Combining Technical and Financial Impacts for Countermeasure Selection

Research in information security has generally focused on providing a comprehensive interpretation of threats, vulnerabilities, and attacks, in particular to evaluate their danger and prioritize responses accordingly. Most of the current approaches propose advanced techniques to detect intrusions and complex attacks but few of these approaches propose well defined methodologies to react against a given attack. In this paper, we propose a novel and systematic method to select security countermeasures from a pool of candidates, by ranking them based on the technical and financial impact associated to each alternative. The method includes industrial evaluation and simulations of the impact associated to a given security measure which allows to compute the return on response investment for different candidates. A simple case study is proposed at the end of the paper to show the applicability of the model.Comment: In Proceedings AIDP 2014, arXiv:1410.322

A service dependency modeling framework for policy-based response enforcement

International audienceThe use of dynamic access control policies for threat response adapts local response decisions to high level system constraints. However, security policies are often carefully tightened during system design-time, and the large number of service dependencies in a system architecture makes their dynamic adaptation di±cult. The enforcement of a single re- sponse rule requires performing multiple con¯guration changes on multi- ple services. This paper formally describes a Service Dependency Frame- work (SDF) in order to assist the response process in selecting the pol- icy enforcement points (PEPs) capable of applying a dynamic response rule. It automatically derives elementary access rules from the generic access control, either allowed or denied by the dynamic response pol- icy, so they can be locally managed by local PEPs. SDF introduces a requires/provides model of service dependencies. It models the service architecture in a modular way, and thus provides both extensibility and reusability of model components. SDF is de¯ned using the Architecture Analysis and Design Language, which provides formal concepts for mod- eling system architectures. This paper presents a systematic treatment of the dependency model which aims to apply policy rules while minimizing con¯guration changes and reducing resource consumption

Optimisation de la réponse aux menaces basée sur les coûts dans des systèmes pour la Sécurité de l'Information et la Gestion des Evénements (SIEMs)

