ABSTRACT

Cyber-attacks are serious threats to operations in most industries, enabled by a growing dependence on Information Technology (IT). To minimise disruptive effects on operations, organisations with complex system derive value both from preventing cyber-attacks and from responding promptly and coherently when cyber-attacks happen, capacity is known as cyber-resilience. Frameworks have been presented in literature to promote cyber-resilient response, yet little is known about the structures that result in a cyber-resilient behaviour. This paper explores an approach to modelling the structure of a system that is subject to an infection an eventual recovery from zero-day malware cyber-attacks, based on mechanisms derived from epidemiology. By analysing the relationship between the system vulnerabilities and the incidence of malware infections in a population of systems, this paper derives structural recommendations for resilience response, and policy requirements based on the claim that cyber-threats are a public-cyber-health issue instead of merely a competitive factor.

摘要

由于对信息技术 (IT) 的日益依赖，网络攻击对大多数行业的运营构成了严重威胁。为了最大限度地减少对运营的破坏性影响，具有复杂系统的组织从防止网络攻击和在网络攻击发生时迅速一致地响应中获得价值，这种能力被称为网络弹性。文献中已经提出了促进网络弹性响应的框架，但对导致网络弹性行为的结构知之甚少。本文探讨了一种方法，该方法基于流行病学派生的机制，对易受感染并最终从零日恶意软件网络攻击中恢复的系统结构进行建模。