Assessing web security risks using dynamic Bayesian network

This paper presents an approach to assess security risks of web systems based on its deployment scenario. First, we propose a conceptual model specifying the characteristics of the cause-effect connections in the formation of security risks. From this conceptual model, we propose a multi-layered dynamic Bayesian network (MLDBN) for integrating temporal factors into the assessment of security risks. This MLDBN allows considering the variation of risk levels and risk likelihood while threat events and vulnerabilities emerging during the deployment process of a web system. An associated mechanism for generating the structure of MLDBN is also proposed. In each deployment scenario, security risks of each asset and security risks of the whole web system are assessed according to three tenets: loss of confidentiality, loss of integrity and loss of availability. The proposed solution is implemented in the form of a risk assessment tool, providing convenient risk assessment and risk monitoring functions for the managers and the experts.