Verona Italy July 13 2015 Revised
Visit to download the full and correct content document: https://textbookfull.com/product/graphical-models-for-security-second-international-wo rkshop-gramsec-2015-verona-italy-july-13-2015-revised-selected-papers-1st-edition-s jouke-mauw/
More products digital (pdf, epub, mobi) instant download maybe you interests ...
Brain Inspired Computing Second International Workshop
BrainComp 2015 Cetraro Italy July 6 10 2015 Revised Selected Papers 1st Edition Katrin Amunts
https://textbookfull.com/product/brain-inspired-computing-secondinternational-workshop-braincomp-2015-cetraro-italyjuly-6-10-2015-revised-selected-papers-1st-edition-katrin-amunts/
Graphical Models for Security Third International Workshop GraMSec 2016 Lisbon Portugal June 27 2016 Revised Selected Papers 1st Edition Barbara Kordy
https://textbookfull.com/product/graphical-models-for-securitythird-international-workshop-gramsec-2016-lisbon-portugaljune-27-2016-revised-selected-papers-1st-edition-barbara-kordy/
Graphical Models for Security 4th International Workshop GraMSec 2017 Santa Barbara CA USA August 21 2017 Revised Selected Papers 1st Edition Peng Liu
https://textbookfull.com/product/graphical-models-forsecurity-4th-international-workshop-gramsec-2017-santa-barbaraca-usa-august-21-2017-revised-selected-papers-1st-edition-pengliu/
Graphical Models for Security 6th International Workshop GraMSec 2019 Hoboken NJ USA June 24 2019 Revised Papers Massimiliano Albanese
https://textbookfull.com/product/graphical-models-forsecurity-6th-international-workshop-gramsec-2019-hoboken-nj-usajune-24-2019-revised-papers-massimiliano-albanese/
Enterprise Security Second International Workshop ES 2015 Vancouver BC Canada November 30 December 3 2015 Revised Selected Papers 1st Edition Victor Chang
https://textbookfull.com/product/enterprise-security-secondinternational-workshop-es-2015-vancouver-bc-canadanovember-30-december-3-2015-revised-selected-papers-1st-editionvictor-chang/
Worldwide Language Service Infrastructure Second International Workshop WLSI 2015 Kyoto Japan January 22 23 2015 Revised Selected Papers 1st Edition Yohei Murakami
https://textbookfull.com/product/worldwide-language-serviceinfrastructure-second-international-workshop-wlsi-2015-kyotojapan-january-22-23-2015-revised-selected-papers-1st-editionyohei-murakami/
Computer Assisted and Robotic Endoscopy Second International Workshop CARE 2015 Held in Conjunction with MICCAI 2015 Munich Germany October 5 2015 Revised Selected Papers 1st Edition Xiongbiao Luo
https://textbookfull.com/product/computer-assisted-and-roboticendoscopy-second-international-workshop-care-2015-held-inconjunction-with-miccai-2015-munich-germanyoctober-5-2015-revised-selected-papers-1st-edition-xiongbiao-luo/
E Learning E Education and Online Training Second International Conference eLEOT 2015 Novedrate Italy September 16 18 2015 Revised Selected Papers 1st Edition Giovanni Vincenti
https://textbookfull.com/product/e-learning-e-education-andonline-training-second-international-conferenceeleot-2015-novedrate-italy-september-16-18-2015-revised-selectedpapers-1st-edition-giovanni-vincenti/
Software Technologies 10th International Joint Conference ICSOFT 2015 Colmar France July 20 22 2015 Revised Selected Papers 1st Edition Pascal Lorenz
https://textbookfull.com/product/software-technologies-10thinternational-joint-conference-icsoft-2015-colmar-francejuly-20-22-2015-revised-selected-papers-1st-edition-pascallorenz/
Sjouke Mauw · Barbara Kordy
Sushil Jajodia (Eds.)
Graphical Models for Security Second International Workshop, GraMSec 2015 Verona, Italy, July 13, 2015
Revised Selected Papers
LectureNotesinComputerScience9390 CommencedPublicationin1973
FoundingandFormerSeriesEditors: GerhardGoos,JurisHartmanis,andJanvanLeeuwen
EditorialBoard
DavidHutchison
LancasterUniversity,Lancaster,UK
TakeoKanade
CarnegieMellonUniversity,Pittsburgh,PA,USA
JosefKittler UniversityofSurrey,Guildford,UK
JonM.Kleinberg
CornellUniversity,Ithaca,NY,USA
FriedemannMattern
ETHZurich,Zürich,Switzerland
JohnC.Mitchell
StanfordUniversity,Stanford,CA,USA
MoniNaor
WeizmannInstituteofScience,Rehovot,Israel
C.PanduRangan
IndianInstituteofTechnology,Madras,India
BernhardSteffen TUDortmundUniversity,Dortmund,Germany
DemetriTerzopoulos UniversityofCalifornia,LosAngeles,CA,USA
DougTygar UniversityofCalifornia,Berkeley,CA,USA
GerhardWeikum
MaxPlanckInstituteforInformatics,Saarbrücken,Germany
Moreinformationaboutthisseriesathttp://www.springer.com/series/7410
SjoukeMauw • BarbaraKordy
SushilJajodia(Eds.)
GraphicalModels forSecurity SecondInternationalWorkshop,GraMSec2015
Verona,Italy,July13,2015
RevisedSelectedPapers
Editors SjoukeMauw
UniversityofLuxembourg
Luxembourg
Luxembourg
BarbaraKordy
INSARennesandIRISA
Rennes
France
SushilJajodia GeorgeMasonUniversity Fairfax,VA USA
ISSN0302-9743ISSN1611-3349(electronic) LectureNotesinComputerScience
ISBN978-3-319-29967-9ISBN978-3-319-29968-6(eBook) DOI10.1007/978-3-319-29968-6
LibraryofCongressControlNumber:2016931195
LNCSSublibrary:SL4 – SecurityandCryptology
© SpringerInternationalPublishingSwitzerland2016
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartofthe materialisconcerned,specificallytherightsoftranslation,reprinting,reuseofillustrations,recitation, broadcasting,reproductiononmicrofilmsorinanyotherphysicalway,andtransmissionorinformation storageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilarmethodologynow knownorhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant protectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthorsandtheeditorsaresafetoassumethattheadviceandinformationinthisbookare believedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsortheeditors giveawarranty,expressorimplied,withrespecttothematerialcontainedhereinorforanyerrorsor omissionsthatmayhavebeenmade.
Printedonacid-freepaper
ThisSpringerimprintispublishedbySpringerNature TheregisteredcompanyisSpringerInternationalPublishingAGSwitzerland
Preface ThepresentvolumecontainstheproceedingsoftheSecondInternationalWorkshopon GraphicalModelsforSecurity(GraMSec2015).TheworkshopwasheldinVerona, Italy,onJuly13,2015,inconjunctionwiththe28thIEEEComputerSecurityFoundationsSymposium(CSF2015).
Graphicalsecuritymodelsprovideanintuitivebutsystematicmethodologyto analyzesecurityweaknessesofsystemsandtoevaluatepotentialprotectionmeasures. Formalmethodsandcomputersecurityresearchers,aswellassecurityprofessionals fromindustryandgovernment,haveproposedvariousgraphicalsecuritymodeling schemes.Suchmodelsareusedtocapturedifferentsecurityfacets(digital,physical, andsocial)andaddressarangeofchallengesincludingsecurityassessment,risk analysis,automateddefensing,secureservicescomposition,policyvalidation,and veri fication.
TheobjectiveoftheInternationalWorkshoponGraphicalModelsforSecurityisto contributetothedevelopmentofwell-foundedgraphicalsecuritymodels,effi cient algorithmsfortheiranalysis,aswellasmethodologiesfortheirpracticalusage.The workshopbringstogetheracademicresearchersandindustrypractitionersdesigning andemployingvisualmodelsforsecurityinordertoprovideaplatformfordiscussion, knowledgeexchange,andcollaborations.
ThesecondeditionoftheGraMSecworkshopreceived13submissionsandeach ofthemwasreviewedbyatleastfourreviewers.Basedontheirqualityandcontributiontothe field,sixpapers,amongwhichoneshorttoolpaper,wereacceptedfor presentationattheworkshopandinclusioninthe fi nalproceedingsofGraMSec2015. Inadditiontotheacceptedpapers,weinvitedChristianProbst,JanWillemson,and WolterPietersfromtheTREsPASSconsortiumtodescribetheAttackNavigator,a graphicalapproachtosecurityriskassessmentinspiredbynavigationsystems.The workshop’sprogramwascomplementedbyaninvitedlecturebyMarcBouissouon “DynamicGraphicalModelsforSecurityandSafetyJointModeling.”
