Tolerating Intrusions Through Secure System Reconfiguration

1
Tolerating Intrusions ThroughSecure System
Reconfiguration

• Dennis Heimbigner and Alexander Wolf
• University of Colorado at Boulder
• John Knight
• University of Virginia
• Prem Devanbu, Michael Gertz, and Karl Levitt
• University of California at Davis

2
Project Overview
Survivability Specifications
Configurability Specifications
ATTACKS
Privilege Specifications
Critical System
Solution Requirements Timely Assured Mediated Auto
mated
Driving Principles Bend, dont break Proactive
and reactive Specification/model-based Dynamic
tolerance evolution
Critical Systems Families Distributed Networked Co
mponentized
3
Posturing
Intelligence Information
No requirement to mask faults
Posture
Vulnerability Analysis
Posture
Anticipated Attacks
Analysis
Posture
Posture
Secure System Configuration/ Reconfiguration
Operational Experience
Posture
Attacked
Threatened
Over hardened
4
Survivability Architecture (Logical View)
During Attack
Commands
New Postures
Before and After Attack
5
Survivability Architecture (Physical View)
6
Integrated Technology Strategy

• Application reconfiguration for survivability
• RAPTOR modeling system
• Survivability specification
• Agent-based software configuration and deployment
• Software Dock software deployment system
• Siena wide-area event notification service
• Agent and information security
• Secure, flexible information access
• Trusted code on untrustworthy platforms

7
RAPTOR Modeling System

• Arbitrary network topologies
• Large model support
• Demonstration
• FedWire payment system
• 10 000 banks
• Terrorist bombs
• Coordinated attacks
• Windows 2000 platform
• Available for download soon

Visualization
Network Topology
Symptoms
Network Model
Vulnerabilities
Node Semantics
8
Software Dock
9
Secure, Flexible Information Access
Publisher 1
Owner 1
Agent
Mediator
Publisher n
Owner n
Authority
Untrusted
Sometimes trusted
Trusted

• Mediators provide to agents information obtained
  from model owners via publishers
• Two complementary forms of security
• Publishers answer queries from mediators, and are
  untrusted, online, and distinct from owners they
  use no secret keys
• Authorities, under administrative control, can
  certify and revoke owner keys and privileges

10
Evaluation

• Continuous assessment
• Increasingly sophisticated models
• Increasingly capable prototypes
• Scenario-based approach
• Increasingly complex attacks
• Informed by interaction with domain experts
• banking and finance, power, transportation
• security threats and vulnerabilities
• Symptom and vulnerability injection
• Metrics speed, precision, and availability

11
(No Transcript)