Network Security risk analysis and project management

 

 

For most modern organizations being competitive is equivalent to be continuously in accordance with the needs dictated by the environment. Therefore, due to the frequent changes that affect various components of this environment (e.g., economic, legal, political), enterprises tend to continuously reorganize their Information Systems (ISs). In fact, organizations are relying increasingly on automated platforms and communication infrastructures. Nonetheless, they are facing substantial difficulties in keeping up with the security needs of their networked computer systems. These needs must in fact be regarded at the same speed ISs are updated, introducing more complexity to security analysis. In this context, the need for efficient risk management theories, models, and tools is becoming more important than ever before.

The most relevant challenges related to network security risk management are:

• Effort estimation: In view of the fact that security planning itself has a cost to the enterprise that conducts it, the amount of effort related to a risk management project should be conveniently predicted. Naturally, if the cost of security planning overtakes the allowed budget, risk management operations have no reason to start. The absence of techniques estimating the required effort with regard to the characteristics of the analyzed system and the way business is conducted by the enterprise is one of the key reasons that alter the confidence of IT users, especially high-level managers, in risk management.

• Attack modeling: Representing attacks against computer networks is among the most challenging tasks the risk analyst should do. This stems from the intrinsic complexity of these attacks, which can be reduced to the following points:

  • Primo , as network attacks are conducted by humans, a corresponding predictive model would be hard to evolve. On the opposite of various events, human thoughts cannot be easily translated into a formal representation. Most of the existing methods assume the existence of an attack database without addressing this issue.

  • Secundo, attacks are seldom performed in a single step. Attackers often follow a structured methodology to achieve malicious acts. Hence, the risk analyst should establish various kinds of links between elementary threats (e.g., causality, time precedence). The major shortcoming of the traditional approaches is that they do not integrate security countermeasures and enterprise resources as a part of the expert knowledge related to attack scenarios.

 

• Countermeasure selection: In traditional risk management approaches, it is customary to map statically security decisions to digital attacks. In other terms, a set of countermeasures correspond to each attack, in the sense that they mitigate it. We found that this static mapping does not satisfy totally the needs of the risk analyst because it can be the source of many problems, especially when evaluating the efficiency of a decision. Consequently, several conditions should be integrated within the security solution selection module to make the choice of the optimal countermeasure alternative depend not only on the possible attacks but also on the environment of the studied system (e.g., network topology). As a result of this reasoning, the security solutions that are optimal for an enterprise are not necessarily the same as for another enterprise even if both of them face the same threats.

• Monitoring and response: This task is often reduced to a continuous control of the system state. However, given that it belongs to a risk management cycle, it seems inadvisable to confine monitoring to its pure security facets. It should be fully integrated in the business activity of the enterprise. Incident response, for instance, should be enriched by a set of models allowing the accurate measurement of an incident impact, and the selection of the appropriate reactions.

Our major contributions regarding these needs are summarized in the following:

• We developed a novel risk management framework called NetRAM©. It consists in an automated multi-process approach that assists information technology systems administrators and managers in their attempt to reduce security risks that threaten their assets. Three major concepts have been emphasized: hierarchical data structure, which is based on the notion of attack tree, the optimization problem for risk analysis, and the control of the system security state. A key characteristic of NetRAM is that it is heterogeneous, meaning that it integrates three different components: (1) software tools, (2) architectural design methodologies, and (3) theoretical models.

• We used the concept of algebraic specification of network security risk management activities which constitutes a helpful means to reason about automating the risk management process. Many-sorted signatures and first-order predicate logic have been previously used to model the risk analysis problem. We proposed a generic constituency for the risk management signature to model the risk analysis process. The richness of this algebraic structure (i.e. the many-sorted risk analysis signature) allows the representation of attack scenarios, which are attacks performed on multiple steps. It has been also demonstrated that security countermeasures can be viewed as pseudo-inverses of attacks with respect to an action composition law. More precisely, decisions aim at making the system recover from the effect of the various possible attacks.

• We used binary relations to represent attacks, alerts, and countermeasures. We introduced a special category, called regular attacks, and we showed that every attack can be viewed as a limit of a sequence of regular attacks. The major interest of these attacks is that they are easy to thwart by simple countermeasures. Based on this reasoning, a balance between the potential risks and the approximation level of the attacks can be set up. One key property of our approach is that the residual risk, which is accepted by the enterprise, can be set a priori (before the conduction of the conduction of the risk analysis process) and thus perfectly controlled. Moreover, we found that relational calculus can serve to represent, match, and rank the candidate security solutions as well as the security alerts. All these entities can in fact be represented and managed in a single uniform environment.

