Present the Ability of Risk Approaches to Adapt to Technology Evolution

Risk Analysis, Vol. 39, No. 9, 2019 DOI: 10.1111/risa.13269

A Robust Approach for Mitigating Risks in Cyber Supply Chains

Kaiyue Zheng1 and Laura A. Albert 2,∗

In recent years, there have been growing concerns regarding risks in federal information tech- nology (IT) supply chains in the United States that protect cyber infrastructure. A critical need faced by decisionmakers is to prioritize investment in security mitigations to maximally reduce risks in IT supply chains. We extend existing stochastic expected budgeted maximum multiple coverage models that identify “good” solutions on average that may be unaccept- able in certain circumstances. We propose three alternative models that consider different robustness methods that hedge against worst-case risks, including models that maximize the worst-case coverage, minimize the worst-case regret, and maximize the average coverage in the (1 − α) worst cases (conditional value at risk). We illustrate the solutions to the robust methods with a case study and discuss the insights their solutions provide into mitigation selection compared to an expected-value maximizer. Our study provides valuable tools and insights for decisionmakers with different risk attitudes to manage cybersecurity risks un- der uncertainty.

KEY WORDS: Cybersecurity; infrastructure risk mitigation; robust optimization

1. INTRODUCTION

Reliance on a global supply chain introduces enormous cybersecurity risks to the information technology (IT) in the United States, including risks due to counterfeit materials, malicious software, unqualified vendors, and poorly trained employees. Cybersecurity risks in the federal IT supply chains have increased dramatically in recent years (Director of National Intelligence, 2015; U.S. Government Accountability Office, 2013). According to a 2015 Government Accountability Office report (2015), the number of reported cyber incidents has increased 1,121% between 2006 and 2014. The White House (2013a, 2013b) proposed new policy directives for securing critical IT physical assets that reflect the

1Amazon, Seattle, WA, USA. 2University of Wisconsin–Madison, Madison, WI, USA. ∗Address correspondence to Laura A. Albert, Industrial and Sys- tems Engineering, University of Wisconsin–Madison, Madison, WI 53706, USA; tel: +1-1-608-262-3002; [email protected].

awareness of the increasing concern of cyber security in critical infrastructure and for directing federal funding to develop mitigation approaches for global supply chain risk management (2015). There is great interest in studying how to prioritize the investment in security mitigations to balance cost and threat reduction, since federal agencies have a limited budget for selecting and deploying mitigations (Hamlet et al., 2015). Moreover, cyber risks stem from various sources, vary in their forms, and vary in their severity of impact, which makes these risks very difficult to assess and analyze (Edwards, Kao, Hamlet, Bailon, & Liptak, 2016). Effort has been made toward assessing the risks in federal IT supply chains (Hamlet et al., 2015; The White House, 2016). However, comprehensive security policies and mit- igations have not been developed and implemented (U.S. Government Accountability Office, 2015). Therefore, there is a need to identify policies that systematically design cost-effective processes for reducing the risk introduced by supply chains.

2076 0272-4332/19/0100-2076$22.00/1 C© 2019 Society for Risk Analysis

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2077

Federal organizations’ IT infrastructure rely on a complex network of third-party suppliers, and some attacks against IT networks originate in supply chains. Adversarial attacks in IT supply chains target weak links in the supply network, including activities involved in handling, distributing, manufacturing, and processing. For example, as one of the largest data breaches in the private sector, more than 40 mil- lion Target customers’ payment cards were stolen in 2013 after malware was introduced into the retailer’s point of sale (POS) system. The initial intrusion to Target’s main system can be traced back to a third-party heating, ventilation, and air conditioning (HVAC) vendor (supplier), where attackers ex- ploited a vulnerability in its remote diagnostics and stole network credentials (Krebs, 2014). It is believed that another large retailer, Home Depot, which expe- rienced credit card breaches in 2014, traced its initial security breach to a third-party vendor (Kirk, 2014). Automated teller machine (ATM) malware attacks in recent years are another example of a supply chain attack. In 2014, the so-called Tyupkin malware affected ATMs from a major manufacturer running Microsoft Windows’ 32-bit operating system, and spread to several countries including Russia, the United States, India, and China (Kaspersky Lab, 2014). Federal IT infrastructure faces similar risks brought by the globalization and increasing sophisti- cation of supply chains. Public information regarding federal supply chain attacks is limited due to confi- dentiality. One published incident is the data breach of the U.S. Office of Personnel Management (OPM) in 2015, when over 22 million federal employees’ information was hacked. Investigation shows that the attackers likely exploited the vulnerability in a third-party background-check provider, KeyPoint Government Solutions, by stealing credentials and inserting malware.

To reduce cyber risks in the supply chain, deci- sionmakers need to design a cost-effective process to support supply chain risk management to systemat- ically prevent IT infrastructure from being exposed to new risks. This process supports policy-level de- cisions for reducing risk across the supply chain life cycle, not merely acquisition decisions. Examples of IT supply chain mitigations include replacing physi- cal components of the IT infrastructure that contain vulnerabilities, replacing malicious or unqualified vendors, requiring tamper-proof components, estab- lishing security policies or procedures, and training employees. The National Institute of Standards and Technology (NIST) provides guidance to federal

agencies for identifying, assessing, and implementing risk management processes and controls to proac- tively manage supply chain risks (2015). This article explores how to operationalize these recommenda- tions by formulating models that identify a set of security controls that are cost effective, reduce risk, and are robust to uncertainty or the role of adaptive adversaries. These security controls form the basis of a secure process to inform best practices. The process design decisions studied in this article are updated periodically, such as yearly, and are separate from response and recovery decisions, such as installing software updates to patch known software vulnera- bilities, and real-time intrusion-detection decisions.

This article builds upon initial work in this area by Zheng, Albert, Luedtke, and Towle (2018), who propose deterministic and stochastic budgeted max- imum multiple coverage models (MaxCoverage and MaxExpCoverage, respectively) that investigate how to identify the best combination of mitigations to maximize the coverage of vulnerabilities in the sys- tem with a layered defense. These models generalize the maximal covering location problem (Church & ReVelle, 1974) and the maximal expected cover- age location problem (Daskin, 1983) by explicitly considering the steps taken to carry out a complete attack on system vulnerabilities. Accordingly, they model attacks as “attack paths,” each of which contains multiple nodes that represent the vulnera- bilities (exploits) required to successfully carry out an attack. Attack paths are used to characterize the possible attacks against a system and identify protections against such attacks (Mauw & Oostdijk, 2006). An attack path could capture the threat of hardware delivered with malware installed on it after the hardware is intercepted from legitimate suppliers. Two of the possible vulnerability nodes on this attack path could represent stealing the hard- ware’s shipping information and breaching a cargo container shipping the hardware. Mitigations that prevent a vulnerability from being exploited are said to “cover” the vulnerability. Mitigations sometimes have overlapping capabilities and mutually affect the same vulnerabilities. Additionally, some mitigations do not prevent a vulnerability as expected and may “fail,” which occurs because cyber threats have evolved or subject matter experts (SMEs) do not manage to accurately assess the effectiveness of the mitigations (Edwards et al., 2016).

In the expected-value stochastic model (Max- ExpCoverage), random variables characterize two states of the mitigation coverage, effective

2078 Zheng and Albert

or ineffective. Zheng et al. (2018) show that the stochastic solution tends to select mitigations that cover vulnerabilities multiple times, so that they are likely to remain covered in the case when some mitigations are not effective as anticipated. By maximizing the expected coverage over all scenarios, MaxExpCoverage provides a solution that performs well on average, i.e., a solution that is satisfactory in most scenarios when uncertainty regarding mitigation effectiveness arises. However, an expected-value model like MaxExpCoverage does not always provide solutions that prepare the system against worst-case scenarios. It is possible that a combination of mitigations could not prevent vulnerabilities as intended and leaves the system unacceptably vulnerable to a serious attack. As a result, expected-value solutions might lead to actual situations that are unacceptable for decisionmakers.

