Cost effective management frameworks: the impact of IDS deployment technique on threat mitigation

Abstract

In this paper we measure the financial benefit of an intrusion detection system (IDS) deployment. To this end, we use a standard risk analysis framework and extend it by introducing the Cascading Threat Multiplier (CTM). The idea behind the CTM is that a security compromise incurs two types of costs: (a) The direct cost of lost integrity/confidentiality/availability, and (b) the indirect cost, of the compromised component serving as a potential stepping stone for future attacks. The CTM tries to capture the second type of costs, which are typically ignored in the classic risk analysis framework. We propose new risk analysis formulas that tie the CTM concept into accurate calculation of Return on Investment (ROI), otherwise commonly known as Return on Security Investment. Finally, through a case study we demonstrate the effect of IDS deployment techniques on threat mitigation and the ROI. The result of the case can be used to support effective decision-making about which techniques are appropriate for the cost effective management of the IDS in a given environment.

Introduction

The recent CSI-FBI survey [1] of 503 American organizations reveals the concerns of business leaders on the increase in security breaches as a result of online electronic commerce. Of the 503 organizations surveyed, 90% detected a security breach of their information systems and 80% experienced financial losses as a result of breaches. While internal threats remain a top priority, 40% cited breaches from outside their organization. Additionally, 85% experienced viruses and 74% stated their Internet connection was most frequently targeted. The most signification piece of data from this survey indicates that 90% of these respondents have a Web site, 90% have firewalls and antivirus programs and 100% conduct business electronically in some fashion.

The statistics in the survey points to a notable trend, not necessarily the percentages, but simply that 100% of those surveyed are conducting business electronically and 90% of them have firewalls and antivirus, yet 90% reported system breaches. Protecting information systems today must be done in a layered process, which includes technology and human analysis. As the CSI-FBI survey revealed, most companies have already deployed firewalls and antivirus programs, and many are moving aggressively towards acquiring intrusion detection systems (IDSs), a security system that monitors computer systems and network traffic and analyzes that traffic for possible hostile attacks originating from outside the organization and also for system misuse or attacks originating from inside the organization.

But given the need to demonstrate the value of an IDS deployment especially when multiple deployments are involved, organizations must justify implementation expenses by proving that the IDS is a value added resource. The justification is to prove that the deployment of the IDS is going to lead to a reduction in the annual loss expectancy (ALE) and the Return on Security Investment (ROSI). This is realized if the IDS is able to effectively detect and deter attacks.

One method for justifying IDS is by determining the value of the ALE using conventional cost/benefit (risk) assessment; the ALE represents the cost/benefit break-even point for risk mitigation measures. In other words, the organization could justify spending up to the dollar amount equivalent of the ALE per year to prevent the occurrence or reduce the impact of a fire. A risk assessment can identify what types of intrusions a company's infrastructure is vulnerable to and the potential for loss should an attack occur. It will also provide the justification of IDS deployment as an effective safeguard. Another way to analyze the benefits of IDS is to document the misuses of an organization's network. The CSI-FBI survey shows that 78% of the respondents detected employee misuse of its systems and its Internet connection. This included web surfing, email abuse, and use of company hardware/software for personal gain. This misuse directly increases the risk of systems being attacked and information compromised, which can be tied to justifying the need and expense of IDS.

An alternative method for justifying IDS is to demonstrate the ability of the IDS to effectively detect and deter attacks in quantifiable measures. There are performance studies [2], [3], [4] that demonstrate the different aspects to this. A more elaborate discussion on the performance studies is given in Section 2.

In this paper, we review risk analysis methodologies, introduce new (Cascading Threat Multiplier, CTM) concepts into risk equations, explore the impact of threat mitigation on the ALE and correlate the effect of IDS management technique on threat mitigation.

The rest of the paper is organized as follows. In Section 2, we discuss current IDS deployment and implementation methods. We discuss risk assessment methodologies in Section 3. In Section 4, we present a novel concept to risk analysis—the CTM and discuss the relation of the ALE to threat mitigation in Section 5. We then present a case study to illustrate the impact of deployment techniques on ALE reduction and a positive Return on Investment (ROI) in Section 6.