A Hybrid Tabu Genetic Metaheuristic for Selection of Security Controls

2. Related Work

Determining the set of security controls that are appropriate and cost effective for a given situation is a complex task as it involves, matching the threats to vulnerabilities, identifying the frequency of the attacks, and mapping between the vulnerabilities to the security controls. The techniques that have been proposed in the literature for solving this multi-objective problem can be classified into defence based approaches and optimization-based approaches. The defence based approaches address from the attacker perspective and use attack countermeasure trees and scenario modelling to decide on appropriate security controls. The optimization-based approaches however focus on the objectives such as cost of security controls, vulnerabilities addressed and residual risks. Economic indicators like return on investment, net present value are also used to find the suitable security controls.