A game theoretic approach to cyber security risk management
Abstract
This paper describes the Cyber Security Game (CSG). Cyber Security Game is a method that has been implemented in software that quantitatively identifies cyber security risks and uses this metric to determine the optimal employment of security methods for any given investment level. Cyber Security Game maximizes a system’s ability to operate in today’s contested cyber environment by minimizing its mission risk. The risk score is calculated by using a mission impact model to compute the consequences of cyber incidents and combining that with the likelihood that attacks will succeed. The likelihood of attacks succeeding is computed by applying a threat model to a system topology model and defender model. Cyber Security Game takes into account the widespread interconnectedness of cyber systems, where defenders must defend all multi-step attack paths and an attacker only needs one to succeed. It employs a game theoretic solution using a game formulation that identifies defense strategies to minimize the maximum cyber risk (MiniMax). This paper discusses the methods and models that compose Cyber Security Game . A limited example of a Point of Sale system is used to provide specific demonstrations of Cyber Security Game models and analyses.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Cyber Security Game (CSG) is a method to distinguish digital security hazards quantitatively and use this measurement to decide the ideal use of safety techniques for any specified systems for any predetermined venture level.
“Cyber Security Game (CSG) [23] is a method to distinguish digital security hazards quantitatively and use this measurement to decide the ideal use of safety techniques for any specified systems for any predetermined venture level.”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [23]
Cites
The economics of information security investment
Gordon, L. A., & Loeb, M. P. (2002) · ACM Transactions on Information and System Security · doi:10.1145/581271.581274 · Cited by 1,341 · see citing works
Kunreuther, H. C., & Heal, G. (2003) · Journal of Risk and Uncertainty · doi:10.1023/a:1024119208153 · Cited by 500 · see citing works
IEEE Transactions on Dependable and Secure Computing
Girault, A., & Kalla, H. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.8858 · Cited by 309 · see citing works
A game theoretic approach to decision and analysis in network intrusion detection
Alpcan, T., & Başar, T. (2004) · doi:10.1109/cdc.2003.1273013 · Cited by 254 · see citing works
Cox, L. A. (2008) · Risk Analysis · doi:10.1111/j.1539-6924.2008.01142.x · Cited by 253 · see citing works
Decision-Theoretic and Game-Theoretic Approaches to IT Security Investment
Cavusoglu, H., Raghunathan, S., & Yue, W. T. (2008) · Journal of Management Information Systems · doi:10.2753/mis0742-1222250211 · Cited by 236 · see citing works
Cox, L. A. (2009) · Risk Analysis · doi:10.1111/j.1539-6924.2009.01247.x · Cited by 169 · see citing works
Bier, V. M. (2007) · Risk Analysis · doi:10.1111/j.1539-6924.2007.00906.x · Cited by 154 · see citing works
When the greedy algorithm fails
Bang‐Jensen, J., Gutin, G., & Yeo, A. (2004) · Discrete Optimization · doi:10.1016/j.disopt.2004.03.007 · Cited by 146 · see citing works
Measuring and Managing Information Risk: A FAIR Approach
Freund, J., & Jones, J. B. (2014) · Cited by 110 · see citing works
Modeling Values for Anti‐Terrorism Analysis
Keeney, R. L. (2007) · Risk Analysis · doi:10.1111/j.1539-6924.2007.00910.x · Cited by 103 · see citing works
A Comparative Analysis of PRA and Intelligent Adversary Methods for Counterterrorism Risk Management
Merrick, J. R. W., & Parnell, G. S. (2011) · Risk Analysis · doi:10.1111/j.1539-6924.2011.01590.x · Cited by 101 · see citing works
Topological Vulnerability Analysis
Jajodia, S., & Noel, S. (2009) · Advances in information security · doi:10.1007/978-1-4419-0140-8_7 · Cited by 88 · see citing works