Wewouldliketothankallthepeoplewhovolunteeredtheirtimeandenergyto makethisyear ’sworkshophappen.Inparticular,wethanktheauthorsforsubmitting theirmanuscriptstotheworkshopandalltheattendeesforcontributingtotheworkshopdiscussions.WearealsogratefultothemembersoftheProgramCommitteeand theexternalreviewersfortheirworkinreviewinganddiscussingthesubmissions,and theircommitmenttomeetingthestrictdeadlines.Further,wewouldliketothankRavi Jhawar(publicitychair),PiotrKordy(webchair),andLucaViganò (GeneralChairof CSF2015)fortheirsupportinorganizingourworkshop.
Finally,ourthanksgototheEuropeanCommission’sSeventhFrameworkProgrammefortheirpartialsponsorshipoftheworkshop(EUFP7grantno. 318003TREsPASS)andtotheUniversityofLuxembourg,theFondsNationaldela RechercheLuxembourg(FNR-COREgrantADT2P),theInstitutNationaldesSciences
Appliquées(INSARennes),andtheInstitutdeRechercheenInformatiqueetSystèmes Aléatoires(IRISA)fortheirinkindcontributiontoGraMSec2015.
July2015SjoukeMauw
BarbaraKordy SushilJajodia Organization ProgramCommittee
MathieuAcherUniversityRennes1andIRISA,France
MassimilianoAlbaneseGeorgeMasonUniversity,USA
LudovicApvrilleTélécomParisTech,France
ThomasBauereissDFKIGmbH,Germany
GiampaoloBellaUniversityofCatania,Italy
StefanoBistarelliUniversityofPerugia,Italy
AhtoBuldasCybernetica,Estonia
JasonCramptonRoyalHollowayUniversityofLondon,UK
FrédéricCuppensTélécomBretagne,France
MathiasEkstedtKTHRoyalInstituteofTechnology,Sweden
OlgaGadyatskayaUniversityofLuxembourg,Luxembourg
PaoloGiorginiUniversityofTrento,Italy
ErlendAndreasGjæreSINTEF,Norway
DieterGollmannTUHamburg-Harburg,Germany
OlivierHeenTechnicolor,France
SivHildeHoumbSecure-NOKASandGjøvikUniversityCollege, Norway
SushilJajodiaGeorgeMasonUniversity,USA RaviJhawarUniversityofLuxembourg,Luxembourg
HenkJonkersBiZZdesign,TheNetherlands
JanJürjensTechnicalUniversityDortmund,Germany
DongSeongKimUniversityofCanterbury,NewZealand
BarbaraKordyINSARennesandIRISA,France
Jean-LouisLanetInria,France
GurvanLeGuernicDGAMaîtrisedel’Information,France
SjoukeMauwUniversityofLuxembourg,Luxembourg
PerHåkonMelandSINTEF,Norway
JogeshMuppalaHKUST,HongKong,SARChina
FlemmingNielsonTechnicalUniversityofDenmark,Denmark
StevenNoelMITREandGeorgeMasonUniversity,USA
AndreasL.OpdahlUniversityofBergen,Norway
StéphanePaulThalesResearchandTechnology,France
WolterPietersDelftUniversityofTechnology,TheNetherlands
SophiePinchinatUniversityRennes1andIRISA,France
VincenzoPiuriUniversityofMilan,Italy
LudovicPiètre-Cambac édèsEDF,France
NicolasPrigentSupélec,France
CristianPrisacariuUniversityofOslo,Norway ChristianW.ProbstTechnicalUniversityofDenmark,Denmark
DavidPymUniversityCollegeLondon,UK
SašaRadomirović ETHZürich,Switzerland
IndrajitRayColoradoStateUniversity,USA ArendRensinkUniversityofTwente,TheNetherlands
YvesRoudierEURECOM,France
PierangelaSamaratiUniversityofMilan,Italy
GuttormSindreNorwegianUniversityofScienceandTechnology, Norway
KetilStølenSINTEFandUniversityofOslo,Norway
AxelTannerIBMResearchZürich,Switzerland KishorS.TrivediDukeUniversity,USA
LucaViganò King’sCollegeLondon,UK
LingyuWangConcordiaUniversity,Canada
JanWillemsonCybernetica,Estonia
AdditionalReviewers Aslanyan,Zaruhi Erdogan,Gencer
Ivanova,MarietaGeorgieva Pouly,Marc
TheAttackNavigator.......................................1
ChristianW.Probst,JanWillemson,andWolterPieters
IntegratedVisualizationofNetworkSecurityMetadatafromHeterogeneous DataSources.............................................18 VolkerAhlers,FelixHeine,BastianHellmann,CarstenKleiner, LeonardRenners,ThomasRossow,andRalfSteuerwald
SysML-SecAttackGraphs:CompactRepresentationsforComplexAttacks...35 LudovicApvrilleandYvesRoudier
HowtoGenerateSecurityCameras:TowardsDefenceGeneration forSocio-TechnicalSystems...................................50 OlgaGadyatskaya
GuidedSpecificationandAnalysisofaLoyaltyCardSystem............66 LaurentCuennet,MarcPouly,andSašaRadomirović
TransformingGraphicalSystemModelstoGraphicalAttackModels.......82 MarietaGeorgievaIvanova,ChristianW.Probst,René RydhofHansen, andFlorianKammüller
ATSyRa:AnIntegratedEnvironmentforSynthesizingAttackTrees: (ToolPaper)..............................................97 SophiePinchinat,MathieuAcher,andDidierVojtisek
AuthorIndex
TheAttackNavigator ChristianW.Probst1(B) ,JanWillemson2 ,andWolterPieters3
1 TechnicalUniversityofDenmark,KongensLyngby,Denmark cwpr@dtu.dk
2 Cybernetica,Tallinn,Estonia janwil@cyber.ee
3 DelftUniversityofTechnology,Delft,TheNetherlands w.pieters@tudelft.nl
Abstract. Theneedtoassesssecurityandtakeprotectiondecisionsis atleastasoldasourcivilisation.However,thecomplexityanddevelopmentspeedofourinterconnectedtechnicalsystemshavesurpassedour capacitytoimagineandevaluateriskscenarios.Thisholdsinparticular forrisksthatarecausedbythestrategicbehaviourofadversaries.Therefore,technology-supportedmethodsareneededtohelpusidentifyand managetheserisks.Inthispaper,wedescribetheattacknavigator:a graph-basedapproachtosecurityriskassessmentinspiredbynavigation systems.Basedonmapsofasocio-technicalsystem,theattacknavigator identifiesroutestoanattackergoal.Specificattackerpropertiessuchas skillorresourcescanbeincludedthroughattackerprofiles.Thisenables defenderstoexploreattackscenariosandtheeffectivenessofdefense alternativesunderdifferentthreatconditions.
1Introduction Theneedtoassesssecurityandtakeprotectiondecisionsisasoldasourcivilisation,andmaybeevenolder.Lookingaroundinnature,weseethatanimals trytobuildtheirlairsinsafeplacesandthatsomeplantsgrowprickles.These kindsofdecisionsarenottakeninaconsciousway,butareratheraresultofa longevolutionarytrialanderrorprocess.
Whatdifferentiateshumansfromotherspeciesisthehighlycomplextechnicalenvironmentweoperatein.Thespeedofdevelopmentofthisenvironment exceedsthecapabilitiesofnaturalevolutionbyseveralordersofmagnitude, whichmeanswecannotrelyonevolutiontodevelopsafeguards.Instead,we needsecurityassessmentmethodstoidentifypotentialthreats,andtoallowus tocopewiththehighlysophisticatedattacksbeingenabledbyourenvironment.
Ontheotherhand,ourperceptionofsurroundingsisstillverymuchlimited bywhatevolutionhasprovidedforus.Humansareaveragelygoodatperceiving visualimages,sounds,andsmells,butnotsomuchatgraspingallthesmall detailsandimplicationsoflargeinfrastructures.Yet,inordertoutilizesuch infrastructuresefficiently,weneedsuchabilitiesinonewayoranother.
c SpringerInternationalPublishingSwitzerland2016 S.Mauwetal.(Eds.):GraMSec2015,LNCS9390,pp.1–17,2016. DOI:10.1007/978-3-319-29968-6 1
Evenifhumansmanagetocollectadequateenvironmentaldata,theirrisk comprehensionmaybeseverelybiasedduetoeducational,cultural,psychological,political,andotherreasons[1–3].Hence,thereisaclearneedfortools thatprovideavisual,easytocomprehendoverviewoftheenvironment,butat thesametimebeingrationalandunambiguous.ThetargetoftheTRES PASS project[4]istoachieveexactlythat–assisthumansintakingsecuritydecisions aboutlarge,complexinfrastructuresinawaythatiseasytoperceivegivenour limitedcapabilities.
