweden
Abstract :
The cyber security modeling language (CySeMoL) is a modeling language for enterprise-level system architectures coupled to a probabilistic inference engine. If the computer systems of an enterprise are modeled with CySeMoL, this inference engine can assess the probability that attacks on the systems will succeed. The theory used for the attack-probability calculations in CySeMoL is a compilation of research results on a number of security domains and covers a range of attacks and countermeasures. The theory has previously been validated on a component level. In this paper, the theory is also validated on a system level. A test indicates that the reasonableness and correctness of CySeMoL assessments compare with the reasonableness and correctness of the assessments of a security professional. CySeMoL´s utility has been tested in case studies.
Keywords :
inference mechanisms; probability; security of data; CySeMoL assessments; attack-probability calculations; cyber security modeling language; enterprise-level system architectures; probabilistic inference engine; Computer architecture; Computer security; Databases; Probabilistic logic; Software; Systems engineering and theory; Computer security; expert systems; risk analysis; supervisory control and data acquisition (SCADA) systems;
Journal_Title :
Systems Journal, IEEE
DOI :
10.1109/JSYST.2012.2221853