Risk management for cyber-infrastructure protection: A bi-objective integer programming approach

Information and communication technology supply chains present risks that are complex difficult for organizations to manage. The cost benefit of proposed security controls must be assessed best match an organizational risk tolerance direct the use resources. In this paper, we integer stochastic optimization models selecting a portfolio within budget. We consider two objectives: maximize reduction across all potential attacks number whose levels lower than threshold after applied. Deterministic bi-objective budgeted difficulty-threshold control selection problems formulated mitigating reflect organization’s preference. problem, uncertainty as whether selected can reduce associated with attacks. demonstrate through computational study trade-off between objectives is important certain preferences budgets. value model when relatively high desired secured past show deterministic solution provides near optimal solutions otherwise. provide analysis solutions.