Insecurityrisks,wedealwithstrategicattackerswhoplantheiractions. Thismeansthatwemustbeableto“thinkthief”,andpredictpossibleattack scenariosbyimaginingattackerbehaviour.Thecentralinnovationtoachieve thisgoalistheintroductionofthenotionof attacknavigatormap.Itcanbe seenasanefforttobridgethegapbetweencomplexityofrealsystemsandlimits ofhumanperceptionbyutilisingaconceptfamiliartoallofus,namelyspatial navigation.Thisapproachgivesusseveralbenefits:
–Movingtowardsanattacker’sgoalcorrespondsintuitivelywelltonavigating throughcomplexterrain,togetherwiththeneedtotakedecisions,achieve subgoals,etc.
–Navigationoptimisationisratherwellstudiedandunderstood,asopposedto complexsystemsecurity.
–Navigationcanbehandledondifferentlevelsofabstraction.Therecanbea bird-eyeversionforexecutive-level,grass-rootversionfortechnicallevel,and anarbitrarynumberofintermediatelevelsasneeded.
Alltheseaspectsmakenavigationagoodmetaphorforstudyingsecurityassessmentofcomplexinfrastructuresandforcommunicatingassessmentresults. Theremainderofthispaperisorganisedasfollows.InSect. 2 weoutlinethe mainstepsoftheTRES PASSprocessthatprovidesanalystswiththetoolsetand methodologyformingthebasisoftheattacknavigator,whichthenisdescribed inSect. 3.Sections 4 and 5 explainhowtomovefromahigh-levelabstractview oftheenvironment(thesatelliteview)toafine-grainedsystemmodel(themap) andhowtofindroutes(theattacks).Finally,Sect. 6 discusseshowtoselectcountermeasuresbasedonTRES PASSanalysis,andSect. 7 drawssomeconclusions.
2TheTRES PASSProcess Ofcourseittakesmorethanjustagoodmetaphortobuildausableriskassessmentsystem.Inpractice,theanalystneedsaworkingtoolsetandmethodologythatwouldbeabletosupportthenavigationapproachonvariouslevels ofabstraction.ThemainresultoftheTRES PASSprojectarethetoolsetand methodologythattogethersupporttheTRES PASSprocess,whichwedescribe inthissection.
Inordertoachievethenavigationeffect,oneneedsananalogueofamapto navigateon.Intherealworld,mapsrepresentcitiesandstreets,andtoacertain
extentartefactssuchaspointsofinterest.Thesemapsareproducedbygeographersbasedonsatelliteimagesandinspectionoftheterrainunderconsideration.
IntheTRES PASSapproach,theroleofamapisplayedbythe systemmodel,a formalrepresentationofthesocio-technicalenvironmenttobeanalysed.System modelscontainanumberofcomponentsfromsuchenvironments:
– Actors representhumanplayersorprocessesinvolvedinthesystem; – Assets canbeeither items or data;
– Locations representwhereactorsoritemsmaybesituatedeitherphysically ordigitally;
–
Edges describepossiblerelocationpathsbetweenlocations;
– Policies describeaccesscontrolandspecifyallowedactions, e.g.,getsome dataitemfromalocationormovebetweenlocations;and
– Processes formalizecertainstatetransitionmechanisms, e.g.,computerprogramsorvirtualmachines.
Unlikeintherealworld,thereisnosatellitetoprovidepicturesoftheenvironment.Themodelcreationisinsteadtheresultofacollectionofprocessesthat resemblethecombinationofsatelliteandgeographer.Beforetheactualmodel creationcanstart,informationaboutthesystemneedstobegathered.This happensinseveralparallelprocesses,bothviaaspeciallycrafteduserinterface andautomateddataacquisition, e.g.,incaseoflargeITinfrastructures.
Whenusingarealmapfornavigation,thegoalistoreachacertainlocation undercertainconstraints, e.g.,asfastaspossible,aseconomicalaspossible,or withoutusingfreeways.Onceasystemmodelisbuilt,theattacknavigatorneeds an attackergoal toexplorethewaystoachievethisgoalbymovingthroughthe model.Thegoalitselfisstatedasapolicyviolation, e.g.,illegitimateaccessto adataasset,andassuchcanserveasatriggerforanautomatednavigation procedure.
Atthispoint,navigationthroughasystemmodelandorienteeringacrossa terrainstarttodiffer.Asmentionedabove,findingone’swayinnatureorurban environmentusuallyhasawell-setoptimisationgoal,typicallypathlengthor timethatitwouldtaketofollowthispath.
Navigationthroughasystemmodelisrelativelylessunderstoodandthe methodsofalong-the-pathoptimisationaremuchlessmaturethanshortestpath algorithmsonterraingraphs.Hence,theoutputofanattacknavigator,interms ofpossibleattackscenarios,hastocontainmoreinformationandoptimisation itselfhastohappenatalaterstage.
IncaseofthecurrenttoolsetimplementationofTRES PASS,thisoutput containsformalattackvectordescriptionsintheformofattacktrees[5].This isnottheonlypossibleoption,butattacktreeswerechosensincetheyare ratherwellestablishedandacceptedintheriskassessmentcommunity[6].Also, computationalmethodshavebeendevelopedforvariousoptimisationtargets thatcanbestatedforattacktrees[7–10].
Aftertheanalysisoftheattacktreeshasbeenfinished,theresultsaredisplayedtotheenduseronavisualfront-end.Theusercanthentakedecisions
concerningoverallsecuritylevel,requiredadditionalcontrolsandpossiblemodel updates.Afterthemodelhasbeenupdated,theanalysiscanberunagainto studytheeffectsofthechangesonthesecuritylevel.
3TheAttackNavigator Wewillnowlookcloserattheattacknavigatoritself.Carnavigationsystems areindependentofthecartheyareusedin, i.e.,propertiesofthecarareoften ignoredsincetheytypicallyarethesameforeachcar.Thenavigatormayhave optionstoavoid,forexample,unpavedroadsinnon-4WDcarsbuttheseoptions arenotexplicitlylinkedtotypesofcars.
Intheattacknavigator,theimportantpropertiesthatinfluencethepossible attacksarepropertiesoftheattacker.Justasincarnavigationsystems,inmany currentmodelsofsecurityrisk,theseattackerpropertiesareimplicit.Therisks andidentifiedattacksbysuchmethodsareannotatedwithprobability,time, andcostvalues,whicharebasedonassumptionsontheattackerthattriesto performtheattack.
Threatagentmodelling[11–13]aimsatspecifyingexplicitthreatagentsas abasisforsecurityriskassessment,withpropertiessuchasskill,resources,and objectives.Thismayleadtoprofilessuchasactivists,terrorists,orspiesallwith specificproperties.
TheTRES PASSattacknavigatorconcepttakesanimportantstepbeyond currentmodelsofsecurityriskbyleveragingthreatagentsasattackerprofiles. Theattacknavigatoranalysisusesacombinationofanavigatormapandan attackerprofiletoderive
–suitablegoalsfortheattackerbasedonattackermotivation,and –feasibleroutestothatgoalandpropertiesoftheseroutesbasedonskilland resourcesfromtheattackerprofile.
Theattackerprofilesalsoimplyalinkbetweenattacknavigatorsandsecurity economics[14].Bothattackersanddefendershavecostsfortheiractions,and utilityfunctionsassociatedwiththepossibleoutcomes,butonlyalimitedbudget.Theutilityofattackersmaybedifferentbasedontheirmotivation,andthis canbeusedintheanalysisofattacktrees[15].Theattacknavigatoraimsat optimisingdefenderinvestments,assumingthat –attackersoptimisetheirinvestmentsaswell, –thedefendermovesbeforetheattacker,and –theattackerknowswhatthedefenderhasdone.
Thisamountstoasimpletwo-stepgamewithminimaxoptimisation[16].One canalsoconsiderattackerbehaviourovertimeinordertogetfrequencymetrics forriskanalysis[17].
Thesimilaritywitheconomicmodelsalsomeansthatthereisquiteabit ofuncertaintyintheresultsofcomputations.Theassumptionsmademaynot alwayshold,andtheavailabledataisfragile.Theclaimofattacknavigatorsis
thereforenotaprecisepredictionofwhatwillhappen,butratheraprediction ofwhatispossibleorlikely,andtowhatextentcountermeasuresimprovethe situation.Evenifresultsarenottheexactnumberswewouldliketohave,they canbeusefulforcomparingoptions,orevenasthinkingtoolsforimagining possibleattacks.
