60 research outputs found
How to Generate Security Cameras: Towards Defence Generation for Socio-Technical Systems
Recently security researchers have started to look into automated generation
of attack trees from socio-technical system models. The obvious next step in
this trend of automated risk analysis is automating the selection of security
controls to treat the detected threats. However, the existing socio-technical
models are too abstract to represent all security controls recommended by
practitioners and standards. In this paper we propose an attack-defence model,
consisting of a set of attack-defence bundles, to be generated and maintained
with the socio-technical model. The attack-defence bundles can be used to
synthesise attack-defence trees directly from the model to offer basic
attack-defence analysis, but also they can be used to select and maintain the
security controls that cannot be handled by the model itself.Comment: GraMSec 2015, 16 page
A Mobile Ambients-based Approach for Network Attack Modelling and Simulation
Attack Graphs are an important support for assessment and subsequent improvement of network security. They reveal possible paths an attacker can take to break through security perimeters and traverse a network to reach valuable assets deep inside the network. Although scalability is no longer the main issue, Attack Graphs still have some problems that make them less useful in practice. First, Attack Graphs remain difficult to relate to the network topology. Second, Attack Graphs traditionally only consider the exploitation of vulnerable hosts. Third, Attack Graphs do not rely on automatic identification of potential attack targets. We address these gaps in our MsAMS (Multi-step Attack Modelling and Simulation) tool, based on Mobile Ambients. The tool not only allows the modelling of more static aspects of the network, such as the network topology, but also the dynamics of network attacks. In addition to Mobile Ambients, we use the PageRank algorithm to determine targets and hub scores produced by the HITS (Hypertext Induced Topic Search) algorithm to guide the simulation of an attacker searching for targets
A Framework for Improved Intrusion Detection and Countermeasure Selection in Cloud Systems
No Abstrac
Analysis of the NIST database towards the composition of vulnerabilities in attack scenarios
The composition of vulnerabilities in attack scenarios has been traditionally performed based on detailed pre- and post-conditions. Although very precise, this approach is dependent on human analysis, is time consuming, and not at all scalable. We investigate the NIST National Vulnerability Database (NVD) with three goals: (i) understand the associations among vulnerability attributes related to impact, exploitability, privilege, type of vulnerability and clues derived from plaintext descriptions, (ii) validate our initial composition model which is based on required access and resulting effect, and (iii) investigate the maturity of XML database technology for performing statistical analyses like this directly on the XML data. In this report, we analyse 27,273 vulnerability entries (CVE 1) from the NVD. Using only nominal information, we are able to e.g. identify clusters in the class of vulnerabilities with no privilege which represent 52% of the entries
- …