A Near Real-Time System for Security Assurance Assessment

Abstract

Building systems that are guaranteed to be secure or to remain secure over time is still an unachievable goal. The need for a tool that helps to determine security assurance level of a system is therefore vital in order to maintain and improve overall security. This paper introduces our system to assess the overall security assurance of a large, networked, IT-driven system in terms of a dedicated evaluation infrastructure based on multiagent technology. We use attack graph approach to compute an attackability metric value and define other metrics for anomaly detection to assess both the static and dynamic visions of the system under study. The implemented software system is described, and the examples of experiments for evaluating of network component, sub network and network security assurance levels are considered.

A Risk Based Approach for Security Assurance Evaluation of IT Systems

“…This implies two countermeasures with the reduction effect of 60% or 0.6 and 80% (0.8) will cumulatively effect the same risk with (1-(1-0.6)*(1-0.8)) =1-(0.4)*(0.2) = 0.92. In case more than one risk is associated to an entity, a suitable aggregation function that we refer to as AGF should be selected to aggregate the corresponding reductions effect on those associated risks as shown in (2). This is relevant as risks to a system or an IT component will not have the same importance.…”

“…Security assurance plays an important role in maintaining and improving the security level of system components and making them therefore more reliable. In that context, recent efforts [1] [2] within the field have been directed towards utilizing quantitative indicators in a more systematic and coordinated fashion to capture the security state of a particular Information Technology (IT) infrastructure. Until recently the focus was mainly on developing qualitative metrics that usually lead to security assurance levels that are either not accurate and/or not repeatable.…”

Modeling Modern Network Attacks and Countermeasures Using Attack Graphs

“…A comprehensive review of past attack graph research is presented in [8]. More recent approaches include [11], [18], and [19] Figure 6. Order of Vulnerability Instance Compromise in Six Scenarios.…”

“…The MulVAL system [21] used in [18] also does not explicitly model firewalls but assumes reachability is provided. Research in [19] uses our prior NetSPA system and thus scales well, but like our prior research, modern attacks and countermeasures are not modeled. Commercial attack graph products such as RedSeal [22] and Skybox [23] model firewalls and compute reachability from firewall rules but neither product's website mentions the ability to model personal firewalls, IPSs, or client side attacks.…”

Towards security effectiveness measurement utilizing risk-based security assurance

“…Even if it was possible, assurance on security controls is very difficult once they have been deployed. Some researchers, such as Pham et al [22], have suggested using attack graphs and anomaly detection metrics. However, this approach lacks security effectiveness metrics.…”