超越脆弱性和恢复力的风险分析-表征关键系统的防御能力
Risk analysis beyond vulnerability and resilience - characterizing the defensibility of critical systems
摘要：
风险分析中的常见问题是表征有价值资产系统的总体安全性（例如，政府建筑物或通信枢纽），并建议措施，以减轻任何危险或安全威胁。目前，分析师通常依赖于一系列指标，如弹性、健壮性、冗余性、安全性和脆弱性。然而，这些指数本身并不足以作为行动指南;例如，虽然有可能制定减少脆弱性的政策，但这些政策并不总是具有成本效益。基于这一差距，我们提出了一个新的指标，防御性。一个系统被认为是可防御的，因为适度的投资可以显着减少攻击或中断造成的损害。为了比较性能不容易验证的系统（例如，电网与供水网络，两者都很关键，但提供不同类型的服务），我们将防御性定义为无量纲指数。在定量地定义了防御能力之后，我们说明了系统的防御能力如何取决于诸如防御者和攻击者资产评估、威胁的性质（无论是智能的和自适应的，还是随机的）以及攻击和防御强度的水平等因素，并提供了支持上述插图所产生的观察结果的分析结果。总体而言，我们认为，系统的防御性是评估潜在防御性投资时要考虑的一个重要方面，它可以应用于各种不同的环境。
英文摘要：
A common problem in risk analysis is to characterize the overall security of a system of valuable assets (e.g., government buildings or communication hubs), and to suggest measures to mitigate any hazards or security threats. Currently, analysts typically rely on a combination of indices, such as resilience, robustness, redundancy, security, and vulnerability. However, these indices are not by themselves sufficient as a guide to action; for example, while it is possible to develop policies to decrease vulnerability, such policies may not always be cost-effective. Motivated by this gap, we propose a new index, defensibility. A system is considered defensible to the extent that a modest investment can significantly reduce the damage from an attack or disruption. To compare systems whose performance is not readily commensurable (e.g., the electrical grid vs. the water-distribution network, both of which are critical, but which provide distinct types of services), we defined defensibility as a dimensionless index. After defining defensibility quantitatively, we illustrate how the defensibility of a system depends on factors such as the defender and attacker asset valuations, the nature of the threat (whether intelligent and adaptive, or random), and the levels of attack and defense strengths and provide analytical results that support the observations arising from the above illustrations. Overall, we argue that the defensibility of a system is an important dimension to consider when evaluating potential defensive investments, and that it can be applied in a variety of different contexts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
