Chapter 4 Uncertainty and Risk Management in Cyber Situational Awareness

Abstract Handling cyber threats unavoidably needs to deal with both uncertain and imprecise information. What we can observe as potential malicious activities can seldom give us 100 % con-fidence on important questions we care about, e.g. what machines are compromised and what damage has been incurred. In security planning, we need information on how likely a vulnerability can lead to a successful compromise to better balance security and functionality, performance, and ease of use. These information are at best qualitative and are often vague and imprecise. In cyber situational awareness, we have to rely on such imperfect information to detect real attacks and to prevent an attack from happening through appropriate risk management. This chapter surveys existing technologies in handling uncertainty and risk management in cyber situational awareness. 4.1 Reasoning about Uncertainty is a Necessity In the physical world it is commonplace that one must deal with uncertainty when security is con-cerned. For example, law enforcement agencies do not (and cannot) know every aspect of every individual citizen’s life. But when a crime is committed there are effective investigative methods to capture the perpetrators. As a result we are not living in havoc where crimes are committed ev-erywhere. Like the law enforcement agencies, cyber defenders also have to deal with a great dea