4FromSatelliteViewtoMaps Anessentialcomponentofanavigatoristheunderlyingmap,onwhichroutesare computed.Assuchtheyalsoformanimportantcomponentoftheattacknavigator.Mapsoftherealworldarecreatedbasedonsatelliteimagesandthework bygeographers.Thisapproachisonlypartlyfeasibleforcreatingmapsoforganisations:whiletheoverallbuildingstructurecanbeassessedfromtheoutside, elementssuchasaccesscontrolpoliciesornetworkandsocialstructurescannot.Theseelements,however,formanessentialpartofattacknavigatormaps, sincetheycanbeenablingfactorsofattacks, i.e.,routesthroughthenavigator map.Satellitesarenottherighttoolforanotherreason:theorganisationsunder scrutinyaretypicallyrathersmallandconsequentlyalsoonlycoveralimited area.Iftheattacknavigatormapcoversabiggerarea,thispartofrealitycan usuallyberepresentedbypartsofarealmap.
4.1ModelsofReality Whencreatingmapsasmodelsofreality,oneneedstoabstracttherealworldby aconceptthatissuitedforautomateddetectionofroutes.Forrealnavigation systems,mapsarestoredasgraphswithnodesconnectedbyedges;bothnodes andedgescanhaveproperties, e.g.,sizeofacity,sizeofastreet,orwhetherit isopenfortrafficornot.
Modelsforattacknavigatorsfollowthesameapproach:organisationsare abstractedtographs,nodesinthegraphrepresentlocationsintheorganisation,
Table1. Anoverviewofcomponentsintheattacknavigatormapandthetoolsand processestoidentifythem.
Realworld Modelcomponent Tool
Relevantarea Locationsandedges Maps
Computer networks Assetsandedges Networkexplorationtoolssuchas nmap toexplorenetworkinfrastructure.
Humanactors Actors Demographicsurveys,personnelprofiles
Physicalaccess control Policiesandprocesses Documentsandinterviews
Computeraccess control Policiesandprocesses Documents,extractiontools,interviews
Softwareprocesses Processes Documents,extractiontools,interviews
andedgesbetweennodesrepresentconnectivitybetweentheselocations.The constructionofattacknavigatormapsfollowsadifferentapproachthanforreal maps,though.Asmentionedabove,satellitesarenotreallyapplicable.They can,however,serveasametaphor.Wheresatellitepicturesgiveaviewofthe realworldthatneedstobeinterpretedtocreateamap,toolscanbeusedto obtainasimilarviewoforganisations.
Forcreatingattacknavigatormaps,acollectionoftoolsorprocessesare requiredtocollectinformationaboutthedifferentpartsofanorganisationand itssurroundingsasnecessaryforthemap.Table 1 showscomponentsofattack navigatormapsandtoolsandprocessestocollectthem.Ingeneral,whenever addinganewcategorytoberepresentedinattacknavigatormaps,onewillalso needtoaddanewtoolorprocesstocollectthenecessaryinformation.
AsshowninTable 1,quiteanumberofcomponentsareobtainedthrough interviewsorbyrunningtools.Thisiswherethe modeller,theattacknavigator map’sequivalentofthegeographer,becomesimportant.Likethegeographeris inchargeofassemblingthemap,andinterpretingpartsofthesatelliteimage, themodellerisinchargeofintegratingthebitsandpiecesofinfrastructureand data.Especiallytheinterviewpartsrequirespecialattention,sinceextracting andinterpretingtheinformationobtainedthroughinterviewsisdifficult.
IntheTRES PASSproject,asetoftoolsforphysicalmodellinghavebeen developed[18]tostructuretheinterviewprocess;physicalmodellingenables employeestocontributetothemapcreationasdomainexpertswithinsideknowledgeoftheirorganisationanditspolicies,assetsandvalues.Physicalmodelling providesawaytoengageemployeesintothemapcreation,andtogivethema creativeprocesstoprovideinput.
Theattacknavigatormapisconstructedaroundthemappingoflocations together.Thelocationsinthedifferentinfrastructuresestablishtheconnection pointsbetweenthedifferentlayersoftheorganisation.Accesscontrolpoliciesare associatedwithlocationsinthebuildinglayerandassetsinthenetworklayer.Locationsinthenetworklayercancoincidewithlocationsinthebuildinglayer.Assets arelocatedatotherassetsoratlocationsofthenetworkorbuildinglayer.Attack navigatormapsarestructuredusingtheseco-locations.
Figure 1 showsasmallexampleforanavigatormapwithdifferentlocations, actors,andassets.Intheofficethereisasafewithasecretinit,andBobhas akeytoopenthesafe.Thereisanotherkeyontheshelfinthereception.Alice wantstoobtainthesecretfromthesafe,butthesafehasapolicythatrequires actorstohavethematchingkeyinordertoopenthesafeandaccessitscontent. Accessingcontentisrepresentedasinputinsystemmodels.
4.2Policies Policiesplayanimportantroleinattacknavigatormaps,sincetheydescribe howaccesstocertainnodesisrestricted,andwhatanactorinthemodelneeds tofullfiltoaccesstheannotatedlocationorasset.Examplesincludekeycards orkeysthatarerequiredtoaccessadoor.Besidesthese local policies,therealso existsystem-wideor global policies[19].Globalpoliciesidentifytheassetsof
Fig.1. Exampleforasmallsystemmodelwithseveralactors,locations,andassets.
anorganisationthatshouldbeprotectedagainstattackers.Forexample,they mightspecifythatacertainfiletypeisnotallowedtoleavetheorganisation, orthatacertainlocationmayonlybeenteredatcertaintimesorwithasetof credentials.Section 5 discusseshowtheseglobalpoliciesguidethecomputation ofattackerroutes.
4.3ModelPatterns
Likerealmaps,attacknavigatormapstendtocontaincomponentsthatare similartoeachother;theysharethesamestructure,butmightbedifferentwith respecttosomeproperties.Forcreatingmaps,thereexiststandardsofsuch patternsusedbymapeditors.
Forattacknavigatormaps,patternsareequallyimportantsincemanyelementsoccurrepeatedly.Toeasethemodeller’stask,modelpatternsareprovided inalibrary.Modelpatternsaresub-graphsthatcanbeputintotheattacknavigatormap.Whensuchapatternisputintothemap,itisinstantiatedandcan beconfiguredtomatchtheelementoftherealworlditrepresents.
Modelpatternsalsoincludepoliciesandprocesses,whichrepresentaccess controlrestrictionsandfunctionalityatnodesinthemodel.Foraccesscontrol orformodelling, e.g.,networkinfrastructure,policiesandprocessescanbecombinedtomodelquitecomplexscenarios.Forexample,role-basedaccesscontrol canbemodelledbyallowingdifferentrolestooutputdifferentmessagestoa location,whereeachmessagetriggersaprocessthatimplementstheassigned functionality.
5FromMapstoRoutes Onceanorganisationhasbeenrepresentedusingagraphicalmodel,theattack navigatorcanidentifypossibleroutesonthemapfortheattackertoreacha goal[20, 21].Inthissectionwediscussthedifferentstepsindoingso.Afterintroducingtherepresentationofattackerroutesinthenextpart,wediscusstheactual
attacknavigationandattackpatterns,whichcanbeusedtoextendidentified attackinasimilarwayasthemodelpatternsdiscussedintheprevioussection.
Likerealnavigation,attacknavigationiswhite-boxtestingofamap. Weassumethattheattackerhasperfectknowledgeoftheorganisationand knows, e.g.,whereassetsarelocated,whatthelayoutoftheorganisationis,or howemployeescanbesocialengineered.Scenarioswithincompleteknowledge canbeconsideredaswell, i.e.,anattackerwhoneedstoexploretheorganisation, butthentheimpactofattackscanbeexpectedtobelowerthanforanattacker withperfectknowledge.
5.1AttackerRoutes Beforepresentingtheactualroutingmechanismonattacknavigatormaps,we brieflydiscusstherepresentationofroutes.Inanavigationsystem,routesare seriesofcoordinates,oftenwithinformationaboutpotentialcongestiononthat partoftheroute.Anavigationsystemassumesthatitsuserisrationalandwill followthesuggestedroute.Onlyoncedeviationsfromthatrouteareobserved, itwillstarttorecalculateanewroutefromthepositionwheretheuserisatthis point.
