EEMCS

Home > Publications
Home University of Twente
Education
Research
Prospective Students
Jobs
Publications
Intranet (internal)
 
 Nederlands
 Contact
 Search
 Organisation

EEMCS EPrints Service


24649 Defining "The Weakest Link" Comparative Security in Complex Systems of Systems
Home Policy Brochure Browse Search User Area Contact Help

Pieters, W. (2013) Defining "The Weakest Link" Comparative Security in Complex Systems of Systems. In: 2013 IEEE 5th International Conference on Cloud Computing Technology and Science, CloudCom, 2-5 Dec 2013, Bristol, United Kingdom. pp. 39-44. IEEE Computer Society. ISBN 978-0-7695-5095-4

Full text available as:

PDF
- Univ. of Twente only
351 Kb

Official URL: http://dx.doi.org/10.1109/CloudCom.2013.101

Exported to Metis

Abstract

Cloud architectures are complex socio-technical systems of systems, consisting not only of technological components and their connections, but also of physical premises and employees. When analysing security of such systems and considering countermeasures, the notion of "weakest link" often appears. Humans are then typically said to be the "weakest link" when it comes to security, but no proof is provided for this statement. One reason for this is the fact that there are no unified metrics of security that would apply to physical, digital and social components of complex systems alike. How does one compare the security of a room against the security of a piece of data, and how does social engineering an employee compare to exploiting a server vulnerability? Are we really comparing apples and oranges here, or would it be possible to present a comparative metric that would apply across the different domains? This paper explores the possibility of such a metric for complex systems, and proposes one in terms of the risk induced by an entity in the system. This also provides a foundation for the notion of "weakest link", in terms of the entity (set of entities) with the highest induced risk.

Item Type:Conference or Workshop Paper (Full Paper, Poster)
Research Group:EWI-DIES: Distributed and Embedded Security
Research Program:CTIT-ISTRICE: Integrated Security and Privacy in a Networked World
Research Project:TREsPASS: Technology-supported Risk Estimation By Predictive Assessment Of Socio-technical Security
Additional Information:Foreground = 100%;Type of activity = workshop;Main leader = TUD;Type of audience = industry + scientific;Size of audience = 15;Countries addressed = international;
Uncontrolled Keywords:Attacker utility, comparative security, induced risk,
security metrics, security risk assessment, socio-technical security, weakest link.
ID Code:24649
Status:Published
Deposited On:03 April 2014
Refereed:Yes
International:Yes
More Information:statisticsmetis

Export this item as:

To request a copy of the PDF please email us request copy

To correct this item please ask your editor

Repository Staff Only: edit this item