Cyber Modeling and Simulation and System Risk Analysis

A new wrinkle with cyber, however, is the active agency of the perpetrator compromising software vulnerability; failure rates proportional to attacker's skill. The “people” part of cyber vulnerability, well‐known as the most common threat vector, is a challenge to model. Evaluating a system's availability for mission performance, a solved problem for manufacturing quality control, is currently an issue in assessing information technology (IT) and cyber physical system risk. One example of risk evaluation is “war gaming” cyber, via modeling and simulation (M&S). This chapter provides an end‐to‐end process for translating interview data to failure rate “models” used to estimate vulnerability for a system of interest, providing an enterprise cyber risk estimate at one instant in time. The opacity of cyberattack/exploit data therefore presents a counting problem for developing model‐based approaches. Future work includes both technical and management tools for evaluating systems for cyber security.