An Ontology of Information Security

Abstract

We present a publicly available, OWL-based ontology of information security which models assets, threats, vulnerabilities, countermeasures and their relations. The ontology can be used as a general vocabulary, roadmap, and extensible dictionary of the domain of information security. With its help, users can agree on a common language and definition of terms and relationships. In addition to browsing for information, the ontology is also useful for reasoning about relationships between its entities, for example, threats and countermeasures. The ontology helps answer questions like: Which countermeasures detect or prevent the violation of integrity of data? Which assets are protected by SSH? Which countermeasures thwart buffer overflow attacks? At the moment, the ontology comprises 88 threat classes, 79 asset classes, 133 countermeasure classes and 34 relations between those classes. We provide the means for extending the ontology, and provide examples of the extendibility with the countermeasure classes ‘memory protection’ and ‘source code analysis’. This article describes the content of the ontology as well as its usages, potential for extension, technical implementation and tools for working with it.

A Survey of Security Assessment Ontologies

“…In [8] an information security ontology in OWL is presented by Herzog et al. This work is aimed at modeling the main concepts of the domain.…”

“…The authors propose an ontology aimed to cover a larger number of standards. The authors mapped papers Herzog et al [8] and Fenz, Pruckner, & Manutscheri [57] with the standards ISO 27001 [58], PCI DSS [59], ISSA 5173 [60] and NISTIR 7621 [61].…”

“…Table 1 presents the keywords and the search string. [11]; [12]; [13]; [14]; [15,16]; [17]; [18]; [19]; [20]; [21]; [22]; [23]; [24]; [25]; [26]; [27]; [28]; [29]; [30]; [31]; [32]; [33]; [34]; [35]; [36]; [37]; [38]; [39]; [40]; [41]; [42]; [43]; [44]; [45]; [44]; [8]; [46]; [47]. Generic and abstract proposals (Top-Level Ontologies) can be found in [48], [3], [49], [50], and [51].…”

“…Furthermore, an ontology can be used to reason (provide inferences) about relationships between entities [8].…”

Decentralized Semantic Threat Graphs

“…In recent years, research in computer security has seen an increase in the use of ontologies. For example, ontologies have been applied to the areas of information security (common security vocabulary) [24], security management (threats, vulnerabilities and countermeasures) [17], access control [15], policy management [25] and trust management [33]. The decentralized Semantic Threat Graphs (ontology fragments) are implemented in OWL-DL, a language subset of OWL which is a W3C standard that includes Description Logic reasoning semantics [30].…”