To address these limitations, we introduce and compare three robust models that extend MaxExp- Coverage to capture risk associated with uncertain mitigation performance. A mitigation “fails” if it is ineffective and does not in actuality cover the vulnerability node. We model the effectiveness of a mitigation covering a vulnerability node as a binary random variable that is only known to the decisionmaker through a probability mass distribu- tion with a finite probability space or a finite set of scenarios. Therefore, the mitigation uncertainty is considered through the coverage functions. The goal is to compare and contrast risk-based models for cyber security planning in their ability to identify robust ways to prioritize the selection of mitigations. The models inform decisions regarding how to use a budget to select a portfolio of mitigations that is robust to worst-case failures over uncertainties in the performance of the mitigations.

First, we consider two of the most common robustness measures in a maximization context: maximizing the minimal coverage across all sce- narios, and minimizing the maximal regret across all scenarios. Both measures are robust in that they are “distribution-free” and focus only on the worst-case performance of the system regardless of the probability distribution that represents the un- certainty. Regret is defined for each scenario as the difference between the coverage of a solution in that scenario and the coverage of the optimal solution for that single scenario. This involves presolving the problem for each individual scenario to obtain a corresponding optimal solution, which can be seen as the best strategy that would have been selected

if this realization of the future occurred. Therefore, regret is often interpreted as the opportunity loss for an uncertain future.

Moreover, we are interested in the conditional value at risk (CVaR), a popular risk measure in stochastic programming (Ahmed, 2006). CVaR is defined as the expected loss in the α worst-case tail of the loss distribution, initially proposed to quantify the risk for loss in finance (Rockafellar & Uryasev, 2000, 2002). CVaR is coherent and computationally tractable through linear programming techniques. In our context, CVaR is the expected coverage in the (1 − α) worst-case scenarios. Compared to max-min coverage and min-max regret, the quantile-based CVaR measure is less pessimistic, since it provides solutions that are robust to the worst cases and also captures the magnitude of the coverage in the worst cases. Unlike maximizing the minimal coverage and minimizing the maximal regret, CVaR is not distribution-free. By varying the confidence level α, the decisionmaker can select a solution corresponding to different risk preferences, with α = 1 being totally risk conservative and α = 0 being totally risk neutral.

1.1. Literature Review

Robust optimization methodologies provide a useful analytical framework for homeland security applications given their practical advantages. Robust methods typically require as input a set of realiza- tions of the uncertain parameters, not an explicit probability distribution as in stochastic optimization and, therefore, robust methods have a clear advan- tage in homeland security applications where many of the model inputs rely on the estimation from the SMEs who have limited knowledge of the problem, its inputs, and associated probability distributions. Robust optimization has been a powerful and popular tool for decision making in different areas, such as supply chain disruption planning (Snyder, Scaparra, Daskin, & Church, 2006) and adversarial risk analysis (McLay, Rothschild, & Guikema, 2012). We refer to Bertsimas, Brown, and Caramanis (2010) for a recent review on robust optimization that highlights its computational tractability and broad range of application, and Ben-Tal, Ghaoui, and Nemirovski (2009) for a textbook treatment.

We include CVaR in our robust method frame- work, since it also provides risk insights for a robust decisionmaker who wants to maximize the per- formance for a set of worst-case scenarios. Unlike

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2079

robust optimization, CVaR requires an estimation of probability distributions. Chen, Daskin, Shen, and Uryasev (2006) apply CVaR to a facility location problem where they compare the model and its com- putational efficiency to earlier models that feature an α-reliable min-max regret model (Daskin, Hesse, & ReVelle, 1997) and demonstrate the advantage of CVaR. Noyan (2012) incorporates CVaR in a two- stage stochastic disaster preparedness management problem, where a weighted sum of expected value and CVaR is optimized to determine the facility lo- cations, and their corresponding inventory levels are determined under different types of uncertainties. Our study similarly demonstrates the applicability of CVaR in robust decision making.

Robust optimization methods have been applied to coverage problems. Church, Scaparra, and Mid- dleton (2004) propose and formulate an interdiction covering problem (RIC) and interdiction median problem (RIM) that identify the most critical fa- cilities whose loss leads to the most damage to the system. The facilities are analogous to mitigations in our article. Scaparra and Church (2008a, 2008b) extend the interdiction median problem to consider a fortification layer that identifies the subset of facilities to fortify to protect against worst-case interdiction of the unfortified facilities. They formu- late the interdiction-fortification model as a bi-level defender–attacker Stackelberg game and identify a tree search algorithm (2008a) and an interval search algorithm (2008b) for solving the interdiction model. Scaparra and Church (2012) introduce a tri-level fortification and interdiction problem to inform disaster mitigation planning. The interdiction papers study a system’s vulnerability due to the worst-case combination of failures, which could occur due to the actions of an adversary. In contrast, in this article, we consider mitigation failure scenarios that could reflect uncertainty in the mitigations’ effectiveness due to SME estimation errors, SME misperceptions of the mitigations’ level of control, or the decision of an adversary who selects a scenario instead of a combination of mitigation failures.

1.2. Contribution

The central contribution of this article is to intro- duce and assess models for managing risk associated with cyber security planning decisions. These models apply robust coverage models to a new application area to inform supply chain risk management and planning decisions that are cost effective and reduce

worst-case risks introduced by adversaries. We com- pare three robust models that address uncertainty in mitigation effectiveness that together form a risk analysis framework for a robust decisionmaker, and we compare these models to an expected coverage model. The robust methods are more conservative to worst-case risks than an expected-value maxi- mization model, and thereby provide insight into planning for the risks introduced by adversarial attacks or disastrous events, which is important in security applications like cyber security, where incidents often lead to tremendous loss and damage.

The robust optimization models provide insight into a defensive stance against adversarial attacks by assuming the adversary (e.g., hackers, criminal groups, nations, terrorists, etc.) is limited to select the worst-case attack scenario(s). Earlier research that applies expected coverage models to cyber secu- rity planning problems does not consider the impact of an adaptive adversary. Decisionmakers can gain practical insights quickly from the robust methods without the need to quantify the adversarial attacks in cyber infrastructure, which can be very challenging given lack of information (e.g., attacker profiles), or solve two-stage interdiction models (Morton, 2010; Smith, Prince, & Geunes, 2013; Scaparra & Church, 2008b), which can be computationally intensive.

Each robust method provides a different per- spective into interpreting the worst-case response, which can be employed by decisionmakers to eval- uate the tradeoffs and select the solution that best suits their goals. The robust model solutions provide decisionmakers with a set of solutions, which is often more useful in practice than a single “best” solution. The first two worst-case robust methods, i.e., maxi- mizing the worst coverage and minimizing the worst regret, do not require an explicit distribution of the uncertain parameters, which makes them practical for homeland security problems. However, their solutions are sensitive to the uncertainty scenarios selected. The third robust method, maximizing the expected coverage in the (1 − α) worst cases, can be seen as a combination of the worst-case risk measure and the expected-value measure. It allows decision- makers the flexibility to obtain a solution with their desired risk preference by adjusting α. Moreover, the solutions are less sensitive to the uncertainty scenar- ios selected, particularly for relatively small values of α. This is advantageous in that it yields model so- lutions that are useful for informing policy decisions.

We proceed as follows. In Section 2, we first describe the MaxExpCoverage model in Zheng et al.

2080 Zheng and Albert

(2018) and introduce the robust coverage models that maximize the worst-case coverage, minimize the worst-case regret, and maximize the expected coverage in the (1 − α) worst case, respectively. In Section 3, we illustrate the model solutions and insights with a case study. We provide additional computational results conducted on a variety of instances to further demonstrate the differences be- tween proposed models and provide insight into the types of solutions the models could yield in different settings. In Section 4, we summarize the article.

