Modeling risk analysis of a layered commercial solution for a classified program when a patient attacker is present

Layered security systems pose significant challenges while attempting to monitor security related activities. The varying attributes embedded within each layer as well as the attribute interdependencies within and across layers takes measurement complexity to an exponential state. The many interdependencies at play in an interconnected infrastructure further exacerbates the ability to measure overall security assurance. Then enters the patient attacker who infiltrates one layer of this security system and waits for the opportune time to infiltrate another layer. The ability to simulate and understand risk with respect to time in this dynamic environment is critical to the decision maker who must work under time and cost constraints. This thesis seeks to improve methods for interdependent risk assessment particularly when a patient attacker is present