Paul R. Garvey

An information architecture for risk assessment and management

As systems become more complex, project managers need a means of accessing risk management experience gained on other projects. To address this need, the authors developed RAMP (Risk Assessment and Management Program), a risk management information system that provides interactive support for identifying, analyzing and sharing risk mitigation experience.

Modelling and measuring the operability of interdependent systems and systems of systems: advances in methods and applications

Interdependency is an important consideration in managing systems and systems of systems. Included in this consideration is identifying, representing, and measuring the ripple effects of dependencies between systems and consumers who rely on their products and services. Anticipating these effects enables planners to minimise dependency risks that, if realised, can have cascading impacts on the ability of systems to deliver services. This paper presents advances in modelling interdependent systems by integrating two methods: functional dependency network analysis (FDNA) and the inoperability input-output model (IIM). Their integration enables hierarchical modelling of perturbations to systems at the physical or operational network levels. To highlight the insights gained by integrating FDNA and IIM, a simulated electric power system that feeds a large metropolitan area is presented. This simulated case demonstrates that other consequence measures, such as the inoperability metric presented herein, must be used in conjunction with monetary objectives to generate holistic prioritisation strategies.

A macro method for measuring economic‐benefit returns on cybersecurity investments: The table top approach

Critical considerations in engineering todays systems are securing the collection, access, and dissemination of the information they contain. Advanced computing technologies, ubiquitous environments, and sophisticated networks enable globally distributed access to data and information repositories to an uncountable community of consumers. Engineering security into these systems is more challenging and sophisticated than ever before. Along with this, assuring the integrity of highly networked systems requires economic decisions in rapidly changing technology and threat environments. Recognizing that countermeasures effective against cyber intrusions today can be ineffective tomorrow, the systems engineering community needs a rapid and agile way to identify the efficacies of competing countermeasure investment decisions. This paper presents a macroanalytic method for measuring economic-benefit returns on investments in cybersecurity. The method is called the Table Top Approach. The table top approach is designed to place light demands on the granularity of inputs to evaluate the impacts of cyber intrusion events and the benefits of countermeasure investments. The table top approach derives which investments in a set of competing choices offer the greatest cost-benefit gains in cyber defense, and why. It finds sets of Pareto efficient cost-benefit investments, and their economic returns, that capture tangible and intangible advantages of countermeasures that strengthen cybersecurity. ©2012 Wiley Periodicals, Inc. Syst Eng 16

A Joint Probability Model for Cost and Schedule Uncertainties

Abstract Systems being acquired by the Department of Defense face numerous technical and programmatic uncertainties that can significantly impact cost and schedule estimates. Although it has long been recognized that cost and schedule are correlated, little has been studied on the degree that they are correlated or on methodologies for analyzing their joint behavior. This paper proposes a model from which the joint probability distribution of total program cost and schedule can be described, analyzed, and presented to decisionmakers. Specifically, the bivariate lognormal distribution is presented. Observations generated from independently conducted Monte-Carlo simulations suggest the bivariate lognormal is representative of the joint behavior between cost and schedule probability distributions. To our knowledge, this is the first time the bivariate lognormal has been proposed to model cost-schedule probability tradeoffs in the work breakdown structure. A follow-on paper* generalizes this work and presents...

A Family of Joint Probability Models for Cost and Schedule Uncertainties

Tiis paper discusses a family of analytical models from which the joint probability of total program cost and schedule can be calculated, analyzed, and presented to decision-makers. Specifically, the classical bivariate normal and two lesser known joint distributions, the normal-lognormal and the bivariate lognormal distributions are discussed. Experiences from Monte Carlo simulations suggest that this family of bivariate distributions are candidate models for computing joint and conditional cost and schedule probabilities. In particular, the discussion on the nonnal-lognormal distribution as a joint cost-schedule probability model extends research on the applicability of the bivariate lognormal presented last year*. Joint probability distributions enable analysts and decision-makers to determine joint and conditional probabilities of the types

Analytical Frameworks to Assess the Effectiveness and Economic-Returns of Cybersecurity Investments