2. THE ROBUST COVERAGE MODELS

In this section, we introduce and compare the fol- lowing four models:

1. a model that maximizes the expected cover- age across all scenarios, denoted MaxExpCov- erage;

2. a model that maximizes the worst-case cover- age across all scenarios, denoted MaxMinCov- erage;

3. a model that minimizes the maximal regret across all scenarios, denoted MinMaxRegret;

4. a model that maximizes the conditional ex- pected coverage that does not exceed a prespecified quantile level in the coverage (CVaR), denoted MaxCVaR.

Attack scenario modeling is an important first step in cyber security planning. In classic network vulnerability analysis, SMEs construct attack trees or attack graphs (Mauw & Oostdijk, 2006; Schneier, 1999) to characterize possible attacks and to identify security controls to reduce risk. In the attack trees, nodes represent attack states and arcs represent transition of states completed by attack exploits. A path from root to leaf corresponds to a likely attack against the system. An attack tree is a powerful tool to organize vulnerabilities in a system and to visual- ize their dependencies. Attacks on IT supply chains can be constructed in a similar manner, which also corresponds to the recommendations of NIST (2015) for a more structured approach to represent supply chain threat scenarios. It is worth mentioning that an extension of attack trees with countermeasures, called the attack–defense trees, has been proposed and formalized (Kordy, Mauw, Radomirović, & Schweitzer, 2011). Kordy and Widel (2017) integrate attack–defense trees with integer programming

to optimize the selection of countermeasures for securing a system.

Cyber attackers exploit vulnerabilities in IT supply chains and usually take several exploits to achieve attack goals. In this article, we use attack paths to represent supply chain attacks with multiple nodes on each of them representing the attack steps (exploits). Attack paths can be easily enumerated from an attack tree. Input from collaborators sug- gests that the size of attack trees for this application is anticipated to be moderate, since there are limited opportunities or access points for influence and control in the supply chains under consideration. Let S be a set of attack paths recognized by SMEs, each of which contains a subset of vulnerability nodes Ns , s ∈ S with

⋃ s∈S Ns = N the entire set of

nodes. Some attack paths may have more strategic importance due to their potential consequences if successful and, therefore, we let as capture the importance (weight) of attack path s ∈ S.

Let M be the set of applicable mitigations iden- tified by SMEs, and Mn be the subset of mitigations that cover node n ∈ N. A vulnerability node is said to be protected if it is covered by at least one mitiga- tion. A layered defense is achieved through multiple coverage of an attack path, i.e., covering different nodes in an attack path. We define a general cover- age function fs (·) to quantify the coverage of attack path s ∈ S with respect to the number of nodes cov- ered on it. We assume that it is nondecreasing and concave, since better security is achieved when more nodes are covered and the marginal benefit from covering more nodes is decreasing. Additionally, we associate each mitigation m ∈ M with a cost bm that captures its deployment and implementation. Let the total budget for selecting mitigations be B.

Inputs for the models are based on SME elicita- tion. The attack paths can be constructed with the aid of SMEs, which yields N, S, Ns , s ∈ S, and as , s ∈ S. Similarly, the mitigations that control each node, Mn, n ∈ N, can be obtained through SME elicitation. Coverage functions are desirable for this application, since they reduce the SME data elicitation burden while also capturing the most salient aspects of the application. Coverage functions could be constructed from relative risk scores based on data collected from stakeholders and SMEs via questionnaires, where the data reflect risk indicators such as control, exposure, and criticality (Edwards et al., 2016). A coverage function could be constructed from the data by exam- ining how an improvement in any risk indicator over a base level, which could be achieved by a mitigation

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2081

“covering” a node, would decrease the relative risk score by, say, increased control over an entity or step. Additionally, the risk scores are relative scores and could therefore be mapped onto a coverage level scaled between 0 and 1. The set of mitigations M, their costs bm, m ∈ M, and total budget B can be ob- tained from federal decisionmakers, managers, and experts who are familiar with the mitigation options available and have estimates of their associated costs.

Mitigation coverage may “fail”—meaning that coverage is not realized—due to uncertain miti- gation coverage or limited knowledge SMEs have about their effectiveness. We consider a set of realizations of mitigation effectiveness |�|, where the corresponding random variable ξ ωmn is equal to 1 if the coverage of m ∈ M on node n ∈ N is effective in scenario ω, and 0 otherwise. We assume that each scenario ω ∈ � occurs with probability pω ∈ [0, 1], ω ∈ � with ∑

ω∈� p ω = 1. Information

collected by SMEs can be used to construct a set of realizations for mitigation effectiveness ξ ωmn, ω ∈ � and their associated probabilities pω ∈ [0, 1], ω ∈ � with

∑ ω∈� p

ω = 1, potentially by sampling. All models use a common set of decision vari-

ables, which are defined as follows:

� xm = 1 if mitigation m ∈ M is chosen, and 0 oth- erwise;

� zωn = 1 if node n ∈ N is covered by at least one selected mitigation under scenario ω ∈ �, and 0 otherwise;

� yωs = the number of nodes in attack path s ∈ S that are covered under scenario ω ∈ �.

The expected coverage maximization model, MaxExpCoverage, which corresponds to the SAA- EBMMC model in Zheng et al. (2018), is formu- lated below.

MaxExpCoverage:

max ∑ ω∈�

pω ∑ s∈S

as fs (y ω s ) (1)

s.t. yωs ≤ ∑ n∈NS

zωn , s ∈ S, ω ∈ �, (2)

zωn ≤ ∑

m∈Mn ξ

ω mn xm, n ∈ N, ω ∈ �, (3)

∑ m∈M

bmxm ≤ B. (4)

xm ∈ {0, 1}, m ∈ M (5)

zωn ∈ {0, 1}, n ∈ N, ω ∈ � (6)

The objective function in (1) is the expected value of the total coverage of all attack paths across all scenarios. This nonlinear function can be easily linearized by adding new variables and constraints; see Zheng et al. (2018) for details. Constraint set (2) sets the value of yωs , the number of nodes covered in attack path s ∈ S in scenario ω ∈ �, and constraint set (3) states that node n ∈ N is covered in scenario ω ∈ � (i.e., zωn = 1) if there exists at least one se- lected mitigation that covers it. Constraint (4) is the budget constraint. Constraint sets (5) and (6) require the x and z variables to be binary.

MaxExpCoverage returns a solution that performs well on average. However, its actual per- formance could be unacceptable to decisionmakers for some realizations of ξ if it yields extremely low coverage in a few scenarios to achieve a better expected coverage across all scenarios. Therefore, we are motivated to identify robust solutions that avoid worst-case performance. The following ro- bust models address the uncertainty from different perspectives and identify solutions that plan for different risk situations.

In the first robust model, we aim to identify a solution that has the best worst-case performance across all scenarios. Denote variable u as the min- imal coverage across all scenarios. We present the following model, MaxMinCoverage, that maximizes the worst-case coverage.

MaxMinCoverage:

max u (7)

s.t. u ≤ ∑ s∈S

as fs (y ω s ), ∀ω ∈ �. (8)

(2)−(6)

The minimal coverage u across all scenarios, as defined by constraint (8), is maximized in the objective (7). This measure is often considered to be overly pessimistic by evaluating only the most extreme scenario, regardless of the coverage in other scenarios. We list two examples when MaxMinCoverage is overly pessimistic. First, if the worst-case scenario occurs with an extremely small probability but requires an expensive mitigation to cover, MaxMinCoverage would suggest selecting this mitigation even when the coverage in most scenarios is high. Second, consider the case when there are several equivalent worst-case scenarios that employ different sets of mitigations. If the total budget is

2082 Zheng and Albert

not enough to select all required mitigations, the resulting minimal coverage is not improved after ex- hausting the entire budget. Meanwhile, coverage in most scenarios is neglected in this decision process.

