[Paper Review] On Game-Theoretic Risk Management (Part Three) - Modeling and Applications

Stefan Raß|arXiv (Cornell University)|Nov 2, 2017

Complex Systems and Decision Making15 references3 citations

TL;DR

This paper presents a game-theoretic risk management framework that models risks using probability distributions rather than point estimates, enabling expert-driven, anonymous, and distributed risk assessments. By integrating loss models and Nash equilibrium analysis into the ISO 27000 risk management process, it supports systematic risk prioritization and resilience optimization, particularly for advanced persistent threats and social engineering attacks.

ABSTRACT

The game-theoretic risk management framework put forth in the precursor reports "Towards a Theory of Games with Payoffs that are Probability-Distributions" (arXiv:1506.07368 [q-fin.EC]) and "Algorithms to Compute Nash-Equilibria in Games with Distributions as Payoffs" (arXiv:1511.08591v1 [q-fin.EC]) is herein concluded by discussing how to integrate the previously developed theory into risk management processes. To this end, we discuss how loss models (primarily but not exclusively non-parametric) can be constructed from data. Furthermore, hints are given on how a meaningful game theoretic model can be set up, and how it can be used in various stages of the ISO 27000 risk management process. Examples related to advanced persistent threats and social engineering are given. We conclude by a discussion on the meaning and practical use of (mixed) Nash equilibria equilibria for risk management.

Motivation & Objective

• To address the limitations of conventional risk management, which rely on consensus-based single-value risk assessments and face-to-face expert meetings.
• To develop a method that preserves all expert opinions by modeling risk as probability distributions, avoiding information loss during aggregation.
• To enable practical integration of game-theoretic risk models into the ISO 27000 risk management lifecycle, including risk assessment, prioritization, and treatment.
• To support privacy-preserving risk assessment by anonymizing threats and countermeasures using abstract identifiers (e.g., T1, C1), enabling third-party service use.
• To provide a decision framework that maintains full uncertainty and expert judgment throughout the risk analysis process, avoiding forced consensus.

Proposed method

• Constructs nonparametric loss models using kernel density estimation with bandwidth parameters to represent expert uncertainty and variability in risk assessments.
• Uses anonymous, asynchronous, individual expert surveys to collect distributional risk assessments, reducing social bias and improving data quality.
• Applies stochastic ordering and rate ratio tests (e.g., rateratio.test in R) to validate and verify the statistical robustness of risk models.
• Integrates game-theoretic models into the ISO 27000 process, mapping threat-countermeasure pairs into a matrix game with distributional payoffs.
• Employs mixed Nash equilibria to identify optimal defense and attack strategies, with interpretation focused on minimizing worst-case risk exposure.
• Supports software deployment via web services, where abstract threat and countermeasure labels (T1, C1) preserve organizational confidentiality.

Experimental results

Research questions

• RQ1 How can risk assessments be modeled using probability distributions to preserve expert uncertainty and avoid consensus-driven simplification?
• RQ2 In what ways can game-theoretic models with distributional payoffs be integrated into the ISO 27000 risk management lifecycle?
• RQ3 How can expert surveys be structured to collect distributional risk assessments while minimizing bias and maximizing data quality?
• RQ4 What is the practical value of mixed Nash equilibria in guiding risk treatment and infrastructure resilience decisions?
• RQ5 How can the method be deployed as a secure, privacy-preserving web service without exposing sensitive threat or countermeasure information?

Key findings

• The method avoids consensus problems by preserving all expert opinions as probability distributions, ensuring no information is lost during aggregation.
• Expert surveys conducted asynchronously and anonymously yield higher-quality data by reducing social influence and enabling participation from external stakeholders like customers.
• The use of kernel density estimation with adjustable bandwidth allows experts to express uncertainty and fuzziness in risk assessments, including likelihoods of alternative outcomes.
• The framework enables the modeling of joint threat scenarios by assigning probabilities to multiple damage levels, even when focusing on a primary threat.
• The game-theoretic equilibrium provides a robust basis for risk treatment, identifying optimal defense strategies that minimize worst-case risk exposure.
• The method supports secure outsourcing of risk modeling via web services, as threats and countermeasures can be anonymized using abstract labels without compromising model solvability.