• We developed an anomaly analysis method based on wavelet theory within the monitoring process of NetRAM. In this method, attacks are modeled as a noise that affects a signal. A set of metrics that need to be monitored is then defined. A set of decision rules is also defined in order to decide whether a value taken by a given metric corresponds to a legitimate or an illegitimate use of the system.

• We developed a set of techniques, called SECOMO, for managing security projects. Four issues are developed within these techniques: (1) three models for security effort and cost estimation are developed to manage security projects in networks presenting different sizes and technology levels, (2) a technique for network size estimation is developed based on the formal representation of security policies, (3) the scale effect of the developed models is discussed, and (4) a multi-objective optimization technique is developed to allow scheduling of security activities and resource allocation.

Several advanced aspects related to the activities discussed above are currently being investigated. The following items give an overview about the ongoing research activities performed by the members of CNAS:

• Relational-based security virtual machine: The developed relational framework for preventive and reactive security solution selection can be used as a basis to define:

• A high-level security grammar in order to represent both attacks and decisions using a unified syntactic and semantic environment,

• A SQL-like language for reactive decision-making. The language should support security cost-benefit computations.Security countermeasure reuse: A theory for countermeasure structuring is being developed. It will support the definition of relational distances that will serve as metrics to rank a set of candidate decisions based on their efficiency. The objective is to build a compound security solution based on the elementary countermeasures composing the library.

• Security policy rewriting systems: An algebraic rewriting system that maps abstract security policy specifications into executable specifications is being devised. The major interest of this system is that it should preserve the security policy composition operations such as addition, subtraction, and multiplication.

Furthermore, the following research trends are expected to be prospected during the next four years:

• Attack correlation (P1.1): In order to reduce the rate of false positives, advanced correlation techniques should be developed. Based on formal data structures representing attacks and alerts, a hierarchical architecture should represent multi-level aggregation of attacks and alerts to make possible the representation of attack scenarios. Hypotheses generation engines should also be developed to compensate the missing information related to the detected events.

• Solution reutilization (P1.2): An idea to solve the fundamental security equation is to gradually build solutions using elementary countermeasures taken from a security library. This emphasizes the need for mathematical tools to structure these libraries (lattice-based structures are preferred) and develop approximate search routines in case where exact solutions cannot be found in the library.

• Security library development (P1.3): A set of security tools implementing the cost estimation, asset analysis, vulnerability analysis, threat analysis, and risk assessment steps of the NetRAM process should be developed. These tools should be interoperable with existing practical security tools such as Nessus, Snort, and IPtables. They should, in addition, solve the heterogeneity observed among these tools and extend the models used by these tools to protect against more complex attacks

• Real-time security techniques (P1.4): Most of the functions performed by the NetRAM modules should fulfill the real-time constraint. Especially, reactive components should guarantee that incident response is done before the maximum tolerated downtime related to the attacked service expires. To address these requirements, a distributed trusted agent system capable of monitoring the activity of NETRAM components and insuring real-time reaction. In addition, a one-parameter relational algebra will be developed to address the formal aspects related to real-time requirements.

 

Selected publications related to project 1

1. J. Krichene, M. Hamdi, N. Boudriga, “Heterogeneous Security Policy Validation: From Formal to Executable Specifications,” Journal of Networks (Academy Publisher), Vol. 3, No. 7, 2008.

2. M. Hamdi, N. Boudriga, “Detecting Denial-of-Service Attacks Using the Wavelet Transform,” Elsevier Computer Communications Journal, 30 (7), 3203–3213, 2007.

3. M. Hamdi, N. Boudriga, “Computer Security Risk Management: Theory, Challenges, and Countermeasures,” International Journal of Communication Systems, Vol. 18, Issue 8, pp. 763-793, 2005.

4. M. Hamdi, N. Essaddi, N. Boudriga, “ReAlSec: A Relational Language for Advanced Security Engineering,” The IEEE 23rd International Conference on Advanced Information Networking and Applications, Bradford, UK, May, 2009.

5. M. Hamdi, N. Boudriga, “Towards a Relational Calculus for Security Library Management,” Security Systems technical symposium, IEEE Globecom Conference, San Francisco, USA, Nov. 27-Dec. 1, 2006.

6. M. Hamdi, J. Krichene, and N. Boudriga, “Algebraic Test Case Generation of Security Policies in Communication Networks,” 10th Nordic workshop on Secure IT systems (NordSec 2005), Tartu, Estonia, October 20-21, 2005.

7. M. Hamdi, N. Boudriga, “An Abstract Reduction Model for Computer Network Security Risk,” 19th IFIP International Information Security Conference (WCC-SEC 2004), Toulouse, France, Aug. 22-27, 2004 ( Best paper award).