论文标题
在多利益相关者风险评估中识别和量化权衡取舍，并应用于数据保护影响GDPR评估
Identifying and Quantifying Trade-offs in Multi-Stakeholder Risk Evaluation with Applications to the Data Protection Impact Assessment of the GDPR
论文作者
论文摘要
网络安全风险管理包括多个步骤，包括选择适当的控制措施以最大程度地降低风险。这是一项艰巨的任务，需要搜索一组可用控件的所有可能子集并确定那些将所有利益相关者的风险降至最低的子集。由于利益相关者可能对风险有不同的看法（尤其是在考虑威胁的影响时），因此可能需要发生冲突的目标，这些目标可能需要在各个需求中找到最佳的权衡。在这项工作中，我们提出了一种定量和（半）自动化的方法，以基于众所周知的帕累托最佳概念来解决此问题。为了进行验证，我们展示了基于我们方法的原型工具如何有助于对一般数据保护调节规定的数据保护影响评估对简化但现实的用例情景。我们还通过对原型进行实验评估来评估方法的可伸缩性，并令人鼓舞。
Cybersecurity risk management consists of several steps including the selection of appropriate controls to minimize risks. This is a difficult task that requires to search through all possible subsets of a set of available controls and identify those that minimize the risks of all stakeholders. Since stakeholders may have different perceptions of the risks (especially when considering the impact of threats), conflicting goals may arise that require to find the best possible trade-offs among the various needs. In this work, we propose a quantitative and (semi)automated approach to solve this problem based on the well-known notion of Pareto optimality. For validation, we show how a prototype tool based on our approach can assist in the Data Protection Impact Assessment mandated by the General Data Protection Regulation on a simplified but realistic use case scenario. We also evaluate the scalability of the approach by conducting an experimental evaluation with the prototype with encouraging results.