Les SIEMs (systèmes pour la Sécurité de l'Information et la Gestion des Evénements) sont le cœur des centres opérationnels de sécurité actuels. Les SIEMs corrèlent les événements en provenance de différents capteurs (anti-virus, pare-feux, systèmes de détection d'intrusion, etc), et offrent des vues synthétiques pour la gestion des menaces ainsi que des rapports de sécurité. La recherche dans les technologies SIEM a toujours mis l'accent sur la fourniture d'une interprétation complète des menaces, en particulier pour évaluer leur importance et hiérarchiser les réponses. Toutefois, dans de nombreux cas, la réponse des menaces a encore besoin de l'homme pour mener l'analyse et aboutir à la prise de décisions, p.ex. compréhension des menaces, définition des contremesures appropriées ainsi que leur déploiement. Il s'agit d'un processus lent et coûteux, nécessitant un haut niveau d'expertise, qui reste néanmoins sujet à erreurs. Ainsi, des recherches récentes sur les SIEMs ont mis l'accent sur l'importance et la capacité d'automatiser le processus de sélection et le déploiement des contremesures. Certains auteurs ont proposé des mécanismes automatiques de réponse, comme l'adaptation des politiques de sécurité pour dépasser les limites de réponses statiques ou manuelles. Bien que ces approches améliorent le processus de réaction (en le rendant plus rapide et/ou plus efficace), ils restent limités car ces solutions n'analysent pas l'impact des contremesures choisies pour atténuer les attaques. Dans cette thèse, nous proposons une nouvelle approche systématique qui sélectionne la contremesure optimale au travers d'un ensemble de candidats, classés sur la base d'une comparaison entre leur efficacité à arrêter l'attaque et leur capacité à préserver, simultanément, le meilleur service aux utilisateurs légitimes. Nous proposons également un modèle pour représenter graphiquement les attaques et les contre-mesures, afin de déterminer le volume de chaque élément dans un scénario de multiples attaques. Les coordonnées de chaque élément sont dérivés d'un URI . Ce dernier est composé principalement de trois axes : l utilisateur, le canal et le ressource. Nous utilisons la méthodologie CARVER pour donner un poids approprié à chaque élément composant les axes de notre système de coordonnées. Cette approche nous permet de connecter les volumes avec les risques (p.ex. des grands volumes sont équivalents à des risques élevés, tandis que des petits volumes sont équivalents à des risques faibles). Deux concepts sont considérés en comparant deux ou plusieurs volumes de risques: le risque résiduel, qui résulte lorsque le volume du risque est plus élevé que le volume de la contre-mesure, et le dommage collatéral, qui en résulte lorsque le volume de la contre-mesure est supérieur au volume du risque. En conséquence, nous sommes en mesure d'évaluer les contre-mesures pour des scénarios d'attaques individuelles et multiples, ce qui permet de sélectionner la contre-mesure ou groupe de contre-mesures qui fournit le plus grand bénéfice à l'organisationCurrent Security Information and Event Management systems (SIEMs) constitute the central platform of modern security operating centers. They gather events from various sensors (intrusion detection systems, anti-virus, firewalls, etc.), correlate these events, and deliver synthetic views for threat handling and security reporting. Research in SIEM technologies has traditionally focused on providing a comprehensive interpretation of threats, in particular to evaluate their importance and prioritize responses accordingly. However, in many cases, threat responses still require humans to carry out the analysis and decision tasks e.g., understanding the threats, defining the appropriate countermeasures and deploying them. This is a slow and costly process, requiring a high level of expertise, and remaining error-prone nonetheless. Thus, recent research in SIEM technology has focused on the ability to automate the process of selecting and deploying countermeasures. Several authors have proposed automatic response mechanisms, such as the adaptation of security policies, to overcome the limitations of static or manual response. Although these approaches improve the reaction process (making it faster and/or more efficient), they remain limited since these solutions do not analyze the impact of the countermeasures selected to mitigate the attacks. In this thesis, we propose a novel and systematic process to select the optimal countermeasure from a pool of candidates, by ranking them based on a trade-off between their efficiency in stopping the attack and their ability to preserve, at the same time, the best service to normal users. In addition, we propose a model to represent graphically attacks and countermeasures, so as to determine the volume of each element in a scenario of multiple attacks. The coordinates of each element are derived from a URI. This latter is mainly composed of three axes: user, channel, and resource. We use the CARVER methodology to give an appropriate weight to each element composing the axes in our coordinate system. This approach allows us to connect the volumes with the risks (i.e. big volumes are equivalent to high risk, whereas small volumes are equivalent to low risk). Two concepts are considered while comparing two or more risk volumes: Residual risk, which results when the risk volume is higher than the countermeasure volume; and Collateral damage, which results when the countermeasure volume is higher than the risk volume. As a result, we are able to evaluate countermeasures for single and multiple attack scenarios, making it possible to select the countermeasure or group of countermeasures that provides the highest benefit to the organizationEVRY-INT (912282302) / SudocSudocFranceF

Correlation of Intrusion Symptoms: an Application of Chronicles

Abstract. In this paper, we propose a multi-alarm misuse correlation component based on the chronicles formalism. Chronicles provide a high level declarative language and a recognition system that is used in other areas where dynamic systems are monitored. This formalism allows us to reduce the number of alarms shipped to the operator and enhances the quality of the diagnosis provided.

Aggregation and Correlation of Intrusion-Detection Alerts

Abstract. This paper describes an aggregation and correlation algorithm used in the design and implementation of an intrusion-detection console built on top of the Tivoli Enterprise Console (TEC). The aggregation and correlation algorithm aims at acquiring intrusion-detection alerts and relating them together to expose a more condensed view of the security issues raised by intrusion-detection systems

New directions in Intrusion Detection and Alert Correlation

International audienc

Evaluation of the Diagnostic Capabilities of Commercial Intrusion Detection Systems

Proceedings of the 5th symposium on Recent Advances in Intrusion Detection (RAID 2002), Zurich