Aggregating vulnerability metrics in enterprise networks using attack graphs

Abstract

Quantifying security risk is an important and yet difficult task in enterprise network security management. While metrics exist for individual software vulnerabilities, there is currently no standard way of aggregating such metrics. We present a model that can be used to aggregate vulnerability metrics in an enterprise network, producing quantitative metrics that measure the likelihood breaches can occur within a given network configuration. A clear semantic model for this aggregation is an important first step toward a comprehensive network security metric model. We utilize existing work in attack graphs and apply probabilistic reasoning to produce an aggregation that has clear semantics and sound computation. We ensure that shared dependencies between attack paths have a proportional effect on the final calculation. We correctly reason over cycles, ensuring that privileges are evaluated without any self-referencing effect. We introduce additional modeling artifacts in our probabilistic graphical model to capture and account for hidden correlations among exploit steps. The paper shows that a clear semantic model for aggregation is critical in interpreting the results, calibrating the metric model, and explaining insights gained from empirical evaluation. Our approach has been rigorously evaluated using a number of network models, as well as data from production systems.

Behavioral and Game-Theoretic Security Investments in Interdependent Systems Modeled by Attack Graphs

“…In particular, humans (i) compare uncertain outcomes with a reference utility or cost, (ii) exhibit risk aversion in gains and risk seeking behavior in losses, and (iii) overweight losses compared to gains (loss aversion). A richer behavioral model, referred to as cumulative prospect theory [10], incorporates all these aspects in its cost function. However, in the setting of this paper, this richer model does not significantly change the cost functions of the defenders.…”

“…In the context of large-scale interdependent systems, adversaries often use stepping-stone attacks to exploit vulnerabilities within the network in order to compromise a particular target [9]. Such threats can be captured via the notion of attack graphs that represent all possible paths that attackers may have to reach their targets within the CPS [10]. The defenders in such systems are each responsible for defending some subset of the assets [2,11] with their limited resources.…”

P<inline-formula><tex-math>$^{2}$</tex-math><alternatives> <inline-graphic xlink:type="simple" xlink:href="holm-ieq1-2382574.gif"/></alternatives></inline-formula>CySeMoL: Predictive, Probabilistic Cyber Security Modeling Language

“…CySeMoL, the tool P 2 CySeMoL bases some of its logic on, is presented in Section 3.1. MulVAL [7], [8], [9], [10] uses the output from network vulnerability scanners to model possible attacks on IT architectures. In MulVAL, each vulnerability is associated with a probability that represents how likely an attacker is to successfully exploit it [10].…”

“…MulVAL [7], [8], [9], [10] uses the output from network vulnerability scanners to model possible attacks on IT architectures. In MulVAL, each vulnerability is associated with a probability that represents how likely an attacker is to successfully exploit it [10]. These probabilities are derived from each vulnerability's denoted access-complexity value according to the Common Vulnerability Scoring System (CVSS) v2 [11] and intuition by the authors.…”

Difficulty-level metric for cyber security training

“…Then, the authors identify the presence of cycles in the attack graphs and extend the definition accordingly to propagating probability over cycles. In [22], [23], the authors utilize existing MulVAL attack graphs and apply probabilistic reasoning to produce an aggregation metric. It is very similar to our work except that they only use CVSS' Access Complexity as node's metric and map them to three fixed probability such as low to 0.9, medium to 0.6, and high to 0.2.…”