Abstract
Security patching is one of the most effective ways to ensure the security of enterprise information systems. However, deciding when to perform patching operations remains a challenging problem for IT managers. On the one hand, to minimize the risk of being attacked, enterprises should install patches timely and frequently. However, frequent patching operations can result in a high patching cost, and unscheduled patching operations can cause business disruptions. On the other hand, failure to install patches in time can increase the risk of system breaches, which is well-known to be highly costly. Therefore, to derive an optimal patching policy, it is necessary to make a trade-off between these costs. Existing patching policies are either static in nature or incur business disruptions, thus leaving room for improvement. The present research proposes a novel dynamic patching policy (DPP) to minimize the total system cost. Specifically, we formulate the patching problem as a Markov Decision Process (MDP) problem and derive the optimal policies under both finite and infinite time horizons. Compared with benchmark policies proposed in prior studies, the proposed DPP strikes the right balance between policy flexibility and orderly execution of patching, thus avoiding unnecessary patching operations as well as business disruption costs. Results from a series of simulated experiments show that the DPP can reduce the total system costs by more than 10% compared with benchmark policies. Given its theoretical advantage and superior empirical performance, we propose that the proposed DPP will be the policy of choice for security patch management.
Awards
🏆 Best Workshop Paper (Runner-up) in CSWIM 2021.