Using statistical simulations to analyze uncertainty in computer security investments, mitigations and vulnerabilities

Models facilitate the analysis of secured computing systems. Models have been developed to establish or refute a system's safety, the owner's exposure to damage, and the opportunities for mitigating vulnerabilities. When the resources available for a system's mitigations are constrained, and the owners must accept some risk, models offer an attractive tool for prioritizing the mitigation opportunities. However, models often rely upon expert estimates for some or all of their parameters, and these estimates introduce uncertainty into the model's forecast. This research introduces three approaches for quantifying uncertainty about computer security incidents.;The first approach introduces Monte-Carlo Probabilistic Risk Assessment techniques for computer security analysis including a system-level financial model for information security investments and the system-level Risk Analysis and Probabilistic Survivability Assessment (RAPSA). The second approach introduces Monte-Carlo graphical techniques for computer security analysis including a weighted vulnerability graph and the Take-Grant Protection System. The Monte-Carlo approaches capture uncertainty about the modeling parameters with user-supplied probability distributions and simulate how this uncertainty impacts the resulting forecasts.;While the selection and configuration of probability distributions is wide-spread in the Risk Analysis field, they require expert estimates for both the choice and the configuration of each distribution. Uncertainty about these estimates can also be simulated by the Monte-Carlo approach, but could there be an alternative to the resulting chain of uncertainty? The third approach introduces evidence for a Self-Organized Criticality (SOC) process underlying the complex dynamics in a record of malware attacks on the Internet. An SOC system autonomously develops a structure or pattern independent of any controlling input parameters by evolving to a configuration near a critical point. This research also demonstrates that a lattice model displaying SOC behaviors can simulate temporal and spatial power-laws observed in a record of Internet malware attacks.