An Approach to Security Policy Configuration Using Semantic Threat Graphs

Abstract

Abstract. Managing the configuration of heterogeneous enterprise security mechanisms is a wholly complex task. The effectiveness of a configuration may be constrained by poor understanding and/or management of the overall security policy requirements, which may, in turn, unnecessarily expose the enterprise to known threats. This paper proposes a threat management approach, whereby knowledge about the effectiveness of mitigating countermeasures is used to guide the autonomic configuration of security mechanisms. This knowledge is modeled in terms of Semantic Threat Graphs, a variation of the traditional Threat/Attack Tree, extended in order to relate semantic information about security configuration with threats, vulnerabilities and countermeasures. An ontology-based approach to representing and reasoning over this knowledge is taken. A case study on Network Access Controls demonstrates how threats can be analyzed and how automated configuration recommendations can be made based on catalogues of best-practice countermeasures.

A move in the security measurement stalemate

“…Nodes in attack trees can be annotated with quantitative properties, but so far the models have addressed attack possibilities only qualitatively. Such trees can also be augmented with countermeasures, as is done in attack-defence trees [20] and semantic threat graphs [13]. Also, argumentation-based approaches have been proposed to reason about security [33].…”

Management of heterogeneous security access control configuration using an ontology engineering approach

“…A semantic threat graph [11], constructed in terms of an ontology, can be defined as a graph that represents the meaning of a threat domain. Enterprise assets are represented as individuals of the Asset concept.…”

“…Semantic Threat Graphs [11], a variation of the traditional threat tree, are encoded within the ontology-based framework in order to relate knowledge about enterprise-level security requirements, best practice recommendations and access-control rules in terms of assets, threats, vulnerabilities and countermeasures. Threats are organised into a hierarchical structure such as a Microsoft STRIDEbased [17] hierarchy.…”

Security risk management using internal controls

“…Attack trees are typically used to assist attack elicitation and countermeasure selection. While they may be used to provide ongoing recommendation about the best current countermeasures [8], they do not explicitly consider the ongoing-process of testing countermeasure effectiveness. This difference to ERM can be illustrated by the following UML class style diagram, whereby an attack can be regarded as a knock-on consequence of some risk and the countermeasures are the controls that used to mitigate that risk:…”

“…An enterprise will have a very large number of technical security risks and we suggest that attack-tree based methodologies [8,15,17] can help in the elicitation and management of this complexity. Note that we propose the use of ERM to track known risks and do not consider how "unknown unknowns" might be discovered.…”