  We introduce a novel framework for computing optimal randomized security
policies in networked domains which extends previous approaches in several
ways. First, we extend previous linear programming techniques for Stackelberg
security games to incorporate benefits and costs of arbitrary security
configurations on individual assets. Second, we offer a principled model of
failure cascades that allows us to capture both the direct and indirect value
of assets, and extend this model to capture uncertainty about the structure of
the interdependency network. Third, we extend the linear programming
formulation to account for exogenous (random) failures in addition to targeted
attacks. The goal of our work is two-fold. First, we aim to develop techniques
for computing optimal security strategies in realistic settings involving
interdependent security. To this end, we evaluate the value of our technical
contributions in comparison with previous approaches, and show that our
approach yields much better defense policies and scales to realistic graphs.
Second, our computational framework enables us to attain theoretical insights
about security on networks. As an example, we study how allowing security to be
endogenous impacts the relative resilience of different network topologies.
