Management of heterogeneous security access control configuration using an ontology engineering approach

Abstract

Management of heterogeneous enterprise security mechanisms is complex and requires a security administrator to have deep knowledge of each security mechanism's configuration. Effective configuration may be hampered by poor understanding and/or management of the enterprise security policy which, in turn, may unnecessarily expose the enterprise to known threats. This paper argues that knowledge about detailed security configuration, enterprise-level security requirements including best practice recommendations and their relationships can be modelled, queried and reasoned over within an ontology-based framework. A threatbased approach is taken to structure this knowledge. The management of XMPP application-level and firewall-level access control configuration is investigated.

Avoiding inconsistencies in the Security Content Automation Protocol

“…In [21], [22], ontologies have been shown to be effective at modelling and reasoning about low-level systems security configurations (for example [21], [22]). Thus, we argue an ontology engineering approach to encode existing low-level SCAP repository information is practical.…”

Federated autonomic Network Access Control

“…An ontology provides a conceptual and formal model of a domain of interest. Ontologies are developed for infrastructure-level access-control mechanisms [2] (Linux iptables and TCP-Wrapper firewalls) and applicationlevel access-control mechanisms [3] (Openfire and Ejabbered XMPP servers).…”

“…Ontologies for best practice standards for firewalls, Email servers, Web servers and XMPP servers, are developed [2], [3]. For example, XEP-0205 [4] and NIST SP800-123 [5] recommend multiple countermeasures such as connection throttling that mitigate against the threat of Denial of Service, when hosting an XMPP server.…”

Reasoning about the security configuration of SAN switch fabrics

“…This paper builds on previous firewall centric research [3]- [5] to model and reason about SAN switch security configurations.…”

“…A formal model for switch security configuration is developed using Description Logic [2]. This approach builds on previous research [3]- [5] that demonstrated the effectiveness of using Description Logic to model and reason about firewall rules.…”