Maximizing network security given a limited budget

Abstract

In order to safeguard an organization's networked assets, a network administrator must decide how to harden the network. To aid the decision-making process, network administrators may use attack graphs, which, through analysis, yield network hardening suggestions. A critical drawback of currently available analyses is the lack of consideration for the network administrator's defense budget. We overcome this shortcoming by modeling the problem of choosing security measures given a finite budget as a combinatorial optimization problem. We call this problem the Security Measures Choosing Problem (SMCP). Dynamic programming is used to provide optimal solutions.