Dynamic Threat Assessment for Prioritising Computer Network Security

Large corporations today consist of heterogeneous IT networks with many thousands of devices, which may use numerous physical and logical interfaces to communicate. Much effort has been applied in automating laborious, time-consuming and sometimes-repetitive security services such as patch management and event loggers for these networks. However such tasks can still take many hours and even days to successfully complete. Currently it is left to the systems administrators’ discretion to choose in which order to protect individual devices, which on larger networks can result in arbitrary security protection at best. In light of the rapidly decreasing time between vulnerabilities being discovered and maliciously exploited by malware, such an arbitrary method introduces an unacceptable level of risk to the security of those devices, which are critical to business processes. An information risk management approach needs to be adopted to ensure the protection of the network with a high likelihood; this can be achieved through the prioritisation of critical devices. In this introductory paper a generic prioritisation technique for individual devices in a network is described offering a methodical alternative to the current ambiguity of a systems administrators operations. The technique is based upon compromise path analysis, which identifies critical paths in a network from a security viewpoint and is relevant in a wide range of operations from the application of security services to analysing their results. The vulnerability period metric is introduced, as a mechanism to control the risk exposure to individual devices through prioritisation