Attackerroutesarecomputedslightlydifferently,andconsequentlyneed anotherrepresentation.Forattackerroutes,weareinterestedinallpossible attacks.Asdescribedabove,theresultoftheattacknavigatoristhesetofall attacksthatarepossibleinthemodel,quantifiedbysomeproperty,andranked accordingly.Thisissimilartotheregularnavigator:fornavigation,onlythe shortest,fastest,ormosteconomicrouteisdisplayed.Duethecomplexityof attacks,thisselectionisfarfromeasyfortheattacknavigator;theresultis thereforepresentedtoahumandefenderwhowilldismissimpossibleornegligibleattacks.
Toenablethisselectionprocess,attacktrees[5, 6]aretheidealrepresentation, sincetheycombinedifferentpossibleattacksthatleadtothesamegoal.Theroot ofanattacktreerepresentsthisgoal,andthesubtreesrepresentsub-attacksthat eitherneedalltobefulfilled,orwhereoneissufficienttoreachthegoal.For representingattackerroutes,theformerwouldrepresentthatseveralstepsneed tobetaken,andthelatterwouldrepresentdifferentpossibleroutes.Wepresent examplesforattacktreesinFig. 5
5.2AttackIdentification
Attackidentificationistheactualnavigationontheattacknavigatormap.Like realnavigation,ittakesanattackerlocationandidentifiesapossibleroutefrom thislocationtothedesiredgoal.
FortheattacknavigatormapshowninFig. 1,thegoalisclear:Alicewants toobtainthesecretfromthesafe.Oncethegoalisidentified,thepathstothe goal(onlyoneintheexample)andthemissingassetsareidentified.Alicelacks thekey,whichisavailablefromBoborfromtheShelf.TheupperpartofFig. 5 showspartoftheattacktreegeneratedforthisscenario.
GoalIdentification: Asdiscussedabove,thegoalinattacknavigatormapsis identifiedbasedonglobalpoliciesofthemodelledorganisation.Thesepolicies representagoaloftheorganisationthatshouldnotbeviolated.Examplesinclude thatemployeesshouldnotsendsecretfilesbyemail,thatingeneralsecretfiles shouldnotleavetheorganisation,orthatthepasswordfileonacomputermay notberead.Intheattackerroute,thisgoalwouldbetherootnode,andits childrenwouldrepresentdifferentattacksthatenableanattackertoreachthis goal.
Theresultofthegoalidentificationisanaction,whichtheattackertriesto perform,oranasset,whichtheattackertriestopossess.Animportantobservationisthatthelatterisavariantoftheformer;topossessanasset,theattacker needstoperformanactiontoobtainit.Intheattacknavigator,thisisrepresentedasinputtingtheasset.
AttackPaths: Foreachoftheidentifiedattackergoals,theremayexistnumerouspathstoreachthegoallocation,wherethegoalactioncanbeperformed,or wherethegoalassetcanbeobtained.Theattacknavigationconsidersallthese paths,sincetheymayresultindifferentimpactormayotherwisehavedifferent propertiesthatthedefenderdeemsimportant.
Thispropertyisessentiallydifferentfromstandardnavigation,whereitis asafeassumptionthatonecanignoreroutesthataretooslowcomparedto theoptimalroutesatanygivenpointduringrouting.Attackerroutesareonly evaluatedinthenextstepandadefendermightusedifferentcriteriaforevaluatingtrees;asaresult,thereisnodecisionbasisforignoringattackroutesor forevaluatingthemonthefly.Oneimportantevaluationcriteriaisanattack route’simpact,whichdoesnotincreasecontinuously,butmayhavediscontinuouschangesbased, e.g.,ontheassetsobtained.
Everystepinanattackpathconsistsofastepinthemodel,beitmoving fromonelocationtoanother,orbeitobtainingsomeasset—eitherthefinalone, oronethatisneededtoperformsomeotheraction.Forexample,iftheattacker goalistoreadthepasswordfileonacentralserver,thentherootpasswordof thatmachineisanassetthatneedstobeobtained.
RequiredResources: Theserequiredresourcesareacquiredonthefly.Whenevertheattackerencountersanactioninanattackpaththatrequiresanasset suchasthepasswordfortheservermachine,anewattackisspawned,attheend ofwhichtheattackerhasobtainedthatasset.Itisimportanttonotethatthe routesalwaysassumesuccess,eventhoughanattackmightbeprohibited.From theattacker’sviewpointtheassethasbeenobtained,andtheoriginalattack cancontinueasplanned.Thisshouldalsobethedefender’spointofview—the interestingcaseisnotadefeatedattack,butasuccessfulone.
MovingAssets: Finally,attackerroutescandiffersignificantlyfromnormal routesthroughthefactthatthegoalassetinattackermodelscanmoveorbe
moved,resultinginnovelattacks.Inaregularnavigationsystemthiswould meanthatthegoalcouldbemoved,resultinginashorter,faster,orlongertrip.
Whilethisisnotpossibleforrealgoals,itisacommonattackstrategyin attackermaps:Theattackconsistsinmakingtheassetmove,andthenfinding attackstoallthoselocationsthattheassetcanreach.Themeansofmakingan assetmovedifferdependingonthekindofasset.Datausuallymovesthrough processes,whicharetriggeredbytheattacker;assetsusuallymovewithactors, whichanattackermustsocialengineer.
Anexampleforanattackthatmadethedatamoveisacloudserviceadministratorwhoattachedanetworksniffertothelocalnetworkintheserverroom, andthenmadeavirtualmachinemigratefromoneservertoanother;asaresult, theadministratorhadacopyofthenetworktrafficthathecouldplaybackto obtainacopyofthevirtualmachine.
5.3DetailednessofModels Onegeneralissuewithmapsandroutes,bothforrealmapsandattacknavigator maps,isthelevelofdetailinthemaps.Inbothcases,ifthemapsaretoodetailed, itisverydifficulttoidentifyaclose-to-optimalroute;ifthemapshoweveraretoo imprecise,theroutesarenotrealisticeither,andmaylackimportantinformation neededtofollowtheroute.
Inattacknavigatormaps,thelevelofdetailrelatestohowdetailedtheidentifiedattacksare.Comingbacktothecloudadministratorexample,modelling thebitsandbytesofthevirtualmachineandtheOSInetworkstackislikelytoo muchdetail.Ontheotherhand,inasystemthatmodelsonlythetwoservers notincludingthenetworkinfrastructure,itwillnotbepossibletoidentifythe attackatall.
Thelevelofdetailisthereforeanimportantdesigncriteriawhendesigning (attacknavigator)maps.Agoodguidingprincipleistoincludeonlythoseelementsthatareessentialforthefunctionalityoftheoverallsystem,butexclude internalworkingsofthesystem.ThemodellingworkintheTRES PASSproject hasshownthatitisbettertoexcludesomedetailsandtorelyonattackpatterns toaddpossibleattackstepstothegeneratedattackroute.
5.4AttackPatterns Todealwithdetailednessofmodels,andtheresultingdetailednessofattacks, weintroduceattackpatterns,whicharesimilartothemodelpatternsdiscussed intheprevioussection.Fortoodetailedmodelsitisdifficulttodealwiththe resultingoverlydetailedattacktrees.Formodelswithtoofewdetails,thisis equallydifficult.However,itiseasiertoadd“standard”attackpattenstoan attacktree,thanitistoremovesuperfluousnodes.
Attackpatternsidentifytypicalapproachestoperforminganattack.Since theyareusedtoextendtheattackerroutesorattacktreesintroducedearlier, attackpatternsarerepresentedassubtreesaswell.
1 labelmatch{ 2 caseINattackeritemcontainer: 3 //gettypeattackerfromattackerprofile 4 //gettypeitemfromknowledgebase 5 //gettypecontainerfromknowledgebase 6 //insertAPLattacksthatallowtoextractitemfromcontainer
7 caseMAKEattackeractoraction: 8 //gettypeattackerfromattackerprofile 9 //gettypeactorfromattackerprofile 10 //insertAPLattacksbasedontypesandaction 11 //... 12 }
Fig.2. Codefortheexpansionofgeneralattacktreesinacontext-unawarefashion.The expansionalgorithmiteratesoverallleafnodesandmatchesleafnodelabelsagainst theknowncases.Ifaleafnodelabelmatchesapatternintheattackpatternlibrary, itisinsertedintothegeneralattacktree.Figure 5 illustratesthisprocess.
Attackpatternsareappliedbyinspectingtheactionsinanattacktree,and byexploringwhetheracertainactionrealisationsofthisactionareknown.The overallstructureofthisexplorationisshowninFig. 2:Theexpansionalgorithm iteratesoverallleafnodesandmatchestheactionatthisleaf(representedas leafnodelabels)againsttheknowncases.Ifaleafnodelabelmatchesapattern intheattackpatternlibrary,itisinsertedintothegeneralattacktree.
