Title: When to Invest in Security? Empirical Evidence and a Game-Theoretic Approach for Time-Based Security,
Abstract: Games of timing aim to determine the optimal defense against a strategic
attacker who has the technical capability to breach a system in a stealthy
fashion. Key questions arising are when the attack takes place, and when a
defensive move should be initiated to reset the system resource to a known safe
state.
In our work, we study a more complex scenario called Time-Based Security in
which we combine three main notions: protection time, detection time, and
reaction time. Protection time represents the amount of time the attacker needs
to execute the attack successfully. In other words, protection time represents
the inherent resilience of the system against an attack. Detection time is the
required time for the defender to detect that the system is compromised.
Reaction time is the required time for the defender to reset the defense
mechanisms in order to recreate a safe system state.
In the first part of the paper, we study the VERIS Community Database (VCDB)
and screen other data sources to provide insights into the actual timing of
security incidents and responses. While we are able to derive distributions for
some of the factors regarding the timing of security breaches, we assess the
state-of-the-art regarding the collection of timing-related data as
insufficient.
In the second part of the paper, we propose a two-player game which captures
the outlined Time-Based Security scenario in which both players move according
to a periodic strategy. We carefully develop the resulting payoff functions,
and provide theorems and numerical results to help the defender to calculate
the best time to reset the defense mechanism by considering protection time,
detection time, and reaction time.