Program portfolio selection for reducing prioritized security risks

The methodology presented here solves an R&D program portfolio selection problem that arises in critical infrastructure protection and similar security risk reduction problems. It requires priorities to be assigned to the risks, existing risk levels to be assessed, and the effectiveness of alternative risk reduction programs to be estimated. A lexicographic optimization procedure involving mixed integer programming with preemptive priorities is developed and illustrated, and extensions are discussed.