U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.


Optimizing Investments in Security Countermeasures: A Practical Tool for Fixed Budgets

Published: September 11, 2007 | Last revised: May 13, 2013

Author(s): Eric D. Hough, Hassan Osman, Jonathan Caulkins, and Nancy Mead Maturity Levels and Audience Indicators: L2  / L M  SDLC Life Cycles: Requirements Copyright: Copyright © Carnegie Mellon University and IEEE 2005-2013.


Software engineers and businesses must make the difficult decision of how much of their budget to spend on software security mitigation for the applications and networks on which they depend. This article introduces a novel method of optimizing using integer programming (IP), the combination of security countermeasures to implement to maximize system security under fixed resources. The steps in the method and recent results with a case study client are described.

This article has been published in the September/October 2007 issue of IEEE Security & Privacy and is available for download under Additional Resources.

Back to Top