While MaxMinCoverage allocates mitigations to improve the worst-case scenarios, these scenarios might not “demand” the most defensive resources. In the case when the worst-case coverage is only improved by a small amount in a MaxMinCoverage solution, it is likely that other scenarios can benefit more from the same amount of budget. This is the motivation for the following robust model that aims to prioritize mitigations toward the scenarios with the greatest regret. Regret is defined for each scenario as the difference between the coverage of a solution in that scenario and the coverage for that single scenario in the optimal solution. To calculate the regret, we need to presolve the optimal solution for each scenario. The subproblem is a deterministic MaxCoverage problem that can be solved quickly by a general-purpose solver (Zheng et al., 2018). Let g∗(ω) capture the optimal subproblem objective function value when scenario ω ∈ � is realized, and let r capture the maximal regret across all scenarios. This new model, MinMaxRegret, minimizes the maximal regret across all scenarios.

MinMaxRegret:

min r (9)

s.t. g∗(ω) − ∑ s∈S

as fs (y ω s ) ≤ r, ∀ω ∈ �. (10)

(2)−(6)

The maximal regret, defined in constraint set (10), is minimized in the objective (9). The left-hand side of constraint set (10) computes the regret for each scenario, i.e., the difference between the cov- erage of a solution in that scenario and the coverage of the optimal solution for that single scenario, which is different from MaxMinCoverage where mitigations are allocated to improve the coverage of the worst-case scenarios. MinMaxRegret allocates mitigations to the scenarios with the greatest regret, i.e., the scenarios whose coverage can be improved the most given the same budget. MinMaxRegret is related to MaxMinCoverage in that they are both worst-case risk models. They both neglect the tail distribution of the uncertain events and the magnitude of the worst-case scenarios, both of which may be important to decisionmakers under

certain circumstances. To address this issue, we introduce CVaR. CVaR considers the worst-case scenarios, which are overlooked by MaxExpCov- erage, and it also assesses the coverage in the tail distribution of the uncertainty, which is overlooked by MaxMinCoverage and MinMaxRegret.

VaR and CVaR are risk measures of loss func- tions widely used in the finance and insurance indus- tries. In a traditional minimization context, VaRα is the α-quantile of the cost distribution and CVaRα is the conditional expected cost exceeding VaRα , where α is a quantile specified by the decisionmaker. As the financial market fluctuates often and can be highly unpredictable, VaR and CVaR help decision- makers manage the likelihood of loss caused by cer- tain types of risks. This makes VaR and CVaR useful tools for managing cyber risks, since cyber threats evolve constantly and are hard to predict. VaR helps to mark the boundary between normal and extreme outcomes, in addition to which CVaR assesses the conditional expected coverage in the tail distribution and provides a less conservative robust solution.

Given the maximization context in this article, we redefine VaRα as the (1 − α)-quantile of the coverage distribution and CVaRα as the expected coverage that does not exceed VaRα . Their formal definitions are presented as follows:

VaRα [g(x, ξ )] = sup { η|P(g(x, ξ ) ≥ η) ≥ α

}

CVaRα [g(x, ξ )] = E[g(x, ξ )|g(x, ξ ) ≤ VaRα (g(x, ξ ))]

= sup η

{ η − 1

1 − α E[(η − g(x, ξ ))+] } .

CVaR has many advantages compared to VaR. First, CVaR quantifies risks beyond VaR, and is coherent. More importantly, CVaR can be linearized and readily solved by a linear programming solver, which popularizes its application in operations research applications. We refer the readers to two seminal papers on CVaR optimization for more details (Rockafellar & Uryasev, 2000, 2002). We define additional variables νω, ω ∈ �, and η that help define and linearize CVaR, where η represents the VaRα and νω represents the coverage of scenario ω that does not exceed VaRα with νω = max{VaRα, 0}. The following model, MaxCVaR, maximizes CVaRα of the coverage across all scenarios.

MaxCVaR:

max η − 1 1 − α

∑ ω∈�

pωνω (11)

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2083

s.t. νω ≥ η − ∑ s∈S

as fs (y ω s ), ∀ω ∈ �, (12)

ν ω ≥ 0, ∀ω ∈ �. (13)

(2)−(6)

The objective function in (11) is the linearized CVaR, which is defined by constraints (12) and (13), and α is an user-defined parameter. A larger α implies a less risk-neutral solution. Notice that MaxCVaR is equivalent to MaxMinCoverage when α = 1, and it is equivalent to MaxExpCoverage when α = 0. The decisionmakers can adjust α according to their risk preferences. Therefore, MaxCVaR offers more flexibility to the decision process as compared to the previous three models.

3. ILLUSTRATIVE EXAMPLES

In this section, we compare and illustrate model insights with several examples. In the first subsection, we conceptually compare the four models visually with histograms that display the empirical distribu- tions over all scenarios associated with the optimal solution of the four models. Next, we present a case study based on realistic data to analyze the model solutions. All models were programmed in Python 2.7.10 and solved with Gurobi 6.0. The data instances were run on an Intel Core i5-3470 CPU at 3.20 GHz with 4 GB of RAM.

3.1. Visual Illustration

Fig. 1 provides a visual demonstration of the model solutions by illustrating the empirical his- tograms over the scenarios for each model. We con- struct a data instance for demonstrative purposes, with |M| = 20, |N| = 20, |S| = 10, |�| = 1, 000. We specify that each mitigation can cover up to three nodes and use a pseudo uniform random number generator to determine the list of nodes covered by each mitigation. We set the upper bound on the num- ber of nodes in each attack path to five and randomly generate a list of nodes in each attack path. Parame- ters as , s ∈ S and bm, m ∈ M are both generated using a pseudo uniform random number generator within ranges (0, 10) and (0, 1), respectively. The budget B is set to 5% of the total cost of all mitigations. The coverage function fs (·) for attack path s ∈ S is set to fs (·) = −(yωs )2 + 2|Ns |yωs as a function of ys , which is nondecreasing and concave as required. A sample

ξ ωmn, m ∈ M, n ∈ N, ω ∈ � with |�| = 1, 000, which captures coverage effectiveness, is drawn from the Bernoulli distribution with success probability 0.5.

In this simple illustrative example, MaxExp- Coverage, MinMaxRegret, and MaxCVaR select the same set of three mitigations (mitigations 6, 8, and 11), while MaxMinCoverage selects miti- gations 6, 11, and 20. The MaxExpCoverage and MaxMinCoverage histograms in Figs. 1(a) and (b) illustrate the empirical distribution of the attack path coverage,

∑ s∈S as fs (y

ω), over |�| = 1, 000 scenarios, which are associated with their optimal solutions, respectively. Comparing these two histograms, we can see the tradeoff clearly: MaxExpCoverage is more aggregated overall and achieves the best expected coverage, 351; however, the worst-case coverage associated with its optimal solution is 0. MaxMinCoverage, on the other hand, has a smaller expected coverage value, 325, associated with its optimal solution, and has a more scattered empirical histogram. However, its worst-case coverage, 15, improves upon that of MaxExpCoverage.

Fig. 1(c) illustrates the empirical distribution of the regret, g∗(ω) − ∑s∈S as fs (yω), over all scenarios that are associated with the optimal MinMaxRegret solution. The tallest bar on the left side of the figure indicates that 44 of the 100 scenarios have zero regret, which means the coverage achieved in those scenarios is the best they can achieve with the current set of available mitigations M. Most scenarios have regret smaller than 100. The worst-case regret is 322, which is the best maximal regret achieved with the optimal MinMaxRegret solution. Note that the scenario that achieves the worst regret in Fig. 1(c) is different from the scenario that achieves the worst coverage in Fig. 1(b). Finally, we plot the cumulative histogram of the coverage,

∑ s∈S as fs (y

ω), over all scenarios associated with the optimal MaxCVaR solution, in Fig. 1(d). We set α = 0.95 in this exam- ple. MaxCVaR maximizes the expected coverage in the 5% tail of the cumulative density function, i.e., E[g(x, ξ )|g(x, ξ ) ≤ VaR0.95(g(x, ξ ))]. The optimal CVaR value is 107, as marked in Fig. 1(d). We can see that the tail is relatively shorter and “thinner” compared to the other part of the distribution, indi- cating that MaxCVaR improves the tail performance of the solution.