Thisapproachhasanumberofbenefitsbeyonditcontributingtoclearingout modelsandkeepingthemfreeofclutter.Attackpatternlibrariescanbeshared betweenorganisationstodisseminatefindingsaboutpossibleattacks.Oncean attackpatternisavailableintheattacknavigator,wheneveramatchingaction workingonmatchingtypesofassetsoractorsisfound,thepatternwillbe instantiated.
TwoattackpatternsareshowninFigs. 3 and 4.ThepatterninFig. 3 replaces obtaininganitemfromanactorwitheitherstealingtheitemorsocialengineering theactortogiveittotheattacker.Therootofthepatternspecifiestheaction andthetypesoftheargumentsfortheactorAobtaininganitemIfromanactor C,representedasAinputingIfromC:
INAitem : Iactor : C Thisinformationiscrucialforapplyingthepattern,alsobecausethesearguments A(attacker),I(item),andC(actor)occuragainintheattackpattern,andmust bereplacedwiththematchingvaluesfromtheattacktree.
ThepatterninFig. 4 isabitmorecomplicated;itdescribesthatAmakes Bperformsomeactionforhim.Asbefore,therootofthepatternisreplaced withnodesthatrepresentdifferentalternativesintheattack.Itshouldbenoted thatlaterphasesmaydiscardsomeofthegeneratedattackssincetheymightbe infeasible.
Fig.3. Anattackpatternthatreplacestheactionofobtaining(inputting)anitem fromanactorwithtwoattacks,onestealingtheitemfromtheactor,andtheother onesocialengineeringtheactortohandovertheitem.
Fig.4. AnattackpatternthatreplacessocialengineeringanactorAtoobtain(input) anitemfromanotheractorB.Thealternativesinsertedarethreatening,blackmailing, bribing,andsocialengineeringactorAtoperformtheaction.
SocialEngineering: Atypicalexampleforattackstepsthatshouldbeadded throughattackpatterns,notthroughaddingmoredetailstothemodel,issocial engineering.Socialengineeringisanimportantfactorofattackingorganisations throughexploitingtheknowledgeandtheaccessrightsofemployeesorinsiders[22–24].Socialengineeringusuallyrequirescreatingapretext,whichispart ofbringingthevictimintoasituationwhereiteitherisnotawareofcontributing toanattack,orwhereithassufficientreasontobelievetodotherightthing.
Duetoitsdependencyonhumanbehaviour,socialengineeringisdifficultto dealwithinformalmethods.Sincethechoiceofpretext,forexampleapplying authority,dependsheavilyonthevictim,thiskindofattackisbestdealtwith throughattackpatterns.ThepatternsshowninFigs. 3 and 4 introducesocial engineeringnodes,wheretheattackersocialengineersanotheractortoperform anaction.
5.5AttackerandActorProfiles Thesuccessofbothattackersanddefendersdependsonthetypeofactorand theskillsconsidered.Intheattacknavigator,differentprofilesareconsidered basedonthreatagentmodelling[11–13],whichprovidesskills,resources,and objectivesofactors.Theattacknavigatoranalysisusestheseprofilestoidentify attacksandcountermeasuresonasystemmodel,andtopredictthelikelihood ofsuccessandimpactoftheattack.
Actorprofilesseparatetheplanningofaroutefromitsassessment:routesin theattacknavigatorare all possibleattackswithrespecttothemodel.Notall oftheseattacksarefeasibleforallattackers,buttheyarestillattacks.Forcar
Fig.5. Theexpansionofapartofageneralattacktree.Thepatterns(Figs. 3 and 4) mayhaveholes,whicharefilledwithattributesfromtheleafnodethatisexpanded. Forconjunctivenodes,theoutgoingedgesareconnectedwithanarc,indicatingthat allchildnodesarerequiredtobeexecutedtoreachthegoal.
key
key from Bob get key from shelf
IN Alice key Bob
SocENG Alice Charlie IN Charlie key Bob get key
get key from Bob get key from shelf
IN Alice key Bob
MAKE Alice Charlie IN Charlie key Bob
Alice steals key from Bob
Alice social engineers Bob to give her key
Alice threatens Charlie to execute IN Charlie key Bob
Alice blackmails Charlie
Alice collects intel about Charlie
Alice blackmails Charlie to execute IN Charlie key Bob
Alice bribes Charlie to execute IN Charlie key Bob
Alice social engineers Charlie
Alice impersonates authority
Alice orders Bob to execute IN Charlie key Bob
navigationthiswouldmeantoshowallpossiblepathsfromthestartingpointto thegoal,butroutesthatrequirea4WDcarwouldnotbefeasibleforallcars.
Realnavigationcannotconsiderallroutes,sinceitrequiresthedriverto decide,whichofthemanypossibleroutesisthebestwithrespecttoanoptimizationgoal.Forattacknavigationitisthereverse:asinglerouteorattack outofmanyisnotuseful;considering all attacksenablesthetoolstoidentify countermeasuresthatdisableasmanyattacksaspossiblewithacertaineffort, anditalsoenablesanalysisofwhichkindofattackertowatchoutfor.
6Countermeasures Ariskassessmentwouldbeuselessifitwouldnotcomewithawaytoincorporatecountermeasureeffectanalysis.Therearetwomajorwaysinwhichthe TRES PASSmethodologysupportsthis.
Thefirstapproachisgenericandcaninprinciplebeappliedtoanyrisk assessmentframework.Itusestheframeworkasablackboxwhichtakessome inputs(inthecaseofTRES PASS,thesystemmodel)andgivessomeoutput(in ourcase,prioritizedattackvectors).Assumingtheenduserisabletochange themodelandruntheanalysisagain,weobtainafulloperationalloopwith humaninvolvement,wheretheuserisexpectedtointerprettheanalysisresults andactivelyparticipateinthemodeldevelopment.
EventhoughTRES PASSaimsatautomatingtheriskanalysisprocess,we donotthinkthatfullautomationispossibleorevenneeded.Againcomingback totheterrainnavigationanalogue–thehumanisnotexpectedtofollowGPS blindly.Infact,severalcaseshavebeenreportedwhenpeoplebeingoverconfident intheGPSreadinghaveendedupinseriousaccidents[25, 26].Andevenifthe model, i.e.,themap,usedbytheGPSdeviceiscorrect,theusermaystillhave optimizationpreferencesthedeviceisunawareof.
Insomesense,thesituationisevenbetterwiththeattacknavigator.Here theuserhasmoreoptionsthanjustselectingbetweentheroutesofferedbya machine.Theusercanactuallychangethemapbyimplementingadditional controls,increasingefficiencyoftheexistingones,etc.Allthesechangeswould hopefullychangetherisklandscape,andrunningtheanalysistoolagainonan updatedmapistheprimewayofverifyingthis.
AsmentionedinSect. 2,attacktreesarenottheonlypossibleattackdescriptionlanguagethatcanbeusedinTRES PASS.Attack-defencetreesbyKordy etal. [27]areanalternativeapproachtocountermeasureselection.Inprinciple,thisformalismallowsforintegratingcountermeasuresintotheriskassessmentprocessonalowerlevelthanthegenericmodelupdateapproachdescribed above.Itispossiblealreadyattheattackgenerationstagetoalsogeneratecertaindefencenodesintothetreeortoobtainthosefromstandardlibraries.The optionofchangingthemodelandrunningtheanalysisagainofcourseremains,so theattack-defencetreeapproachispotentiallymoreflexiblethantheonebased onclassicalattacktrees.However,sinceattack-defencetreesareconsiderably morerecentandaccordinglylessstudied,thecurrentversionoftheTRES PASS toolset(asof2015)doesnotyetsupportthis.
7Conclusions Thenavigationmetaphorisanewapproachtosecurityassessmentofcomplex systemsthataimsatbeingmoreaccessibletoahumanenduserthanother computer-assistedframeworks.However,nometaphorcanmaketheinherent challengesofriskassessmenttogoaway,itcanonlytrytopresentthemonthe levelwherehumandecisionscanbemademoreintuitively.
TheTRES PASSprojecthasbeenbuildingatoolsetsupportingsuchaworkflow.Wehavepublishedkeyinnovationsinforexampletheattacknavigation metaphor[14],makingattackerprofilesexplicit[28],attackgeneration[20, 21], quantitativeanalysis[29, 30],andvisualisationofmapsandpaths[31, 32].Our practicalandtheoreticaldevelopmentsopenupformanynewandinteresting researchquestionsintheareaofattacknavigationandgraphicalmodelsfor security,forexample:
–Whatisthecorrectabstractionlevelforasystemmodelsandmapsthat wouldbehumanlycomprehensibleandatthesametimewouldallowformal analysis?
