To define a mathematical model to evaluate the impact of a vulnerability in an information infrastructure, we consider a zero sum game between an attacker and a defender, each allocating a fixed amount of resources to search for vulnerabilities. To prevent attacks, the resources allocated by the defender search for vulnerabilities to remove them. Instead, the attacker ones search for vulnerabilities to attack the infrastructure. Attacks results in a defender loss that, in the simplest case, is proportional to the time in-between the discovery of a vulnerability by an attacker resource and the discovery of the vulnerability by a defender one. We define conditions for Nash equilibrium where a player cannot improve its utility by changing its move only and show that the corresponding allocation requires a large defender investment with a low return. A condition is introduced to evaluate when open code components should be preferred.
IOS Press, Inc.
6751 Tepper Drive
Clifton, VA 20124
Tel.: +1 703 830 6300
Fax: +1 703 830 2300 email@example.com
(Corporate matters and books only) IOS Press c/o Accucoms US, Inc.
For North America Sales and Customer Service
West Point Commons
Lansdale PA 19446
Tel.: +1 866 855 8967
Fax: +1 215 660 5042 firstname.lastname@example.org