3.2. Case Study

In this subsection, we compare the robust methods and illustrate the insights of their solutions

2084 Zheng and Albert

(a) Histogram of coverage associated with the optimal Max- ExpCoverage solution across all scenarios. The optimal ex-

pected coverage is 351.

(b) Histogram of coverage associated with the optimal MaxMinCoverage solution across all scenarios. The opti-

mal worst-case coverage is 15.

(c) Histogram of regret associated with the optimal Min- MaxRegret solution across all scenarios. The optimal max-

imal regret is 322.

(d) Cumulative histogram of coverage associated with the optimal MaxCVaR solution across all scenarios with α =

0.95. The optimal CVaR value is 107.

Fig. 1. Empirical distribution functions (histograms) associated with the optimal solution of MaxExpCoverage, MaxMinCoverage, Min- MaxRegret, and MaxCVaR, respectively.

with a case study. We base our study on two main data sets, each of which contains three instances, which consist of attack paths and mitigation controls. The first uses real-world data from the book by Shostack (2014) on attack modeling, where, in the appendix, the author presents 15 STRIDE attack trees, such as spoofing a client or tampering with a data flow, as well as mitigation approaches as-

sociated with each attack. The second set of data is randomly generated, following the same rule as presented in the last subsection for generating the example instance to gain additional insights. As public data of attack tree and mitigation for federal IT supply chain attacks are scarce, we believe that these two sets of data are sufficient to demonstrate the insights that the robust methods provide for

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2085

Table I. Cross-Comparison of Four Model Solution Values on Cyber Attack Data for Three Instances in Data Set 1

Exp. Cov. Min. Cov. Max. Reg. CVaR0.95 CVaR0.90 CVaR0.85

MaxExpCoverage 136.0 76.8 34.1 87.1 96.2 101.4 MaxMinCoverage 124.2 85.0 51.9 88.8 93.5 97.2 MinMaxRegret 131.7 82.4 30.4 91.0 95.8 100.2 MaxCVaR0.95 131.3 84.0 41.8 92.1 97.2 100.8 MaxCVaR0.90 130.7 79.2 36.8 89.4 97.5 101.2 MaxCVaR0.85 132.9 79.6 35.8 88.6 97.2 101.9

(a) |M| = 52, |N| = 103, |S| = 103, |�| = 100

Exp. Cov. Min. Cov. Max. Reg. CVaR0.95 CVaR0.90 CVaR0.85

MaxExpCoverage 140.3 95.2 39.0 101.1 105.8 109.1 MaxMinCoverage 134.5 99.0 47.8 100.5 103.1 104.9 MinMaxRegret 139.5 89.4 32.6 99.9 104.5 108.7 MaxCVaR0.95 139.1 95.0 39.3 104.3 107.6 110.3 MaxCVaR0.90 139.1 95.0 39.3 104.3 107.6 110.3 MaxCVaR0.85 139.1 95.0 39.3 104.3 107.6 110.3

(b) |M| = 52, |N| = 103, |S| = 103, |�| = 100

Exp. Cov. Min. Cov. Max. Reg. CVaR0.95 CVaR0.90 CVaR0.85

MaxExpCoverage 145.3 98.8 34.8 105.2 108.5 111.1 MaxMinCoverage 134.8 102.8 41.0 104.5 105.9 107.5 MinMaxRegret 142.9 101.2 27.1 104.5 109.0 112.3 MaxCVaR0.95 138.4 99.8 43.8 109.2 112.0 113.6 MaxCVaR0.90 143.2 100.4 37.1 108.0 112.5 115.0 MaxCVaR0.85 143.2 100.4 37.1 108.0 112.5 115.0

(c) |M| = 52, |N| = 103, |S| = 103, |�| = 100

Note: The boldface values report the optimal objective function values.

mitigation selection as compared to an expected- value model.

We first describe the construction of the first data set using the attack tree examples introduced by Shostack (2014). The 15 attack trees have 10–20 nodes on each tree, and feasible attack paths can be easily generated for each tree, which yields S, N, and Ns, s ∈ S. Shostack (2014) also provides applicable security controls that protect the vulnerabilities in each tree, giving us the data for M and Mn, n ∈ N. We note that these mitigations have overlapping capacities over some nodes, which is consistent with our model assumptions. Shostack (2014) does not provide information on the attack path weights (as , s ∈ S), mitigation costs (bm, m ∈ M), or budget (B), so we generate these parameters in a random manner similar to that in Section 3.1. The listed mitigations in this data set only affect the end node (leaf) of the attack path. Therefore, there is only one node “active” on each path, and our problem is reduced to a single coverage case with this data set. Accordingly, we set the coverage function to

fs (yωs ) = as yωs , a linear function commonly used in maximum coverage models in the literature. This data set contains 52 mitigations, 103 nodes, and 103 attack paths in total. We create three instances with different stochastic data, i.e., three sets of samples ξ ωmn drawn independently from Bernoulli distribution with success probability 0.5 and size |�| = 100. A larger number of scenarios is not preferred here as the worst case might be too extreme to provide useful insights into decision making. All instances were solved to optimality in less than 8.4 seconds.

We randomly create a second set of instances to assess multiple coverage and additional instances. To generate these instances, we follow the same rule in- troduced in Section 3.1 to create three different in- stances with size |M| = 50, |N| = 150, |S| = 50, |�| = 100, and we use the same concave coverage function. All instances were solved to optimality in less than 71.4 seconds.

We compare the models by retrospectively evaluating all objective function values, i.e., the ex- pected coverage, the minimal coverage, the maximal

2086 Zheng and Albert

Table II. Model Solutions on Cyber Attack Data for Three Instances in Data Set 1

Mitigation Number

1 2 4 5 7 8 9 12 13 18 20 22 25 29 31 35

MaxExpCoverage X X X X X X X X X X MaxMinCoverage X X X X X X X X MinMaxRegret X X X X X X X X X X X X MaxCVaR0.95 X X X X X X X X X X X MaxCVaR0.90 X X X X X X X X X X X MaxCVaR0.85 X X X X X X X X

(a) |M| = 52, |N| = 103, |S| = 103, |�| = 100

Mitigation Number

1 4 5 7 8 13 15 17 20 23 28 40 41 47 48

MaxExpCoverage X X X X X X X X X X MaxMinCoverage X X X X X X X X MinMaxRegret X X X X X X X X X MaxCVaR0.95 X X X X X X X X X X X MaxCVaR0.90 X X X X X X X X X X X MaxCVaR0.85 X X X X X X X X X X X

(b) |M| = 52, |N| = 103, |S| = 103, |�| = 100

Mitigation Number

1 4 9 10 13 20 21 24 25 27 30 31 35 36 37 40 47

MaxExpCoverage X X X X X X X X X X MaxMinCoverage X X X X X X X X X X X X MinMaxRegret X X X X X X X X X X X MaxCVaR0.95 X X X X X X X X X X MaxCVaR0.90 X X X X X X X X X X X X MaxCVaR0.85 X X X X X X X X X X X X

(c) |M| = 52, |N| = 103, |S| = 103, |�| = 100

regret, and the CVaR, associated with their optimal solutions, respectively. To achieve this, we first solve the four models to obtain their optimal solutions, and then calculate each measure associated with the solu- tions, respectively. We choose three different quan- tiles for the MaxCVaR model: 0.95, 0.90, and 0.85. Tables I and II report the objective function values and the associated solutions for the three instances in data set 1. Similarly, Tables III and IV report the ob- jective function values and the associated solutions for the three instances in data set 2. Rows in Tables I and III represent different models and columns correspond to different performance measure eval- uations. The boldface values on the diagonal from top left to bottom right report the optimal objective function values, and the other values report the other performance measures associated with the models. For example, in Table I(a), the MaxExpCoverage

solution has the largest expected coverage value of 136.0 compared to that of the other model solutions in that column, which vary from 124.2 to 132.9.

