Abstract:In the dynamic cyber threat landscape, effective decision-making under uncertainty is crucial for maintaining robust information security. This paper introduces the Cyber Resilience Index (CRI), a threat-informed probabilistic approach to quantifying an organisation's defence effectiveness against cyber-attacks (campaigns). Building upon the Threat-Intelligence Based Security Assessment (TIBSA) methodology, we present a mathematical model that translates complex threat intelligence into an actionable, unified metric similar to a stock market index, that executives can understand and interact with while teams can act upon. Our method leverages Partially Observable Markov Decision Processes (POMDPs) to simulate attacker behaviour considering real-world uncertainties and the latest threat actor tactics, techniques, and procedures (TTPs). This allows for dynamic, context-aware evaluation of an organization's security posture, moving beyond static compliance-based assessments. As a result, decision-makers are equipped with a single metric of cyber resilience that bridges the gap between quantitative and qualitative assessments, enabling data-driven resource allocation and strategic planning. This can ultimately lead to more informed decision-making, mitigate under or overspending, and assist in resource allocation.
What problem does this paper attempt to address?
The main problem that this paper attempts to solve is the deficiencies of current network security assessment methods in the face of dynamic and uncertain network threats. Specifically, traditional risk assessment methods are often too static to fully cope with the rapidly changing network threat environment and lack effective mechanisms to integrate and quantify cyber threat intelligence (CTI). This makes it difficult for decision - makers to obtain a unified and actionable metric to evaluate and enhance the organization's cyber - security resilience.
To this end, the author proposes the **Threat - Informed Cyber Resilience Index (CRI)**, which is a probability - based quantitative method for measuring an organization's defense effectiveness against cyber - attacks (especially attack activities). CRI draws on the **Threat - Intelligence Based Security Assessment (TIBSA)** method and simulates the actual behavior of attackers through Partially Observable Markov Decision Processes (POMDPs), taking into account the uncertainties in the real world and the latest tactics, techniques and procedures (TTPs) of threat actors. This method enables organizations to evaluate their security posture dynamically and in context, going beyond static compliance assessment.
### Core Objectives of CRI
1. **Provide a Unified Metric**: CRI aims to provide organizations with a single, unified metric similar to a stock market index, enabling management to understand and interact with it, while allowing teams to take action accordingly.
2. **Enhance Decision - making Capacity**: By transforming complex threat intelligence into specific and actionable indicators, CRI helps decision - makers better carry out data - driven resource allocation and strategic planning, thus making more informed decisions and avoiding over - or under - investment of resources.
3. **Real - time Evaluation and Improvement**: CRI provides a real - time cyber - security resilience score, reflecting the effectiveness of current security measures against the latest threats, supporting continuous improvement and immediate decision - making.
### Mathematical Modeling
To calculate CRI, the author uses the POMDP model to simulate the attacker's decision - making process. The following are the main components of the POMDP model:
- **State (S)**: Represents different security states of the network, such as whether a node has been breached.
- **Action (A)**: Actions that an attacker may take, such as sending phishing emails, executing malicious attachments, etc.
- **Observation (O)**: Results that an attacker may observe after taking an action, such as success, failure, being blocked, etc.
- **Transition Probability (T)**: The probability of transitioning from one state to another, given a certain action.
- **Observation Probability (O)**: The probability of observing a specific result after taking a certain action in a given state.
- **Reward (R)**: Rewards associated with state - action pairs, reflecting the likelihood of a successful attack.
- **Initial Belief State (b₀)**: The probability distribution of each state in the initial state.
Through these elements, the POMDP model can simulate attack sequences and defense responses, thereby automatically calculating the probability of a successful attack \( P \), and then deriving the CRI value.
### Formula Representation
For each attack flow \( af \in AF \), the CRI calculation formula is as follows:
\[
\text{CRI}(af)=\max(CRI(af_1),\ldots,CRI(af_n))
\]
where \( CRI(af_i) \) is the cumulative probability value for a specific attack flow \( af_i \), calculated as follows:
- If there is a sequential relationship between two nodes \( N_1 \) and \( N_2 \), the cumulative probability is:
\[
P_{\text{cumulative}} = P_1\times P_2
\]
- If there is a parallel relationship between two nodes \( N_1 \) and \( N_2 \), the cumulative probability is:
\[
P_{\text{cumulative}}=\max(P_1, P_2)
\]