A formal approach to automatically assess and manage ICT risk

Attività Svolte

• Attività di tutoraggio nei corsi di Sicurezza Informatica 2014/2015/2016/2017 • Attività di tutoraggio nei corsi di Informatica Laboratorio 2015 • NATO Locked Shield 2014 • European Cyber Security Month 02/10/2014 • NATO Locked Shield 2015 • Seminari di Monitoraggio Traffico e Sicurezza di Rete 17/03/2016 • Seminari di Monitoraggio Traffico e Sicurezza di Rete 28/04/2016 • NATO Locked Shield 2016

Esami Sostenuti

• Reti ad Hoc e sensori 27/05/2014 • Computer Aided Cryptography 26/06/2014 • Security Threat Identification and Testing 31/12/2014 • TREsPASS Winter School 20/01/2016 • Sensor Networks internet of things 13/07/2016 • Searching by similarity on a very large scale 20/09/2016

Pubblicazioni Presentate

7 PEER-REVIEWD JOURNALS

• Automating the Assessment of ICT Risk • Harùspex: Evaluating Risk without Data • Iterative Selection of Countermeasures for Intelligent Threat Agents • Assessing and Managing the ICT Risk of Power Generation • Selecting Countermeasures for ICT systems Before They are Attacked • Considering Application Vulnerabilities in Risk Assessment and Management • Metriche per la cyber robustezza (Submitted) 3 DIVULGATIVE PAPERS • Valutare e Gestire il Rischio ICT senza Dati Storici (in italian) • La contromisura benefica: non fidarsi è meglio (in italian) • Pensare come un hacker o come un progettista? Sicurezza e self fulfilling profecy (in italian)

15 PEER-REVIEWD CONFERENCE

• GVScan: Scanning Networks for Global Vulnerabilities • QSec: Supporting Security Decisions on an IT Infrastructure (Best Paper) • A Scenario Method to Automatically Assess ICT Risk • Simulating Attack Plans Against ICT Infrastructures • Assessing and Managing ICT Risk with Partial Information • Security Stress: Evaluating ICT Robustness through a Monte Carlo Method

• Producing Data to Assess and Manage the ICT Risk by Simulating Threat Agents • Iterative Selection of Cost-Effective Countermeasures for Intelligent Threat Agents • CyVar: Extending Var-At-Risk to ICT • Harùspex: a Suite to Assess and Manage ICT Risk by Simulating Threat Agents • An Extension of Haruspex to Cover Vulnerabilities in Application Environments • Assessing and Managing Risk by Simulating Attack Chains • Assessing ICT Risk through a Monte Carlo Ecology • Metrics for Cyber Robustness (Best Paper) • Using S-Rules to Fire Dynamic Countermeasures