Find results with:

Add another field

Search by date

to

Searching collections:

Dartmouth Dissertations

Add or remove collections

Home Dartmouth Dissertations Page 1

Reference URL

To link to the entire object, paste this link in email, IM or document

To embed the entire object, paste this HTML in website

To link to this page, paste this link in email, IM or document

To embed this page, paste this HTML in website

Quantitative risk analysis of computer networks.

you wish to report:

Your comment:

Your Name:

Submit

Cancel

...

Back to top

Powered by CONTENTdm®

Call No.	Ph.D. 2003
Author	Bilar, Daniel.
Title	Quantitative risk analysis of computer networks.
Date	2003
Abstract	Quantitative Risk Analysis of Computer Networks (QSRA) addresses the problem of risk opacity of software in networks. It allows risk managers to get a detailed and comprehensive snapshot of the constitutive software on the network, assess its risk with assistance of a vulnerability database, and manage that risk by rank ordering measures that should be taken in order to reduce it, subject to cost, functionality and risk constraints. A theoretical methodology is proposed and a prototype implementation has been developed. Six out-of-the-box popular operating systems were studied using the methodology and the prototype. We find that around 75% of discovered vulnerabilities are patchable within two weeks, and around 90% within 40 days after initial discovery. We find a statistically significant time window difference between security-audited and non-security audited software. Across the operating systems, the majority of faults give rise to availability and full compromise consequences. There is a statistically significant difference between fault types: Input validation faults are proportionally over-represented. There is a statistically significant difference between consequence types: Full compromise consequences are proportionally over-represented. There is, however, no statistically significant fault or consequence proportion difference between the audited systems. QSRA's risk assessment model calculated that for all audited systems, four to six months after their respective release date, the probabilities are very high (66% to 99%) that an attacker can conduct a full consequence compromise, remotely and locally. Risk management analysis for remote risk probabilities indicates that, given a moderate fault count, QSRA's 'highest risk' analytic risk mitigation strategy consistently outperforms the simpler strategy of choosing software with the highest vulnerability count. 'Highest risk' outperforms the undifferentiated 'highest count' strategy for at least four out of the six tested operating systems and for four out of five fault consequences.
Description	xi, 131 leaves : ill. 28 cm.
Format	application/pdf
Advisor	George Cybenko.
Subject	Computer networks -- Security measures. Computer security. Risk assessment. Operating systems (Computers) -- Evaluation.
College	Thayer School of Engineering.
Issuing Body	Dartmouth Dissertations are made available through the Dartmouth Digital Library.
Degree	Thesis (Ph.D.)--Dartmouth College.
Copyright	All rights reserved. No part of this book may be reproduced in any form by any electronic or mechanical means without permission in writing from the author.
DOI	http://dx.doi.org/10.1349/ddlp.3

Title	Page 1
Format	application/pdf
Issuing Body	Dartmouth Dissertations are made available through the Dartmouth Digital Library.
Degree	Thesis (Ph.D.)--Dartmouth College.
Full Text	Quantitative Risk Analysis of Computer Networks Examining Committee: b eK Carol L. FoIt Dean of Graduate Studies A Thesis Submitted to the Faculty in partial fulfillment of the requirements for the degree of Doctor of Philosophy by Daniel Bilar Thayer School of Engineering Dartmouth College Hanover, New Hampshire June, 2003 George Cybenko _____..,......,,.--___ _ (Chairpers~) \ Robert Morris ___________ _ (Member 1) Robert Gray.....,.......... ~ ________ (Member 2)./ , I ,., Sue McGrath --------r--...,......I (Member 3) © 2003 Trustees of Dartmouth College '---

	All
	Pages Enter page numbers or page ranges separated by commas. For example: 1,3,5-12

Find results with:

Searching collections:

Home Dartmouth Dissertations Page 1

Quantitative risk analysis of computer networks.

Page 1

Object Description

Description

Quantitative risk analysis of computer networks.

Quantitative risk analysis of computer networks.