Consistency and Accuracy in Decision Aids: Experiments with Four Multiattribute Systems*
Olson, D. L., Moshkovich, H. M., Schellenberger, R. E., & Mechitov, A. I. (1995) · Decision Sciences · doi:10.1111/j.1540-5915.1995.tb01573.x · Cited by 81 · see citing works
Mission Oriented Risk and Design Analysis of Critical Information Systems
Buckshaw, D. L., Parnell, G. S., Unkenholz, W. L., et al. (2005) · Military Operations Research · doi:10.5711/morj.10.2.19 · Cited by 81 · see citing works
Critical Asset and Portfolio Risk Analysis: An All‐Hazards Framework
Ayyub, B. M., McGill, W. L., & Kaminskiy, M. P. (2007) · Risk Analysis · doi:10.1111/j.1539-6924.2007.00911.x · Cited by 80 · see citing works
Cybersecurity Strategies: The QuERIES Methodology
Carin, L., Cybenko, G. V., & Hughes, J. A. (2008) · Computer · doi:10.1109/mc.2008.295 · Cited by 79 · see citing works
Computing the impact of cyber attacks on complex missions
Musman, S., Tanner, M., Temin, A., et al. (2011) · 2020 IEEE International Systems Conference (SysCon) · doi:10.1109/syscon.2011.5929055 · Cited by 65 · see citing works
Self-citationWhat's Wrong with Hazard‐Ranking Systems? An Expository Note
Cox, L. A. (2009) · Risk Analysis · doi:10.1111/j.1539-6924.2009.01209.x · Cited by 58 · see citing works
Modeling Security of Power Communication Systems Using Defense Graphs and Influence Diagrams
Sommestad, T., Ekstedt, M., & Nordström, L. (2009) · IEEE Transactions on Power Delivery · doi:10.1109/tpwrd.2009.2028796 · Cited by 46 · see citing works
2009 International Conference on Game Theory for Networks
(2009) · doi:10.1109/gamenets15528.2009 · Cited by 37 · see citing works
A Cyber Mission Impact assessment tool
Musman, S., & Temin, A. (2015) · IEEE International Symposium on Technologies for Homeland Security (HST) · doi:10.1109/ths.2015.7225283 · Cited by 29 · see citing works
Self-citationSome remarks on rare-event approximation
Collet, J. (1996) · IEEE Transactions on Reliability · doi:10.1109/24.488924 · Cited by 28 · see citing works
A systems engineering approach for crown jewels estimation and mission assurance decision making
Musman, S., Tanner, M., Temin, A., et al. (2011) · doi:10.1109/cicybs.2011.5949403 · Cited by 23 · see citing works
Self-citationAssessing prescriptive improvements to a system's cyber security and resilience
Musman, S. (2016) · 2020 IEEE International Systems Conference (SysCon) · doi:10.1109/syscon.2016.7490660 · Cited by 13 · see citing works
Self-citationAnalytical Frameworks to Assess the Effectiveness and Economic-Returns of Cybersecurity Investments
Garvey, P. R., & Patel, S. H. (2014) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2014.29 · Cited by 12 · see citing works
Barlow, J. (2010) · CommonKnowledge Research Repository (Pacific University Oregon) · Cited by 11 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Kandasamy, K., Srinivas, S., Achuthan, K., & Rangan, V. P. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-00111-0 · Cited by 160 · see citing works
- Authors
- Musman, S., & Turner, A.
- Affiliations
- Mitre (United States) (US)
- Corresponding author
- Musman, Scott
- ORCID
- Turner, Andrew
- Venue
- The Journal of Defense Modeling and Simulation: Applications, Methodology, Technology
- Publisher
- SAGE Publications
- Published
- 2017-03-20
- Volume
- 15
- Issue
- 2
- Pages
- 127-146
- ISSN
- 1548-5129 (ISSN-L)
- 1557-380X
- OpenAlex
- W2774222527
- Cited by
- 55
- References
- 28
- Citations by year
- 2026: 6 · 2025: 4 · 2024: 10 · 2023: 13 · 2022: 4 · 2021: 5 · 2020: 6 · 2019: 4 · 2018: 3
- FWCI
- 6.62
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- The Journal of Defense Modeling and Simulation Applications Methodology Technology (publishedVersion)
- RePEc: Research Papers in Economics (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- game theory, minimax strategy, mission risk, threat modeling, attack paths, system topology, point-of-sale systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
