CyDRA: Risk and Vulnerability Assessment in Transactions under Security Threats

CyDRA project is dedicated to solving difficult security-by-design issues in transactional systems, processing financial, commercial, and business information. The design of such systems must guarantee the security of their operation by lowering the risk of unauthorized intrusions, malfunctioning, and malicious activities. This is a big concern for banks and insurance companies, in electronic commerce and digital businesses as well as for online service providers.

Most existing solutions are based on complex security frameworks, which are expensive, inflexible, and inefficient.

CyDRA software solution addresses the above problems using a methodology for risk assessment and vulnerability analysis based on the use of a powerful model of transactions under stress, known as Partially Observable Markov Decision Process model (POMDP). This model is configurable both in terms of architecture and component parameters. It allows the security professionals to create interactively a model of the security infrastructure, formulate security policies, and by interactive experimentation, create an optimal design with guaranteed lowest level of security risks.

This is possible thanks to the graph modeler, which provides a starting point for the analysis and through a set of templates can be easily customized. CyDRA software implements several original methods for the analysis of the vulnerability and assessment of the security risks which combine technological and theoretical innovations and thus, allow very compact and efficient implementation.

The core CyDRA software can be installed as a desktop application or as a service and can be used using a standard Web browser. It is offered free of charge to allow demonstration of the modeling and for testing the computations. The customers can purchase separate packages from the software ecosystem that best suit their needs - either directly from the vendor, or from licensed resellers:

**Bronze Package:** A set of templates helping the manual design by providing drop-down menu options with predefined meaning for network engineers and security architects

**Silver Package:** Additional policy plugins guiding the process of designing the model of the security infrastructure for security architects and security analysts

**Gold Package:** Advanced vulnerability analysis and reinforcement learning modules for optimal tunning, suitable for senior security consultants

**Platinum** **Package:** Training in modelling and expert support decision-making on different levels for all security professionals

In addition, the business customers will be able to assess the resilience and robustness of their existing or design a new security architecture for their business from licensed consultancy companies and certified agencies.