A Scalable Game-Theoretic Approach for Selecting Security Controls from Standardized Catalogues

2025-03-19

AI Summary

This study addresses the automated selection of an optimal subset of security controls from large, standardized control catalogs (e.g., ITSG-33) under budget constraints, inter-control dependencies, and heterogeneous effectiveness. Method: We propose the first approach that algebraically models control dependencies within a zero-sum game framework, formalizing attacker–defender interaction as a single two-player zero-sum game to enable scalable, interpretable, and catalog-aware control selection. Contribution/Results: A Python-based prototype tool was developed and evaluated on a Canadian military system case study. Results demonstrate significant improvements in security objective attainment and budget utilization efficiency, while providing actionable, auditable decision support for critical information infrastructure protection.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Game Theory and Economic Paradigms: Adversarial Learning
• Multiagent Systems: Mechanism Design

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work

Abstract

Selecting the combination of security controls that will most effectively protect a system's assets is a difficult task. If the wrong controls are selected, the system may be left vulnerable to cyber-attacks that can impact the confidentiality, integrity, and availability of critical data and services. In practical settings, as standardized control catalogues can be quite large, it is not possible to select and implement every control possible. Instead, considerations, such as budget, effectiveness, and dependencies among various controls, must be considered to choose a combination of security controls that best achieve a set of system security objectives. In this paper, we present a game-theoretic approach for selecting effective combinations of security controls based on expected attacker profiles and a set budget. The control selection problem is set up as a two-person zero-sum one-shot game. Valid control combinations for selection are generated using an algebraic formalism to account for dependencies among selected controls. Using a software tool, we apply the approach on a fictional Canadian military system with Canada's standardized control catalogue, ITSG-33. Through this case study, we demonstrate the approach's scalability to assist in selecting an effective set of security controls for large systems. The results illustrate how a security analyst can use the proposed approach and supporting tool to guide and support decision-making in the control selection activity when developing secure systems of all sizes.

Problem

• Selecting effective security controls from large standardized catalogues.
• Balancing budget, effectiveness, and dependencies among security controls.
• Using game theory to guide decision-making for secure system development.

Innovation

• Game-theoretic approach for security control selection
• Algebraic formalism to handle control dependencies
• Scalable software tool for large system applications