of QoS attributes and also mean times to security Quantitative Cyber Risk Reduction E

Proceedings of the 39th Hawaii International Conference on System Sciences- 2006potential attacks if they are to effectively manage their resources. Cyber security evaluations are traditionally qualitative in nature such that recommendations are given for remedial actions with no quantitative measure of how the recommended actions reduce the risk of a successful attack. In April 2005 our risk analysis team was asked to perform a quantitative estimate of the risk reduction on a partial Supervisory Control and Data Acquisition (SCADA) system referred to as CS60. The baseline system had already undergone a security review, been modified to enhance security, and then been retested; consequently, there was no opportunity to devise or Researchers are testing the viability of different approaches for dealing with control system cyber security. Carlson et al. [3] describes a novel approach for applying Hidden Markov Models to an attack/defend scenario on an infrastructure system. The approach, based on sound statistical models, is flexible, but requires both detailed information about the system and significant set-up time. Madan et al. [6] apply a stochastic model to computer network system. It is used to determine steady-state availabilit