Dynamic Risk Mitigation in Computing Infrastructures

In this brief paper, we formulate a novel analytical framework for modeling and mitigation of dynamically changing security risk profiles in information systems and networks. Risk accumulates at components/nodes (hosts, servers, databases, etc.) due to risk shocks hitting them (virus, worm attacks, etc.) and is monitored by risk indicators. The risk manager dynamically chooses defenses by reconfiguring and allocating available protection resources to various infrastructure components/nodes. The issue is to dynamically control risk by (re)deploying defenses on the spot in response to changing risk indicators. The framework is designed to parallel queuing modeling ones, mapping backlog/congestion to risk level/stress. This exposes interesting connections between dynamic risk management and queueing systems. It also allows for leveraging some results of congestion management for risk mitigation, as well as developing new ones to capture risk management performance tradeoffs.