A Scalable Game-Theoretic Approach for Selecting Security Controls from Standardized Catalogues

1. Problem Statement

Selecting the optimal combination of security controls from large standardized catalogues (e.g., NIST SP 800-53, ITSG-33) is a complex decision-making challenge.

• Scale and Complexity: Catalogues contain hundreds of controls. The number of possible combinations grows exponentially ($2^N$), making manual selection or brute-force optimization infeasible for large systems.
• Dependencies and Constraints: Controls often have dependencies (e.g., a policy control is required before an implementation control) and must adhere to budget constraints.
• Limitations of Existing Approaches:
  • Optimization-based methods: Often rely on precise probability estimates for threat likelihoods and control success rates, which are rarely available in real-world scenarios.
  • Human Element: Many existing methods treat the problem as a static mathematical optimization, ignoring the strategic, adversarial nature of cybersecurity where attackers actively adapt to defenses.
  • Scalability: Most automated tools fail to handle the computational complexity of large control spaces combined with dependency constraints.

2. Methodology

The authors propose a two-person zero-sum one-shot game-theoretic approach where a security analyst (defender) selects a strategy (a combination of controls) to counter an expected attacker profile. The methodology consists of six steps:

A. Identification and Formalization

1. Identify Applicable Atomic Controls: The analyst selects indivisible controls from a catalogue (e.g., ITSG-33) relevant to the system's threat model (e.g., STRIDE). Mandatory controls are identified, and others are marked as optional.
2. Assign Effectiveness: For each atomic control, the analyst assigns an effectiveness value (0 to 1) for satisfying specific security objectives (Confidentiality, Integrity, Availability) on specific assets.
3. Assign Cost: A cost (monetary or effort) is assigned to each atomic control.

B. Algebraic Generation of Valid Strategies

To handle dependencies and constraints without brute-forcing all combinations:

• Security Control Algebra: The authors utilize Product Family Algebra (based on semirings) to formally define the set of valid control combinations.
  • Operators: $\oplus$ (choice/optional), $\odot$ (mandatory composition), and a requirement relation ($\to$) for dependencies.
  • Budget Rule: A function filters combinations where the total cost exceeds the prescribed budget $B$.
• This algebraic formalism allows the generation of a set of Valid Control Combinations (strategies) that respect both technical dependencies and financial constraints.

C. Game Construction and Play

4. Construct the Game Matrix:
   • Rows: Valid control combinations (Defender strategies).
   • Columns: Security objectives on assets that the attacker might target (Attacker strategies).
   • Payoffs: Calculated using an inductive formula inspired by NASA's DDP approach. For a combination $a \odot b$, effectiveness is $1 - (1 - Eff(a))(1 - Eff(b))$, representing the compounded protection.
5. Play the Game:
   • The analyst defines an Attacker Profile, which prioritizes specific assets and security objectives (e.g., "Attacker targets Confidentiality of Asset X first, then Integrity of Asset Y").
   • The tool iteratively filters the valid combinations to find those that maximize effectiveness against the prioritized attacker objectives in order.
   • The result is a set of suggested control combinations that offer the best defense against the specific attacker profile within the budget.

3. Key Contributions

• Game-Theoretic Framework for Control Selection: Unlike previous optimization methods, this approach explicitly models the adversarial dynamic between defender and attacker without requiring precise probability distributions of attack success. It focuses on attacker objectives rather than attack probabilities.
• Algebraic Handling of Dependencies: The introduction of Product Family Algebra to model control dependencies and generate valid combinations ensures that the solution space is logically consistent and respects mandatory requirements.
• Scalable Automation (CSAT Tool): The authors developed the Control Selection Assistant Tool (CSAT). It automates the complex algebraic generation and game-playing logic.
  • It solves the bounded 0-1 knapsack problem to identify candidate combinations efficiently, avoiding the need to enumerate all $2^N$ possibilities.
  • It handles uncertainty by generating results for different permutations of effectiveness ratings.
• Real-World Applicability: The approach is designed to work with standard catalogues (ITSG-33) and realistic constraints (budget, dependencies).

4. Results and Case Study

The approach was validated using a fictional Canadian military IoT system ("Ravenclaw") with the following parameters:

• System: 7 assets (Sensors, UAVs, Satellite Channel, Interfaces, Processing System, Database).
• Controls: 8 mandatory controls and 39 optional controls from the ITSG-33 catalogue.
• Budget: $950,000.
• Scenarios:
  • Scenario 1 (Broad Attack): Attacker targets all CIA triads of interfaces and databases. Result: 1 optimal combination found in 10.6 seconds.
  • Scenario 2 (Targeted Attack): Attacker targets Integrity/Availability of physical sensors and interfaces. Result: 2 optimal combinations found (depending on uncertainty in audit control effectiveness) in 16 minutes and 44 seconds.
• Performance: The tool successfully handled 39 optional controls (generating $2^{39}$ theoretical combinations) and filtered them down to optimal strategies within a reasonable timeframe. The tool was shown to handle up to 50 optional controls in approximately one hour.

5. Significance

• Bridging Theory and Practice: The paper demonstrates that game theory can be applied practically to security engineering, moving beyond theoretical models to a tool-supported workflow.
• Human-Centric Decision Support: By focusing on attacker profiles and objectives rather than unknown probabilities, the method aligns better with how security analysts actually think and plan.
• Scalability: It addresses the "combinatorial explosion" problem in control selection, proving that large-scale systems with complex dependencies can be analyzed automatically.
• Decision Confidence: The tool provides security analysts with a mathematically grounded, repeatable justification for their control selection, reducing reliance on intuition and mitigating the risk of leaving critical assets vulnerable due to poor control combinations.

In conclusion, this work presents a robust, scalable, and automated framework for selecting security controls that effectively balances budget, technical dependencies, and adversarial strategy.