John Homer Promotion Portfolio

Quantifying security risk is an important and yet difficult task in enterprise network security management. Even though metrics exist for individual vulnerabilities, such as CVSS, there is currently no standard way of aggregating such metrics. We developed a quantitative model that can be used to aggregate vulnerability metrics in an enterprise network, with a sound computation model. The result of the aggregation is quantitative metrics that measure the likelihood breaches can occur within a given network configuration, taking into consideration the effects of all the inter-plays between all the vulnerabilities. In order to validate the effectiveness of this approach to realistic networks, we present the empirical study results of the approach on a number of system configurations. We used a real network as the test bed to demonstrate the utility of the approach. We show that the sound computation model is crucial for interpreting the metric result.