Critical considerations in engineering todays systems are securing the collection, access, and dissemination of the information they contain. Advanced computing technologies, ubiquitous environments, and sophisticated networks enable globally distributed information access to an uncountable number of consumers - and adversaries. Assuring the integrity of todays missions, and the highly networked systems they depend on, requires economic decisions in rapidly changing technology and cyber threat environments. Knowing that countermeasures effective against todays threats can be ineffective tomorrow, decision-makers need agile ways to assess the efficacies of investments in cyber security on assuring mission outcomes. Analytical methods in cyber security economics need to be flexible in their information demands. Some investment decisions may necessitate methods that use in-depth knowledge about a missions information systems and networks, vulnerabilities, and adversary abilities to exploit weaknesses. Other investment decisions may necessitate methods that use only a high-level understanding of these dimensions. The sophistication of methods to conduct economic-benefit tradeoffs of mission assuring investments must calibrate to the range of knowledge environments present within an organization. This paper presents a family of analytical frameworks to assess and measure the effectiveness of cyber security and the economic-benefit tradeoffs of competing cyber security investments. These frameworks demonstrate ways to think through and shape an analysis of the economic-benefit returns on cyber security investments - rather than being viewed as rigid model structures.

Three methods for quantifying software development effort uncertainty

Abstract Software development effort estimates have several major sources of uncertainty. Among these uncertainties are the size of the project, the development attribute ratings, and the error of the estimation model. This paper presents three methods which quantify the effects of these uncertainties on development effort estimates. One method takes advantage of the invertibility of the nonlinear effort models to approximate the effort probability distribution. In the case of a single software configuration item, this methods yields the exact probability distribution. A second method uses Taylor series to estimate mean and variance of effort, and then specifies its probability distribution by invoking the Central Limit Theorem. The third method, specific to the Constructive Cost Model (COCOMO), invokes a Monte Carlo simulation technique to approximate the effort probability distribution. The results of case studies based on the COCOMO model are presented and compared. The mathematical details are provide...

Enhanced Scenario-Based Method for Cost Risk Analysis: Theory, Application, and Implementation

In 2006, the scenario-based method was introduced as an alternative to advanced statistical methods for generating measures of cost risk. Since then, enhancements to the scenario-based method have been made. These include integrating historical cost performance data into the scenario-based methods algorithms and providing a context for applying the scenario-based method from the perspective of the 2009 Weapon Systems Acquisition Reform Act. Together, these improvements define the enhanced the scenario-based method. The enhanced scenario-based method is a historical data-driven application of scenario-based method. This article presents enhanced scenario-based method theory, application, and implementation. With todays emphasis on affordability-based decision-making, the enhanced scenario-based method promotes realism in estimating program costs by providing an analytically traceable and defensible basis behind data-derived measures of risk and cost estimate confidence. In memory of Dr. Steve Book, nulli secundus, for his kindness and devotion, and for his invaluable comments and insights on an earlier draft.

A General Analytic Approach To System Cost Uncertainty Analysis

This paper presents the foundations of a recently developed analytic approach to system cost uncertainty analysis. The approach is referred to as the Analytic Cost Probability (ACOP) model; and its structure is sufficiently general to meet the characteristics of any program definition. The analytic nature of the ACOP model facilitates the identification of cost variance drivers and measures their overall impact on the system cost. The ACOP model offers several techniques for treating correlation between cost elements of a work breakdown structure; a technical issue that has not been widely discussed in the literature or accounted for in existing models. An illustrative analysis using the ACOP model on a hypothetical system is presented, and the mathematical foundations of the model are provided so that the cost analysis community may review, comment on, and expand upon the approach within their organizations.

A Scenario-Based Method for Cost Risk Analysis

Abstract This article presents an approach for performing an analysis of a programs cost risk. The approach is referred to as the scenario-based method (SBM). This method provides program managers and decision-makers an assessment of the amount of cost reserve needed to protect a program from cost overruns due to risk. The approach can be applied without the use of advanced statistical concepts or Monte Carlo simulations, yet is flexible in that confidence measures for various possible program costs can be derived.