Cybersecurity: causality and ontological parsimony

Abstract

Cybersecurity risk assessment using standards like ISO 27005 is hard, especially for complex target systems. The main challenges are to identify threats, estimate their likelihood, and determine their consequences. One source of difficulty is the presence of (system-specific) dependencies, whereby a threat to one system component can lead indirectly to consequences in other system components via (system-specific) attack paths and secondary-effect cascades. This paper postulates that part of the problem is that threat paths require an analysis of causes and effects in the context of a specific system, but tools and knowledge bases used for this are not based on causal models. Existing cybersecurity knowledge bases may help identify threats but do not allow the likelihood of adverse outcomes including indirect effects to be found in a target system. This paper proposes to address some of these challenges by using a simple causal model. Such a model provides at least three attractive benefits for knowledge capture and reuse: parsimony (the number of distinct concepts is small compared to existing knowledge bases), generality (it is feasible to capture these concepts in a way that does not require assumptions about target systems), and utility (it is easy to create simulations of cybersecurity threats in target systems and determine the presence and likelihood of attack paths and secondary effects). This has implications for the development of current and future cybersecurity knowledge bases. For example, the high cost of analysing new vulnerabilities in the NVD catalogue seems related to the fact that CVSS (in its current form) hides some causal relationships. This suggests that aligning CVSS with a causal model would reduce the cost of NVD and make it more useful in risk assessment. Mapping CVSS and other cybersecurity knowledge bases to a simple causal model would also make it easier to integrate them in a way that supports application in practical risk assessments.

More information

Identifiers

ORCID for Mike Surridge: orcid.org/0000-0003-1485-7024

ORCID for Samuel M. Senior: orcid.org/0000-0002-3428-9215

Catalogue record

Export record