Next, we examine the tradeoffs between differ- ent measures and contrast their results to shed light on the insights they provide for decision making. First, we compare the expected-value model with the two worst-case robust models. We notice that MaxExpCoverage solutions usually have poor worst- case coverage. Similarly, MaxMinCoverage solutions usually have a relatively low expected coverage as the model overlooks average performance over all scenarios. For example, in Table I(a), the minimal coverage for the MaxExpCoverage solution is 76.8, which is the lowest among all model solutions. At the same time, expected coverage of the MaxMinCover- age solution is 124.2, which is also the lowest among all model solutions. The MaxMinCoverage solution

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2087

Table III. Cross-Comparison of Four Model Solutions on Randomly Generated Data for Three Instances in Data Set 2

Exp. Cov. Min. Cov. Max. Reg. CVaR0.95 CVaR0.90 CVaR0.85

MaxExpCoverage 1,673.0 991.5 949.2 1,091.7 1,167.8 1,230.3 MaxMinCoverage 1,595.8 1,011.1 1,268.9 1,095.3 1,136.0 1,176.3 MinMaxRegret 1,673.0 991.5 949.2 1,091.7 1,167.8 1,230.3 MaxCVaR0.95 1,595.8 1,011.1 1,268.9 1,095.3 1,136.0 1,176.3 MaxCVaR0.90 1,656.8 664.5 1,276.1 1,064.3 1,176.7 1,229.7 MaxCVaR0.85 1,673.0 991.5 949.2 1,091.7 1,167.8 1,230.3

(a) |M| = 50, |N| = 150, |S| = 50, |�| = 100

Exp. Cov. Min. Cov. Max. Reg. CVaR0.95 CVaR0.90 CVaR0.85

MaxExpCoverage 2,131.3 1,475.7 270.0 1,569.2 1,638.3 1,694.8 MaxMinCoverage 2,084.3 1,524.7 334.4 1,586.0 1,642.6 1,680.3 MinMaxRegret 2,131.3 1,475.7 270.0 1,569.2 1,638.3 1,694.8 MaxCVaR0.95 2,084.3 1,524.7 334.4 1,586.0 1,642.6 1,680.3 MaxCVaR0.90 2,096.7 1,501.9 434.4 1,583.0 1,670.4 1,711.1 MaxCVaR0.85 2,096.7 1,501.9 434.4 1,583.0 1,670.4 1,711.1

(b) |M| = 50, |N| = 150, |S| = 50, |�| = 100

Exp. Cov. Min. Cov. Max. Reg. CVaR0.95 CVaR0.90 CVaR0.85

MaxExpCoverage 1,296.4 722.3 289.0 862.1 930.3 973.2 MaxMinCoverage 1,252.3 819.9 393.6 888.8 921.8 942.4 MinMaxRegret 1,296.4 722.3 289.0 862.1 930.3 973.2 MaxCVaR0.95 1,252.3 819.9 393.6 888.8 921.8 942.4 MaxCVaR0.90 1,286.5 761.6 337.2 886.9 938.5 966.4 MaxCVaR0.85 1,296.4 722.3 289.0 862.1 930.3 973.2

(c) |M| = 50, |N| = 150, |S| = 50, |�| = 100

Note: The boldface values report the optimal objective function values.

uses mitigation resources on improving the minimal coverage, which would be beneficial if the decision- maker is extremely risk averse. The other worst- case robust method, MinMaxRegret, optimizes over the worst-case regret. The maximal regret of the MaxMinCoverage solution is often the worst among all models across the instances in the two tables. Sim- ilarly, the minimal coverage of the MinMaxRegret solutions is often high. This implies that the scenario with the worst coverage is usually not the scenario with the worst regret. Additionally, we observe some resemblance between the solution performance of MaxExpCoverage and MinMaxRegret. Their solu- tions have close performance when evaluated with each other’s measure. For example, in Table I(c), the MinMaxRegret solution achieves an expected cover- age of 142.9, close to the optimal coverage of 145.3, and the MaxExpCoverage solution has a maximal re- gret of 34.8, which is closer to the optimal maximal regret compared to the other model solutions.

Decisionmakers responsible for investment plan- ning usually require flexibility from the solutions.

They may have multiple goals to achieve and have to decide on tradeoffs. The first three models lack such flexibility, which is fulfilled by the introduction of the MaxCVaR model, which balances expected-value and worst-case optimization through a quantile parameter α. We can see clear evidence from the re- sults by comparing the solution performance of three MaxCVaR models with different α values, and with the other models. We use the results in Table III(c) as evidence. MaxCVaR0.95 maximizes the expected coverage in the 5% worst-case scenarios, i.e., the five worst-case scenarios given the total 100 scenarios. Its solution is identical to that of MaxMinCoverage that maximizes the one worst-case scenario. When α de- creases to 0.90, we obtain a slightly more risk-neutral MaxCVaR solution, the expected coverage of which increases by 34.2, and the maximal regret of which is improved by 56.4. However, its minimal coverage is compromised and decreases to 58.3. As α further decreases to 0.85, the MaxCVaR solution is identical to that of MaxExpCoverage, indicating that maxi- mizing the expected coverage in the 15 worst-case

2088 Zheng and Albert

Table IV. Model Solutions on Cyber Attack Data for Three Instances in Data Set 2

Mitigation Number

3 7 12 26 28 30 33 48

MaxExpCoverage X X X X X X MaxMinCoverage X X X X X X MinMaxRegret X X X X X X MaxCVaR0.95 X X X X X X MaxCVaR0.90 X X X X X X MaxCVaR0.85 X X X X X X

(a) |M| = 50, |N| = 150, |S| = 50, |�| = 100

Mitigation Number

1 6 8 12 15 21 24 31 32 33 36 46 48 49 MaxExpCoverage X X X X X X X X X X X X MaxMinCoverage X X X X X X X X X X X X MinMaxRegret X X X X X X X X X X X X MaxCVaR0.95 X X X X X X X X X X X X MaxCVaR0.90 X X X X X X X X X X MaxCVaR0.85 X X X X X X X X X X

(b) |M| = 50, |N| = 150, |S| = 50, |�| = 100

Mitigation Number

2 6 7 13 16 19 25 28 32 41 45 46 MaxExpCoverage X X X X X X X X X MaxMinCoverage X X X X X X X X X MinMaxRegret X X X X X X X X X MaxCVaR0.95 X X X X X X X X X MaxCVaR0.90 X X X X X X X X X X MaxCVaR0.85 X X X X X X X X X

(c) |M| = 50, |N| = 150, |S| = 50, |�| = 100

scenarios requires the same portfolio of mitigations as maximizing the expected coverage over all scenar- ios. In general, when α is close to 1, the MaxCVaR solution is more risk conservative and behaves more closely to the MaxMinCoverage solution. As α decreases, the MaxCVaR solutions become more risk neutral and exhibit more resemblance toward MaxExpCoverage solutions.

