How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network?
Industrial Internet of Things (IIoT) networks (e.g., a smart grid industrial control system) are increasingly on the rise, especially in smart cities around the globe. They contribute to meeting the day-to-day needs (e.g., power, water, manufacturing, transportation) of the civilian society, alongsi...
| Main Authors: | , , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
ACM
2023
|
| Online Access: | https://hdl.handle.net/1721.1/152616 |
| _version_ | 1826214588023046144 |
|---|---|
| author | Pal, Ranjan Yin, Xinlong Sequeira, Rohan Zeijlemaker, Sander Kotala, Vineeth |
| author2 | Sloan School of Management |
| author_facet | Sloan School of Management Pal, Ranjan Yin, Xinlong Sequeira, Rohan Zeijlemaker, Sander Kotala, Vineeth |
| author_sort | Pal, Ranjan |
| collection | MIT |
| description | Industrial Internet of Things (IIoT) networks (e.g., a smart grid industrial control system) are increasingly on the rise, especially in smart cities around the globe. They contribute to meeting the day-to-day needs (e.g., power, water, manufacturing, transportation) of the civilian society, alongside making societal businesses more efficient, productive, and profitable. However, it is also well known that IoT devices often operate on poorly configured security settings. \textcolor{blue}{This increases the chances of occurrence of (nation-sponsored) stealthy spread-based APT malware attacks in IIoT networks that might go undetected over a considerable period of time.} Such attacks usually generate a negative first-party QoS impact upon a network that spans (aggregates) space (the entire IIoT network or a sub-network) and time (duration of business disruption) and is popularly captured through a statistical cyber-loss distribution by businesses. \textcolor{blue}{In this paper, \emph{we propose, for spread-based APT malware cyber-attacks, the first rigorous and computationally efficient network theory framework (that extends beyond IIoT networks to general sensor networks) to (a) evaluate this distribution, (b) accurately approximate its computationally intractable statistical moments under arbitrary tail-shapes, and (c) tightly bound the accuracy of empirical tail risk obtained using the Conditional Value at Risk (CVaR) metric.}} \textcolor{blue}{Clearly, an accurate estimates of the latter quantities for a parameterized family of malware-based APT cyber-attacks acts as a necessary condition for cyber-risk managers (e.g., cyber-insurers) to effectively design and deploy stand-alone risk coverage policies for such attacks on IIoT networks.} These quantities will also help the C-suite of business organizations allocate appropriate investments in time and money on securing `central' adversary targets (e.g., processes, humans, hardware) within the organization to reduce first-party tail risks and improve cyber-resilience. We validate the effectiveness of our theory using trace-driven Monte Carlo simulations based upon test-bed experiments conducted in the FIT IoT-Lab. |
| first_indexed | 2024-09-23T16:08:12Z |
| format | Article |
| id | mit-1721.1/152616 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T16:08:12Z |
| publishDate | 2023 |
| publisher | ACM |
| record_format | dspace |
| spelling | mit-1721.1/1526162024-02-05T18:44:52Z How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network? Pal, Ranjan Yin, Xinlong Sequeira, Rohan Zeijlemaker, Sander Kotala, Vineeth Sloan School of Management Industrial Internet of Things (IIoT) networks (e.g., a smart grid industrial control system) are increasingly on the rise, especially in smart cities around the globe. They contribute to meeting the day-to-day needs (e.g., power, water, manufacturing, transportation) of the civilian society, alongside making societal businesses more efficient, productive, and profitable. However, it is also well known that IoT devices often operate on poorly configured security settings. \textcolor{blue}{This increases the chances of occurrence of (nation-sponsored) stealthy spread-based APT malware attacks in IIoT networks that might go undetected over a considerable period of time.} Such attacks usually generate a negative first-party QoS impact upon a network that spans (aggregates) space (the entire IIoT network or a sub-network) and time (duration of business disruption) and is popularly captured through a statistical cyber-loss distribution by businesses. \textcolor{blue}{In this paper, \emph{we propose, for spread-based APT malware cyber-attacks, the first rigorous and computationally efficient network theory framework (that extends beyond IIoT networks to general sensor networks) to (a) evaluate this distribution, (b) accurately approximate its computationally intractable statistical moments under arbitrary tail-shapes, and (c) tightly bound the accuracy of empirical tail risk obtained using the Conditional Value at Risk (CVaR) metric.}} \textcolor{blue}{Clearly, an accurate estimates of the latter quantities for a parameterized family of malware-based APT cyber-attacks acts as a necessary condition for cyber-risk managers (e.g., cyber-insurers) to effectively design and deploy stand-alone risk coverage policies for such attacks on IIoT networks.} These quantities will also help the C-suite of business organizations allocate appropriate investments in time and money on securing `central' adversary targets (e.g., processes, humans, hardware) within the organization to reduce first-party tail risks and improve cyber-resilience. We validate the effectiveness of our theory using trace-driven Monte Carlo simulations based upon test-bed experiments conducted in the FIT IoT-Lab. 2023-11-01T16:00:30Z 2023-11-01T16:00:30Z 2023-11-01T07:45:08Z Article http://purl.org/eprint/type/JournalArticle https://hdl.handle.net/1721.1/152616 Pal, Ranjan, Yin, Xinlong, Sequeira, Rohan, Zeijlemaker, Sander and Kotala, Vineeth. "How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network?." ACM Transactions on Management Information Systems. PUBLISHER_CC en http://dx.doi.org/10.1145/3605949 ACM Transactions on Management Information Systems Article is made available in accordance with the publisher's policy and may be subject to US copyright law. Please refer to the publisher's site for terms of use. The author(s) application/pdf ACM Association for Computing Machinery |
| spellingShingle | Pal, Ranjan Yin, Xinlong Sequeira, Rohan Zeijlemaker, Sander Kotala, Vineeth How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network? |
| title | How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network? |
| title_full | How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network? |
| title_fullStr | How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network? |
| title_full_unstemmed | How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network? |
| title_short | How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk in their Industrial IoT Network? |
| title_sort | how should enterprises quantify and analyze multi party apt cyber risk in their industrial iot network |
| url | https://hdl.handle.net/1721.1/152616 |
| work_keys_str_mv | AT palranjan howshouldenterprisesquantifyandanalyzemultipartyaptcyberriskintheirindustrialiotnetwork AT yinxinlong howshouldenterprisesquantifyandanalyzemultipartyaptcyberriskintheirindustrialiotnetwork AT sequeirarohan howshouldenterprisesquantifyandanalyzemultipartyaptcyberriskintheirindustrialiotnetwork AT zeijlemakersander howshouldenterprisesquantifyandanalyzemultipartyaptcyberriskintheirindustrialiotnetwork AT kotalavineeth howshouldenterprisesquantifyandanalyzemultipartyaptcyberriskintheirindustrialiotnetwork |