# CISAF: A Framework for Estimating the Security Posture of Academic and Research Cyberinfrastructure

## TL;DR

CISAF is a systematic framework designed to evaluate and improve the security posture of academic and research cyberinfrastructures by identifying risks and prioritizing mitigation strategies.

## Contribution

The paper introduces CISAF, a novel, mission-centric framework tailored for assessing security risks in heterogeneous academic cyberinfrastructures.

## Key findings

- Provides a structured approach for security analysis
- Helps prioritize mitigation actions based on risk assessment
- Integrates architecture, mission, and attack analysis

## Abstract

Academic and research cyberinfrastructures (AR-CIs) present unique security challenges due to their collaborative nature, heterogeneous components, and the lack of practical security assessment frameworks tailored to their needs. We propose Cyber Infrastructure Security Analysis Framework (CISAF) -- a simple, systematic, mission-centric approach to analyze the security posture of a CI and prioritize mitigation actions. CISAF guides administrators through a top-down process: (1) defining unacceptable losses, (2) identifying associated system hazards and critical assets, (3) analyzing possible attack paths that target these critical assets, and (4) analyzing security mechanisms that lie on these attack paths. By combining information about the CI architecture, mission, attack vectors, and security mechanisms, CISAF provides a clear overview of potential security risks and offers valuable information to prioritize mitigation actions.