Tables II and IV report the solutions associated with the three instances in data sets 1 and 2, respec- tively. They show that the models often identify mitigations that are common across the different measures. Five, six, and seven of the mitigations are common in all six model solutions for the three problem instances using data set 1. Table II(b) indicates that the optimal solutions are the same across all MaxCVaR models with α = 0.95, 0.90, 0.85 in instance 2 of data set 1. Similarly, Table II(c) in- dicates that the optimal solutions are the same for

MaxCVaR models with α = 0.90 and 0.85 in instance 3. The MaxMinCoverage and MinMaxRegret solu- tions each contain one mitigation not selected in any other solution for all three instances, which suggests that they are sensitive to the uncertainty scenarios. Similar observations can be drawn for the solutions to data set 2, as reported in Table IV. In data set 2, four, nine, and seven of the mitigations are selected in all six models for the three instances. Two of the models identify the same solutions for each instance. The MaxExpCoverage and MaxCVaR0.85 solutions are the same for instance 1 (see Table IV(a)), the MaxCVaR0.90 and MaxCVaR0.85 solutions are the same for instance 2 (Table IV(b)), and the Min- MaxRegret and MaxCVaR0.85 solutions are the same for instance 3 (Table IV(c)).

We examine the sensitivity of the model so- lutions to different scenarios sets using data set 1. To do so, we create 10 instances of 100 stochastic

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2089

Table V. Sensitivity of Model Solutions Across 10 Instances for Data Set 1 with ξ ωmn Drawn Independently from Bernoulli Distribution with Success Probability 0.95 and Size |�| = 100

Mitigation Number

Model Instance 1 2 4 7 8 9 12 18 20 22 25 28 29 31 35

MaxExpCoverage 1 X X X X X X X X X X 2 X X X X X X X X X X 3 X X X X X X X X X X 4 X X X X X X X X X X 5 X X X X X X X X X X 6 X X X X X X X X X 7 X X X X X X X X X X 8 X X X X X X X X X X 9 X X X X X X X X X X

10 X X X X X X X X X X MaxMinCoverage 1 X X X X X X X X X

2 X X X X X X X X X 3 X X X X X X X X X X X 4 X X X X X X X X X X X X 5 X X X X X X X X X 6 X X X X X X X X X 7 X X X X X X X X X X 8 X X X X X X X X X 9 X X X X X X X X X

10 X X X X X X X X X X X MinMaxRegret 1 X X X X X X X X X

2 X X X X X X X X X X 3 X X X X X X X X X X 4 X X X X X X X X X X 5 X X X X X X X X X X 6 X X X X X X X X 7 X X X X X X X X X X 8 X X X X X X X X X 9 X X X X X X X X X

10 X X X X X X X X X MaxCVaR0.95 1 X X X X X X X X X

2 X X X X X X X X X 3 X X X X X X X X X X X X 4 X X X X X X X X X X 5 X X X X X X X X X X 6 X X X X X X X X 7 X X X X X X X X X X X 8 X X X X X X X X X 9 X X X X X X X X X

10 X X X X X X X X X X X X MaxCVaR0.90 1 X X X X X X X X X X

2 X X X X X X X X X 3 X X X X X X X X X 4 X X X X X X X X X X 5 X X X X X X X X X X 6 X X X X X X X X 7 X X X X X X X X X X 8 X X X X X X X X X X 9 X X X X X X X X X

10 X X X X X X X X X MaxCVaR0.85 1 X X X X X X X X X X

2 X X X X X X X X X X

(Continued)

2090 Zheng and Albert

Table V (Continued)

Mitigation Number

Model Instance 1 2 4 7 8 9 12 18 20 22 25 28 29 31 35

3 X X X X X X X X X X 4 X X X X X X X X X X 5 X X X X X X X X X X 6 X X X X X X X X X 7 X X X X X X X X X X 8 X X X X X X X X X X 9 X X X X X X X X X X

10 X X X X X X X X X

Fig. 2. Empirical cumulative distribution func- tion of the coverage associated with the optimal MaxCVaR solution for different α values.

scenarios, i.e., 10 sets of ξ ωmn drawn independently from a Bernoulli distribution with success probability 0.95 and size |�| = 100. Table V reports the solu- tions for the 10 instances for each of the six models. First, we note that nine of the 10 MaxExpCoverage solutions are identical, which suggests that MaxExp- Coverage is not sensitive to the scenario sets. Three models—MaxMinCoverage, MinMaxRegret, and MaxCVaR with α = 0.95—are the most sensitive to the uncertainty scenarios. This is evident by both the number of unique solutions across the 10 instances and the mitigations selected in the solutions. For example, solutions to these three model instances are the only solutions to select mitigations 2, 25, and 28. The solutions to instances of MaxCVaR with α = 0.90 and 0.85 are less sensitive to uncertainty.

Additionally, we note that four mitigations—1, 29, 31, and 35—are common to all 60 solutions and four additional instances—4, 9,12, and 20—are common to at least 55 of the 60 solutions, which provides useful input to decisionmakers. The model solutions together can provide a set of solutions to decision- makers, which is often more useful in practice than a single “best” solution, with MaxExpCoverage and MaxCVaR with α ≤ 0.90, providing solutions that are less sensitive to uncertainty and practical to use.

Finally, we demonstrate how to achieve solu- tions with a desired level of security by adjusting the parameter α in the MaxCVaR model, since α is a user-defined parameter that reflects the risk attitudes of the decisionmaker. We investigate the insights on mitigation selection strategy that the MaxCVaR

A Robust Approach for Mitigating Risks in Cyber Supply Chains 2091

solution provides by varying the values of α. Fig. 2 demonstrates how the choice of α shapes the empiri- cal cumulative distribution functions of the coverage across the scenarios. We solve a new medium- sized data instance with |M| = 50, |N| = 50, |S| = 20, |�| = 200 with three different α values, 0.99, 0.95, 0.90. We then compute the coverage of all attack paths,

∑ s∈S as fs (y

ω), associated with the optimal solution corresponding to each α value, respectively. Fig. 2 illustrates the cumulative histograms of the coverage across all scenarios associated with the optimal MaxCVaR solutions for α = 0.90, 0.95, 0.99. These plots are useful for decisionmakers to adjust the tail distribution by varying the α value until a desired level of security is achieved.

4. CONCLUSIONS

Uncertainties are embedded in cyber security planning given the dynamic feature of cyber attacks and the limited knowledge SMEs have regarding attacker profiles and mitigation approaches. In this article, we address one of the main uncertainties associated with mitigation effectiveness. We pro- pose three robust methods as extensions to the expected-value budgeted maximum multiple cover- age (MaxExpCoverage) model introduced in Zheng et al. (2018) to investigate robust solutions that hedge against worst-case risks. An expected-value solution performs well on average across all scenarios, but could be unacceptable in certain circumstances. We first introduce two worst-case robust optimization models, MaxMinCoverage and MinMaxRegret, which optimize the worst-case coverage and the worst-case regret, respectively. Next, we introduce a more flexible model that maximizes the expected coverage in the (1 − α) worst-case scenarios, com- bining expected-value maximization and worst-case optimization. By varying α, the decisionmaker with different risk preferences can achieve solutions that are either more risk conservative (with α closer to 1) or more risk neutral (with α closer to 0).

We compare the four models, MaxExpCov- erage, MaxMinCoverage, MinMaxRegret, and MaxCVaR, and investigate their insights through a case study that consists of real cyber attack data and randomly generated data. We demonstrate the trade- offs between different models by retrospectively evaluating their solutions with different measures. We also demonstrate how MaxCVaR can be used to achieve solutions with different robustness by varying α. Our study provides decisionmakers in

cyber security planning with analytical tools for managing risks in IT supply chains. They can use this robust and stochastic optimization framework to obtain a suite of potential solutions that meet with their budget requirements and the level of security they aim to achieve from which to inform policy decisions.

