Towards Operational Measures of Computer Security: Experimentation and Modelling

Abstract

Abstract.This paper discusses similarities between reliability and security with the intention of finding probabilistic measures of operational security similar to those that we have for reliability of systems. Ideally, a measure of the security of a system should capture quantitatively the intuitive notion of 'the ability of the system to resist attack', described by the parameter effort.That is, it should reflect the degree to which the system can be expected to remain free of security breaches under particular conditions of operation, including those of attack. Current security levels, e.g., those of the Orange book, at best reflect the extensiveness of safeguards introduced during the design and development of a system. Even though we might expect a system developed to a higher level than another system to exhibit 'more secure behaviour' in operation, this cannot be guaranteed. In particular, we can not assess the actual operational security from knowledge of such a level.We have carried out two realistic intrusion experiments intended to investigate the empirical issues that arise from this probabilistic view of security assessment. More specifically, they investigated the problems of measuring effort and reward associated with security attacks and breaches. In the first, pilot experiment, the intention was to see whether experiments of this type, in which a number of under-graduate students were allowed to attack a system under controlled circumstances, were at all feasible, and if so, to get valuable information on how they should be carried out. In the second full-scale experiment, we aimed at getting enough data to be able to start a methodology development, a methodology by which operational security measures could be derived. During this latter experiment 181 activity reports were submitted, resulting in 63 successful breaches, and reflecting a total expenditure of 594 man-hours. The breaches were classified into 6 different categories, based on which kind if security flaw was exploited and the underlying functionality and nature of these flaws is discussed. In a short concluding discussion on quantitative assessment, it is recognized that, even if effort is meant to be composed of many different parameters, various time parameters, such as working time, on-line time and CPU time, form an important base for the measure.

E-WBM: An Effort-Based Vulnerability Discovery Model

“…However, mature effort-based models that have been proposed are still rare. Using effort as a factor was first discussed by Brocklehurst and Littlewood [19], [20], but they have not suggested a unit or a way to measure effort. Alhazmi et al [21] present a reference formula for testing effort.…”

An integrated framework for security and dependability

“…A possible way to achieve this is to perform attacking campaigns, during which intruders are encouraged to attack a system, while as much relevant data as possible on the intrusion process are collected [5], [18], [27], [41].…”

How to systematically classify computer security intrusions

“…For example, if the attackers gain root access on the file-server, they can do virtually anything to the system and the final consequences are impossible to assess completely. In our intrusion experiment, the attackers were told to stop when they had obtained the desired higher privileges, as we did not want them to disturb the work of ordinary system users [20]. In terms of real-time intrusion detection, another reason for concentrating on the immediate result is that it is desirable to detect the intrusion and take preemptive action as early as possible, preferably before any damage is done [10].…”

“…This section briefly outlines the arrangement of the experiment; for details see Olovsson et al [20]. The target system consisted of a set of 24 SUN ELC diskless workstations connected to one file-server, all running SunOS 4.1.2.…”