Network Access Control and Collaborative Security Against APT and AET

Abstract

Cybercrime is rising due to the appearance of a new generation of attacks, APT and AET, and the reactionary aspect of the protection systems implemented in the IP networks. In this chapter, the authors analyze the gap between the innovative aspect of those attacks and the reactive aspect of the security measures put in place inside victim networks. The challenge is to shift this security aspect from reactive to proactive by adopting a collaborative approach based on NAC technology as a multi-level protection and IF-MAP as a security standard exchange protocol. First, a brief overview of NAC and IF-MAP is given. Then, the authors analyze the anatomy of these chained exploits and their escape techniques in order to propose an approach able to counter such attacks through the convergence towards a security ecosystem having the correlative intelligence to respond to challenges in real time and in a proactive way.

Mobile agent-based SIEM for event collection and normalization externalization

“…One of the main reasons why SIEM systems have become an essential part of monitoring and defending networks and hosts against intrusions is their ability to use their correlation engine to detect complex attacks that typically go unnoticed by most defense security devices. For instance, the authors in (Orhanou et al , 2018) highlighted this by studying many use cases where AET (advanced evasion techniques) and APT (Advanced Persistent Attacks) are executed in a chained matter and key security elements such as IPS, Firewall, WAF and AntiSpam fail to react simply because they operate in series and don’t share information. In this context, they proposed to use IF-MAP as a security standard exchange protocol to share information in real-time, but their proposal is only effective when tools like SIEM systems are implemented, tools that aggregate and correlate events in real-time and view the network as a whole instead of fragmented parts.…”