Modeling Cybersecurity Operations to Improve Resilience

Abstract

In this paper, we explore the concept of operational resilience of a network or system of computer systems, focusing on the processes of a cybersecurity team within the multi-disciplinary network security operations center. The computer system under examination has faced a cyber-attack that has reduced its capability. The organization's reputation is damaged temporarily but can be restored if the network security operations center can quickly restore the organization's ability to produce desired results. After a cyber-attack, we examine the processes for restoring the system's capability to its original level. These processes will happen sequentially and require close coordination of the cybersecurity team members. We examine a balanced and adaptive assignment policy within the cybersecurity organization to the various processes, showing how these policies can impact the speed with which the system's capability can be restored. Our findings reveal that the adaptive assignment policy among the team members can increase the system restoration rate even though recovering the complete capability of the system may be the same.