A Combined Attack-Tree and Kill-Chain Approach to Designing Attack-Detection Strategies for Malicious Insiders in Cloud Computing

Abstract

Attacks on cloud-computing services are becoming more prevalent with recent victims including Tesla, Aviva Insurance and SIM-card manufacturer Gemalto [1]. The risk posed to organisations from malicious insiders is becoming more widely known about and consequently many are now investing in hardware, software and new processes to try to detect these attacks. As for all types of attack vector, there will always be those which are not known about and those which are known about but remain exceptionally difficult to detectparticularly in a timely manner. We believe that insider attacks are of particular concern in a cloud-computing environment, and that cloudservice providers should enhance their ability to detect them by means of indirect detection.We propose a combined attack-tree and kill-chain based method for identifying multiple indirect detection measures. Specifically, the use of attack trees enables us to encapsulate all detection opportunities for insider attacks in cloud-service environments. Overlaying the attack tree on top of a kill chain in turn facilitates indirect detection opportunities higher-up the tree as well as allowing the provider to determine how far an attack has progressed once suspicious activity is detected.We demonstrate the method through consideration of a specific type of insider attack -that of attempting to capture virtual machines in transit within a cloud cluster via use of a network tap, however, the process discussed here applies equally to all cloud paradigms.

Vulnerabilities Mapping based on OWASP-SANS: A Survey for Static Application Security Testing (SAST)

“…Over the last few years, attack methods [8][9][10][11][12][13] have grown with the evolution of fundamental technology and architecture of applications (e.g. JavaScript attacks [20], and attacks on cloudcomputing services [21]), and hence the update [14] of OWASP Top 10 as illustrated in Table 1 below.…”

Methods Combining for Identifying of Insiders in Large Information Systems

“…В работе [5] описано решение задачи противодействия атакам на сервисы облачных вычислений со стороны инсайдеров, для чего комбинируется пара методов путем их наложения. Первый основан на классическом дереве атак, примененном к внутренней среде облачных сервисов; второй представляет собой, так называемую, цепочку уничтожения, вышедшую из концепции ведения боевых действий и заключающуюся в отслеживании степени продвижения атаки к заданным целям.…”

A Review: Insider Attack in New Normal

“…We clarify the nature and state of the insiders with respect to and with reference to the cloud ecosystem. [7] Symptomatic Insider:…”