Portunes: Representing Attack Scenarios Spanning through the Physical, Digital and Social Domain

Abstract

The security goals of an organization are realized through security policies, which concern physical security, digital security and security awareness. An insider is aware of these security policies, and might be able to thwart the security goals by combining physical, digital and social means. A systematic analysis of such attacks requires the whole environment where the insider operates to be formally represented. This paper presents Portunes, a framework which integrates all three security domains in a single environment. Portunes consists of a high-level abstraction model focusing on the relations between the three security domains and a lower abstraction level language able to represent the model and describe attacks which span the three security domains. Using the Portunes framework, we are able to represent a whole new family of attacks where the insider is not assumed to use purely digital actions to achieve a malicious goal.

Transforming Graphical System Models to Graphical Attack Models

“…As stated above, both the ExASyM [7] and Portunes [8] modelling languages fulfil the above requirements for using our approach, as does any Klaim-like models [12] in general. While Klaim models process mobility by processes moving from node to node, we request processes to reside in special nodes that move around with the process.…”

“…System models includes representations of both the physical and the digital infrastructure of an organisation. This is similar to approaches such as ExASyM [7] and Portunes [8], which represent relevant elements as nodes in a graph, that form the natural basis for the application of our techniques. However, for the current work, we do not require a particular kind of representation: the only requirement is that the core concepts discussed later in this section can be extracted from the underlying model.…”

“…Our approach is generally applicable to graphical system models and graphical attack models; examples for instances of such models include system models, e.g., ExASyM [7] and Portunes [8], and attack models such as attack trees and attack-defence trees [1,2].…”

“…These attacks can then be used as input to a traditional risk assessment process and thereby extend and support the brainstorming results. Our approach is applicable to a class of recent system models such as ExASyM [7] and Portunes [8], which have been used to model and analyse organisations for possible attacks [9]. These models contain both the physical infrastructure and information on actors, access rights, and policies; consequently, analysis of such models can include, for example, social engineering in the identified attacks.…”

Understanding How Components of Organisations Contribute to Attacks

“…The only requirement is that all model elements have unique identifiers that establish the link between their occurrences in the attack tree and the model, respectively. While we present them in the setting of the TRE S PASS model, which is similar to ExASyM [11] and Portunes [12], the general approach can be applied to any graphical system model and any attack model. For example, the metrics used for visualising model components can also be output as a text file for sorting and further analysis.…”