| NSF Org: |
CNS Division Of Computer and Network Systems |
| Recipient: |
|
| Initial Amendment Date: | August 9, 2016 |
| Latest Amendment Date: | May 29, 2020 |
| Award Number: | 1616575 |
| Award Instrument: | Standard Grant |
| Program Manager: |
Rob Beverly
CNS Division Of Computer and Network Systems CSE Directorate for Computer and Information Science and Engineering |
| Start Date: | August 15, 2016 |
| End Date: | July 31, 2021 (Estimated) |
| Total Intended Award Amount: | $499,982.00 |
| Total Awarded Amount to Date: | $515,982.00 |
| Funds Obligated to Date: |
FY 2020 = $16,000.00 |
| History of Investigator: |
|
| Recipient Sponsored Research Office: |
1109 GEDDES AVE STE 3300 ANN ARBOR MI US 48109-1015 (734)763-6438 |
| Sponsor Congressional District: |
|
| Primary Place of Performance: |
1301 Beal Avenue Ann Arbor MI US 48109-2122 |
| Primary Place of
Performance Congressional District: |
|
| Unique Entity Identifier (UEI): |
|
| Parent UEI: |
|
| NSF Program(s): | Secure &Trustworthy Cyberspace |
| Primary Program Source: |
01002021DB NSF RESEARCH & RELATED ACTIVIT |
| Program Reference Code(s): |
|
| Program Element Code(s): |
|
| Award Agency Code: | 4900 |
| Fund Agency Code: | 4900 |
| Assistance Listing Number(s): | 47.070 |
ABSTRACT
This project addresses the following two key questions in cyber security: (1) how is the security condition of a network assessed, and (2) to what extent can we predict data breaches or other cyber security incidents for an organization. The ability to answer both questions has far-reaching social and economic impact. Recent data breaches such as those at Target, JP Morgan, Home Depot, Office of Personnel Management (OPM), and Anthem Healthcare, to name just a few, highlight the increasing social and economic impact of such cyber security incidents. Often, by the time a breach is detected, it is too late and damage has already occurred. Consequently, being able to predict such incidents accurately can greatly enhance an organization's ability to put preventative and proactive measures in place. The answers to these questions also have implications on public policy design - not only for the security policies themselves, but also for related incentive mechanisms. Such mechanisms might be aimed at encouraging adoption of better security policies and cybersecurity frameworks, including cyber insurance, liability limitation, and rate recovery among others. Presidential Policy Directive (PPD) 21, on Critical Infrastructure Security and Resilience, encourages efforts to strengthen and maintain secure, functioning, and resilient critical infrastructure. Understanding the potential attack vector presented by an enterprise or organization is a crucial part of achieving this goal.
This project follows a comprehensive agenda aimed at transitioning to practice technologies developed by the research team in the domain of quantitative assessment of the security posture at both a network and an organizational level. The use of such assessments enables more accurate forecasting of cyber security incidents. The technological innovation is a sound quantitative framework that combines a large collection of cybersecurity data, novel data processing methods, advanced machine learning techniques, and extensive cybersecurity domain expertise. The resulting framework produces accurate predictions of security incidents for a given organization, thereby providing tangible information and crucial input for decision makers such as an insurance underwriter, or an enterprise customer seeking to validate vendor specifications.
PUBLICATIONS PRODUCED AS A RESULT OF THIS RESEARCH
Note:
When clicking on a Digital Object Identifier (DOI) number, you will be taken to an external
site maintained by the publisher. Some full text articles may not yet be available without a
charge during the embargo (administrative interval).
Some links on this page may take you to non-federal websites. Their policies may differ from
this site.
PROJECT OUTCOMES REPORT
Disclaimer
This Project Outcomes Report for the General Public is displayed verbatim as submitted by the Principal Investigator (PI) for this award. Any opinions, findings, and conclusions or recommendations expressed in this Report are those of the PI and do not necessarily reflect the views of the National Science Foundation; NSF has not approved or endorsed its content.
The overall goal of this project is to transition to practice the quantitative org-level security posture/risk assessment and data breach prediction framework our research team has built over the past few years. The ability to do so has far-reaching social and economic impact: data has become an evermore important asset in any business, and the recent data breaches highlight the increasing social and economic impact of such cyber incidents. Finding practical ways of using our quantitative framework has enormous implications on policy design, not only security policies, but also various incentive mechanisms aimed at encouraging the adoption of better security policies and cybersecurity frameworks such as cyber insurance.
Within this context, specific research tasks performed under this project include: (1) translating incident probabilities into loss and cost estimates; (2) constructing exemplar insurance policies that utilize our breach prediction and quantitative risk assessment methodology; and (3) exploring other practical use cases of our risk assessment methodology.
The main outcomes of this project has had significant impact on security and incentive policy design. Our work on risk quantification and cyber insurance is gradually beginning to reach the risk management industry. It is starting to bring about a paradigm shift by introducing new ways of designing cyber insurance policies, and new ways of thinking about network security and risk quantification at a much higher level and in a more holistic manner. In particular, our risk assessment technology is now in active use in vendor management, insurance underwriting, as well as by institutional investors.
The project team has extensive experience in data collection, measurement, and analysis, as well as contract theory, game theory, mathematical modeling, and mechanism design. Our research identified novel use and applications of these disciplines, as well as new techniques that need to be developed under these disciplines to further our goals. Our cross-disciplinary research in integrating Internet data analysis and incentive design can lead to significant advances in network theory and practice.
Last Modified: 08/30/2021
Modified by: Mingyan Liu
Please report errors in award information by writing to: awardsearch@nsf.gov.