Modeling the decision framework against adap- tive adversaries in IT supply chains is an important next step given the drastic increase in number, scale, and impact of adversarial attacks. The robust methods proposed in this article can be interpreted as modeling an adversary who chooses the minimal coverage attack (MaxMinCoverage), or the maximal regret attack (MinMaxRegret), or an attack in the (1 − α) worst cases. An important extension to this framework explicitly models the interaction between decisionmakers and adversarial attackers with bi-level programming methodology.

ACKNOWLEDGMENTS

This work was funded by National Science Foundation Award 1422768. The views and conclu- sions contained in this document are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied, of the National Science Foundation. The methodology in this article is motivated by conversa- tions with federal decisionmakers at Sandia National Laboratory (SNL) about planning applications for mitigating risks in federal IT infrastructure. The authors would like to thank Dr. Gio Kao at Sandia National Laboratory for his guidance and feedback on the research results reported in this article. The authors would like to thank the anonymous review- ers for their valuable comments and suggestions to improve the quality of the article.

REFERENCES

Ahmed, S. (2006). Convexity and decomposition of mean-risk stochastic programs. Mathematical Programming, 106(3), 433– 446.

Ben-Tal, A., Ghaoui, L. E., & Nemirovski, N. (2009). Robust opti- mization. Princeton, NJ: Princeton University Press.

Bertsimas, D., Brown, D. B., & Caramanis, C. (2010). Theory and applications of robust optimization (Tech. Rep.). Cambridge, MA: Massachusetts Institute of Technology.

Chen, G., Daskin, M. S., Shen, Z. J., & Uryasev, S. (2006). The α-reliable mean-excess regret model for stochastic facility loca- tion modeling. Naval Research Logistics, 53(7), 617–626.

Church, R., & ReVelle, C. (1974). The maximal covering location problem. Papers in Regional Science, 32(1), 101–118.

Church, R., Scaparra, M. P., & Middleton, R. S. (2004). Identi- fying critical infrastructure: The median and covering facility

2092 Zheng and Albert

interdiction problem. Annuals of the Association of American Geographer, 94, 491–502.

Daskin, M. S. (1983). A maximum expected covering location model: Formulation, properties and heuristic solution. Trans- portation Science, 17(1), 48–70.

Daskin, M. S., Hesse, S. M., & ReVelle, C. S. (1997). α-reliable p-minimax regret: A new model for strategic facility location modeling. Location Science, 5(4), 227–246.

Director of National Intelligence. (2015). Worldwide threat assess- ment of the U.S. intelligence community. (Unclassified statement for the record). Washington, DC: Senate Select Committee on Intelligence.

Edwards, N., Kao, G., Hamlet, J., Bailon, J., & Liptak, S. (2016). Supply chain decision analytics: Application and case study for critical infrastructure security. In 11th International Conference on Cyber Warfare and Security: ICCWS2016, p. 98.

Hamlet, J., Helinski, R., Kao, G. K., Lin, H. W., Michalski, J., & Shakamuri, M. (2015). Supply chain security decision analytics: Macro analysis. (Tech. Rep.). Report SAND2015-4070C. Albu- querque, NM: Sandia National Laboratories.

Kaspersky Lab. (2014). Tyupkin: Manipulating ATM ma- chines with malware. Kaspersky Lab Secure List. https:// securelist.com/blog/research/66988/tyupkin-manipulating-atm- machines-with-malware/

Kirk, J. (2014). Home Depot attackers broke in using a vendor’s stolen credentials. Computer World. http://www.computer- world.com/article/2844491/home-depot-attackers-broke-in-usi- ng-a-vendors-stolen-credentials.html

Kordy, B., Mauw, S., Radomirović, S., & Schweitzer, P. (2011). Foundations of attack–defense trees. In Formal Aspects of Se- curity and Trust: 7th International Workshop, Fast 2010, Pisa, Italy, September 16–17, 2010 (pp. 80–95). Berlin, Heidelberg: Springer.

Kordy, B., & Widel, W. (2017). How well can I secure my system? In 13th International Conference on Integrated Formal Methods (iFM 2017).

Krebs, B. (2014). Target hackers broke in via HVAC Com- pany—Krebs on Security. Krebs on Security. https://krebs- onsecurity.com/2014/02/target-hackers-broke-in-via-hvac-com- pany/

Mauw, S., & Oostdijk, M. (2006). Foundations of attack trees (pp. 186–198). Berlin, Heidelberg: Springer.

McLay, L. A., Rothschild, C., & Guikema, S. (2012). Robust ad- versarial risk analysis: A level-k approach. Decision Analysis, 9(1), 41–54.

Morton, D. P. (2010). Stochastic network interdiction. In J. J. Cochran, L. A. Cox, Jr., P. Keskinocak, J. P. Kharoufeh, & J. C. Smith (Eds.), Wiley encyclopedia of operations re- search and management science. Hoboken, NJ: John Wiley & Sons.

National Institute of Standards and Technology. (2015). Supply chain risk management practices for federal information systems and organizations, Tech. Rep., NIST Special Publication 800- 161. Washington, DC.

Noyan, N. (2012). Risk-averse two-stage stochastic programming with an application to disaster management. Computers & Op- erations Research, 39, 541–559.

Rockafellar, R., & Uryasev, S. (2000). Optimization of conditional value at risk. Journal of Risk, 2, 21–42.

Rockafellar, R., & Uryasev, S. (2002). Conditional value-at-risk for general loss distributions. Journal of Banking and Finance, 26, 1443–1471.

Scaparra, M. P., & Church, R. (2012). Protecting supply sys- tems to mitigate potential disaster: A model to fortify capac- itated facilities. International Regional Science Review, 35(2), 188–210.

Scaparra, M. P., & Church, R. L. (2008a). A bilevel mixed-integer program for critical infrastructure protection planning. Com- puters and Operations Research, 35, 1905–1923.

Scaparra, M. P., & Church, R. L. (2008b). An exact solu- tion approach for the interdiction median problem with for- tification. European Journal of Operational Research, 189, 76–92.

Schneier, B. (1999). Attack trees: Modeling security threats. Dr. Dobb’s Journal of Software Tools, 24(12), 21–29.

Shostack, A. (2014). Threat modeling: Designing for security. New York: Wiley Publishing.

Smith, C. J., Prince, M., & Geunes, J. (2013). Modern network in- terdiction problems and algorithms. In P. M. Pardalos, D.-Z. Du, & R. L. Graham (Eds.), Handbook of combinatorial opti- mization, 1949–1987. New York: Springer.

Snyder, L. V., Scaparra, M. P., Daskin, M. S., & Church, R. L. (2006). Planning for disruptions in supply chain networks. INFORMS Tutorials in Operations Research, pp. 234–257. https://doi.org/10.1287/educ.1063.0025.

The White House. (2013a). Executive order: Improving critical in- frastructure cybersecurity. Washington, DC: Office of the Press Secretary.

The White House. (2013b). Presidential policy directive: Critical infrastructure security and resilience. Washington, DC: Office of the Press Secretary.

The White House. (2015). The comprehensive national cybersecu- rity initiative (Tech. Rep.). Washington, DC.

The White House. (2016). Commission on enhancing national cy- bersecurity (Report on securing and growing the digital econ- omy). Washington, DC.

U.S. Government Accountability Office. (2013). National strategy, roles, and responsibilities need to be better defined and more effectively implemented, Tech. Rep., GAO Publication No. 13-187. Washington, DC.

U.S. Government Accountability Office. (2015). Cybersecurity ac- tions needed to address challenges facing federal systems (Tech. Rep., GAO Publication No. 15-573T). Washington, DC.

Zheng, K., Albert, L. A., Luedtke, J., & Towle, E. (2018). A budgeted maximum multiple coverage model for cyber- security planning and management, Tech. Rep. Madison, WI: University of Wisconsin–Madison. https://uwmadison.box. com/s/qjah7jgpvf1eyan3q4f83tu2t6pf9wi1

Copyright of Risk Analysis: An International Journal is the property of Wiley-Blackwell and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.