–Arethereadditionalopportunitiesforusingthepropertiesofattackerprofiles insecurityanalysis?Canweusemoreadvancedcalculationsorstatistics?
–ArethecurrentTRES PASSmodelcomponentsgeneralisableenoughtoperformrealisticsecurityassessmentsonawideclassofsystems,orareextensions neededfordifferenttypesofsystems?
–Howcanweshareattackpatternsandwhataretherequirementsonthe patternsharingauthorisationinfrastructure?
Acknowledgment. Theresearchleadingtotheseresultshasreceivedfundingfrom theEuropeanUnionSeventhFrameworkProgramme(FP7/2007–2013)undergrant agreementno.318003(TRES PASS).Thispublicationreflectsonlytheauthors’views andtheUnionisnotliableforanyusethatmaybemadeoftheinformationcontained herein.
References
1.Fischhoff,B.:Riskperceptionandcommunicationunplugged:twentyyearsof process.RiskAnal. 15(2),137–145(1995)
2.Jasanoff,S.:Thepoliticalscienceofriskperception.Reliab.Eng.Syst.Saf. 59(1), 91–99(1998)
3.Weinstein,N.D.:Whatdoesitmeantounderstandarisk?evaluatingriskcomprehension.J.Nat.CancerInst.Monogr. 25,15–20(1999)
4.TheConsortium:Projectwebpage,31October2015. https://www. trespass-project.eu
5.Schneier,B.:Attacktrees:modelingsecuritythreats.Dr.Dobb’sJ.Softw.Tools 24(12),21–29(1999). http://www.ddj.com/security/184414879
6.Kordy,B.,Pi`etre-Cambac´ed`es,L.,Schweitzer,P.:DAG-basedattackanddefense modeling:don’tmisstheforestfortheattacktrees.Comput.Sci.Rev. 13–14, 1–38(2014)
7.J¨urgenson,A.,Willemson,J.:Computingexactoutcomesofmulti-parameter attacktrees.In:Meersman,R.,Tari,Z.(eds.)OTM2008,PartII.LNCS,vol. 5332,pp.1036–1051.Springer,Heidelberg(2008)
8.J¨urgenson,A.,Willemson,J.:Serialmodelforattacktreecomputations.In:Lee, D.,Hong,S.(eds.)ICISC2009.LNCS,vol.5984,pp.118–128.Springer,Heidelberg (2010)
9.J¨urgenson,A.,Willemson,J.:Onfastandapproximateattacktreecomputations. In:Kwak,J.,Deng,R.H.,Won,Y.,Wang,G.(eds.)ISPEC2010.LNCS,vol.6047, pp.56–66.Springer,Heidelberg(2010)
10.Arnold,F.,Hermanns,H.,Pulungan,R.,Stoelinga,M.:Time-dependentanalysis ofattacks.In:Abadi,M.,Kremer,S.(eds.)POST2014(ETAPS2014).LNCS, vol.8414,pp.285–305.Springer,Heidelberg(2014)
11.Casey,T.:ThreatAgentLibraryHelpsIdentifyInformationSecurityRisks.Intel WhitePaper,Houston(2007)
12.Casey,T.,Koeberl,P.,Vishik,C.:Threatagents:anecessarycomponentofthreat analysis.In:ProceedingsoftheSixthAnnualWorkshoponCyberSecurityand InformationIntelligenceResearch,CSIIRW2010,pp.56:1–56:4.ACM,NewYork (2010)
13.Rosenquist,M.:PrioritizingInformationSecurityRiskswithThreatAgentRisk Assessment.IntelWhitePaper,Houston(2010)
14.Pieters,W.,Barendse,J.,Ford,M.,Heath,C.P.,Probst,C.W.:Thenavigation metaphorinsecurityeconomics.IEEESecur.Priv. 14,Scheduledforpublication inMay/June2016
15.VanHolsteijn,R.:Themotivationofattackersinattacktreeanalysis.Master’s thesis,TUDelft(2015)
16.CoxJr,L.A.:Gametheoryandriskanalysis.RiskAnal. 29(8),1062–1068(2009)
17.Pieters,W.,Davarynejad,M.:Calculatingadversarialriskfromattacktrees: controlstrengthandprobabilisticattackers.In:Garcia-Alfaro,J.,HerreraJoancomart´ı,J.,Lupu,E.,Posegga,J.,Aldini,A.,Martinelli,F.,Suri,N.(eds.) DPM/SETOP/QASA2014.LNCS,vol.8872,pp.201–215.Springer,Heidelberg (2015)
18.TheConsortium:FinalrequirementsforvisualisationprocessesandtoolsDeliverableD4.1.2(2015)
19.Pieters,W.,Dimkov,T.,Pavlovic,D.:Securitypolicyalignment:aformalapproach.IEEESyst.J. 7(2),275–287(2013)
20.Kamm¨uller,F.,Probst,C.W.:Invalidatingpoliciesusingstructuralinformation. In:2ndInternationalIEEEWorkshoponResearchonInsiderThreats(WRIT 2013).IEEECo-locatedwithIEEECSSecurityandPrivacy2013(2013)
21.Kamm¨uller,F.,Probst,C.W.:Combininggenerateddatamodelswithformal invalidationforinsiderthreatanalysis.In:3rdInternationalIEEEWorkshopon ResearchonInsiderThreats(WRIT2014).IEEECo-locatedwithIEEECSSecurityandPrivacy2014(2014)
22.Winkler,I.S.,Dealy,B.:Informationsecuritytechnology?don’trelyonit.acase studyinsocialengineering.In:USENIXSecurity(1995)
23.Thornburgh,T.:Socialengineering:the”darkart”.In:Proceedingsofthe1st AnnualConferenceonInformationSecurityCurriculumDevelopment,InfoSecCD 2004,pp.133–135.ACM,NewYork(2004)
24.Mitnick,K.D.,Simon,W.L.,Wozniak,S.:TheArtofDeception:Controllingthe HumanElementofSecurity.Wiley,Hoboken(2002)
25.Holley,P.:DriverfollowsGPSoffdemolishedbridge,killingwife,police say,15October2015. https://www.washingtonpost.com/news/morning-mix/wp/ 2015/03/31/driver
26.Knudson,T.:’DeathbyGPS’indesert,Lastvisited15October2015(2011). http://www.sacbee.com/entertainment/living/travel/article2573180.html
27.Kordy,B.,Mauw,S.,Radomirovi´c,S.,Schweitzer,P.:Attack-defensetrees.J.Log. Comput. 24(1),55–87(2014)
28.Lenin,A.,Willemson,J.,Sari,D.P.:Attackerprofilinginquantitativesecurity assessmentbasedonattacktrees.In:Bernsmed,K.,Fischer-H¨ubner,S.(eds.) NordSec2014.LNCS,vol.8788,pp.199–212.Springer,Heidelberg(2014)
29.Buldas,A.,Lenin,A.:Newefficientutilityupperboundsforthefullyadaptive modelofattacktrees.In:Das,S.K.,Nita-Rotaru,C.,Kantarcioglu,M.(eds.) GameSec2013.LNCS,vol.8252,pp.192–205.Springer,Heidelberg(2013)
30.Lenin,A.,Willemson,J.,Charnamord,A.:Geneticapproximationsforthefailurefreesecuritygames.In:Khouzani,M.H.R.,etal.(eds.)GameSec2015.LNCS,vol. 9406,pp.311–321.Springer,Heidelberg(2015).doi:10.1007/978-3-319-25594-1 17
31.Hall,P.,Heath,C.,Coles-Kemp,L.,Tanner,A.:Examiningthecontributionofcriticalvisualisationtoinformationsecurity.In:Proceedingsofthe2015NewSecurity ParadigmsWorkshop.ACM(2015)
32.Heath,C.H.P.,Coles-Kemp,L.,Hall,P.A.,etal.:Logicallego?co-constructed perspectivesonservicedesign.In:DS81:ProceedingsofNordDesign2014,Espoo, Finland,27–29thAugust2014
IntegratedVisualizationofNetworkSecurity MetadatafromHeterogeneousDataSources VolkerAhlers(B) ,FelixHeine,BastianHellmann,CarstenKleiner, LeonardRenners,ThomasRossow,andRalfSteuerwald
FacultyIV,DepartmentofComputerScience,UniversityofAppliedSciencesand ArtsHannover,P.O.Box920251,30441Hannover,Germany volker.ahlers@hs-hannover.de,trust@f4-i.fh-hannover.de http://trust.f4.hs-hannover.de/
Abstract. Incomputernetworksmanycomponentsproducevaluable informationaboutthemselvesorotherparticipants,especiallysecurity analysisrelevantinformation.Althoughsuchinformationisintrinsically relatedascomponentsareconnectedbyanetwork,mostofthemstill operateindependentlyanddonotsharedataamongsteachother.Furthermore,thehighlydynamicnatureofanetworkhampersaprofound understandingofsecurityrelevantsituations,suchasattackscenarios. Hence,acomprehensiveviewofthenetworkincludingmultipleinformationsourcesaswellastemporalnetworkevolutionwouldsignificantly improvesecurityanalysisandevaluationcapabilities.Inthispaper,we introduceacomprehensiveapproachforanintegratedvisualization,coveringallaspectsfromdataacquisitioninvarioussourcesuptovisual representationoftheintegratedinformation.Weanalyzetherequirementsonthebasisofanexemplaryscenario,proposesolutionscovering thesedemandsbasedontheIF-MAPprotocol,andintroduceoursoftwareapplicationVisITMetaasaprototypicalimplementation.Weshow howthegraph-basedIF-MAPprotocolprovidesagraphicalmodelfor anintegratedviewofnetworksecurity.
