Affiliations: [a] Department of Computer Science, University of Idaho, Moscow, ID, USA. E-mails: conr2286@uidaho.edu, jimaf@uidaho.edu | [b] Department of Statistics, University of Idaho, Moscow, ID, USA
Correspondence:
[*]
Corresponding author: J.R. Conrad, 5350 W. Banker Dr., Boise, ID 83714, USA. Tel.: +1 208 573 6450.
Abstract: We introduce TG/MC, a Monte Carlo approach for evaluating the impact of uncertainty about vulnerabilities upon forecasts of security for a real-world system modeled by a protection graph. A TG/MC model defines a vulnerability as a potential change to an otherwise safe initial protection graph that, if exploited, leads to an unauthorized state, a violation of the system's security policy through the application of TG rules. TG/MC captures uncertainties about vulnerabilities as probability distributions and forecasts the probability of a specific security violation. TG/MC extends beyond the rigid yes/no analysis of safety in a TG protection graph to consider uncertainty in questions of security for real-world systems.
Keywords: Take-Grant, TG, protection graph, Monte Carlo, security