1Introduction Inrecentyearsseveralvisualizationapproacheshavebeenproposedfornetwork securitycomponentslikeIntrusionDetectionSystem(IDSandflowcontrollers, whichmonitordifferentaspectsofnetworktrafficorthebehaviorofsystemsand users[11].Foracomprehensiveviewontheoverallnetworkstate,however,an integratedvisualizationofsecurityinformationgatheredfrommultipleseparate componentsisdesirable.Incontrasttoexistingdashboarduserinterfaces,which visualizeinformationfromdifferentsourcesinseparateviewsonthesamescreen, weaimatthevisualizationofhomogenizeddatawithinasinglerepresentationto emphasizetheirinterrelations.Inthisway,theusercangetathoroughunderstandingofwell-definedaspectsofthenetworkbyfocusingonitsimmediate surroundings,whilestillbeingabletogainabroadoverviewofthenetworkby includingmoregenerallyrelateddata,e.g.infrastructureinformation.Anintegratedvisualizationtherebyfacilitatesadetailedassessmentofthesecuritystate andthedetectionofpotentialsecuritythreatsorattacks.
c SpringerInternationalPublishingSwitzerland2016 S.Mauwetal.(Eds.):GraMSec2015,LNCS9390,pp.18–34,2016. DOI:10.1007/978-3-319-29968-6 2
1.1ExemplaryRealWorldScenario Thefollowingscenarioclarifiesthenecessityofthoseadvancedmonitoringand visualizationapproachesandservesasabasisfortherequirementswederivefor ourapproach.Givenisatypicalenterpriseenvironmentwithseveralemployees, eachwithapersonalcomputerorsmartphone.Theyarepartofanetwork, whichincludesservices,likemailandSSHservers,internalstoragedevices,and databases.AnIDSisusedtodetectunwantedbehaviorandfirewallsregulate thetrafficandenforcethesecuritypolicy.
Onepossibleattackscenarioisauserdownloadinganinfectedfile(notrecognizedbytheIDS),whichresultsincompromisinghisaccountanddevice.The malwarenotonlystartstospreadacrosstheinternalnetwork,butalsotries tocompromisefurtheraccountsbyconductingbrute-forceloginattemptsonto availableserviceswithinthenetwork(thisfinallyisdetectedbytheIDS).Subsequentlysystemssuccessfullyinfectedstartdoingthesame.
Thedesiredprocessforanetworksecurityadministratoristo:(1)Quickly detectnotonlysingleincidents,butrecognizethecombinationoffailedlogin attemptsonmultipleservicesbythesameusers.(2)Findthesourcesofthe attacksandtherebytheinfectedsystemsandusers(theymightusedifferentlogin informationorspoofedaddresses).(3)Discovertheinitialsecuritybreachby identifyingtheinitiallyinfectedcomponentanddeterminethewaythemalware enteredthenetwork.(4)Reactasfastaspossible(e.g.,shutdownaccountsor lockoutdevices)topreventfurtherharm,likesuccessfulbrute-forceattempts. (5)Returnthenetworkaswellasitscomponentsanduserstowardsaproductive stateaftertheproblemhasbeenhandledappropriately.
1.2Requirements AtoolwhichhelpsthesecurityadministratorperformtasksasinSect. 1.1 has tofulfillthreemainrequirements,eachofwhichwithsuitablevisualsupport.
(I) Real-timeMonitoring. Duetothehighlydynamicnatureofnetworks,time isacrucialfactorwhenanalyzingthenetworkstate.Fastreactionscanpreventothersystemsfromgettingcorruptedorvaluableinformationfrom gettingstolen.Furthermore,analysisresultsmayonlybeaccuratefora certaintimeframe,anditiscrucialtoacquireknowledgebeforeitisoutdated.
(II) DataIntegration. Thedifferentnetworkcomponentsgenerallyperform theirrespectivetaskswithoutcommunicatingwitheachotherorsharing theiravailableinformation,mostofthemusingproprietarydatamodels. Toovercometheseisolatedviews,anintegrationofthedifferentpartsof informationisfundamental.Nevertheless,thesourceofeachdatumshould stillberetained,inordertocorrelateachievedknowledgeonasemantically higherlevelwiththetriggeringlowlevelevents.
(III) RetrospectiveAnalysis. Inordertounderstandthecurrentstateofanetworkitisnecessarynotonlytoperceiveanddetectcurrentsituations,but
Another random document with no related content on Scribd:
beveiligd door een dijk, zig strekkende van de uitwatering van de Vecht in de Zuiderzee af, tot aan Muiderberg, en van daar tot Naarden toe.
N A A M S O O R S P R O N G . Deeze wordt gevonden in de ligging der stad, zijnde, gelijk boven gezegd is, aan de Zuiderzee, bepaaldlijk ter plaatse alwaar de mond van de Vecht is: het woord Mond nu, was weleer Muden, zijnde door klankverbastering in Muiden veranderd; de oude naam Amuden, zegt men, bevestigt zulks nog nader; het eerste gedeelte deezes zamengestelden woords, Aa naamlijk, betekende toen, gelijk nog, een rivier, waarvan de Mond mede ter deezer plaatse is: in oude geschriften komt het steedjen dikwerf voor onder den gezegden naam van Amuden.
S T I C H T I N G G R O O T T E S T E R K T E . Wanneer Muiden gesticht zij, is niet te bepaalen, alzo het van een visschers dorp of vlek, tot den rang der steden verheven is: onbetwistbaar is het intusschen dat men deeze stad den toenaam van grijs of oud mag geeven; want in den jaare 953 wordt reeds van dezelve gewaagd.
Wat de grootte betreft, vòòr den jaare 1632 vinden wij er 146 huizen voor aangetekend; en honderd jaaren laater, telde men er 205; anderen geeven er negen minder op, naamlijk slechts 196: de verpondingen welken dezelven opbrengen, beloopen weinig meer dan zeven honderd guldens.
Behalven wegens de gemelde groote sluis, is Muiden onder de sterke steden van Nederland te plaatsen: het heeft drie van boven open poorten; behalven de zogenaamde Sortiepoorten van het beruchte slot, ’t welke aldaar gevonden wordt, (hier van nader;) de vestingwerken [3]der stad zijn zodanig dat men dezelve weerbaar mag noemen, en weleer wilde men dat Muiden, behoorelijk versterkt, en met tweeduizend man bezet, geen hond in of uit de stad zoude kunnen komen: in den
beginne der zestiende eeuw, getuigt men, had Muiden noch poorten noch muuren; daarna heeft het beiden gekregen, en van tijd tot tijd is het noodig bevonden om ’t steedjen te versterken, en de versterking te verbeteren, vooral ook het slot: in 1629, toen de Spanjaarden in de Veluwe stroopten, was men desaangaande met ernst bedacht, echter is tot de daad zelve geen besluit genomen; in onze jongstledene troublen, toen menig dapper patriot naar Muiden getrokken is, om zijn hoofd voor de zaak, die toen van dien kant gedreven werd, ten pande te stellen, is het steedjen in volkomenen staat van tegenweer gebragt, schoon het zig aan de Pruissen heeft moeten overgeeven.
’T W A P E N Is een blaauw veld, met een zilveren dwarsbalk er door.
KERKLIJKE