A situation-driven framework for dynamic security management

Laborde, Romain; Oglaza, Arnaud; Wazan, Ahmad Samer; Barrère, François; Benzekri, Abdelmalek

doi:10.1007/s12243-018-0673-0

Cited by 6 publications

(7 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The specification of the situations depends on the sensors available in the vessel and their characteristics. Different patterns for describing situations using CEP have been proposed in [ 8 , 9 ]. The resulting low level situations specification is then provided to a situation manager that continuously calculate the current situation.…”

Section: The Proposed Methodologymentioning

confidence: 99%

“…Therefore, the security policy refers to them only. Hence, we represent situation-based security policies in a generic way as: when situation and some condition then authorization decision and/or obligation(s) where the condition statement is any constraint on any characteristic of the entities involved in the situation as well as the situation itself [ 8 ]. This generic approach is flexible enough to express changes of security controls when the situation is shifting to another one using the reactive rules pattern: when situation and situation starts [ and some condition ] then obligation(s) where the obligations reflect the security controls modifications the security management system will enforce.…”

Section: The Proposed Methodologymentioning

confidence: 99%

“…In this paper, we propose an adaptive security framework that covers both dynamic risk assessment and situational driven security policy deployment. We extend a maritime-specific risk assessment methodology (MITIGATE [ 5 , 6 ]) to suggest adaptive security controls, and integrate it with a situation-driven security management framework (DynSMAUG [ 7 , 8 , 9 ]) to dynamically enforce adaptive security policies implementing the security controls. We will follow a situation-driven approach.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Adaptive, Situation-Based Risk Assessment and Security Enforcement Framework for the Maritime Sector

Grigoriadis

Laborde

Verdier

et al. 2021

Sensors

Self Cite

View full text Add to dashboard Cite

Maritime processes involve actors and systems that continuously change their underlying environment, location and threat exposure. Thus, risk mitigation requires a dynamic risk assessment process, coupled with an adaptive, event driven security enforcement mechanism, to efficiently deal with dynamically evolving risks in a cost efficient manner. In this paper, we propose an adaptive security framework that covers both situational risk assessment and situational driven security policy deployment. We extend MITIGATE, a maritime-specific risk assessment methodology, to capture situations in the risk assessment process and thus produce fine-grained and situation-specific, dynamic risk estimations. Then, we integrate DynSMAUG, a situation-driven security management system, to enforce adaptive security policies that dynamically implement security controls specific to each situation. To validate the proposed framework, we test it based on maritime cargo transfer service. We utilize various maritime specific and generic systems employed during cargo transfer, to produce dynamic risks for various situations. Our results show that the proposed framework can effectively assess dynamic risks per situation and automate the enforcement of adaptive security controls per situation. This is an important improvement in contrast to static and situation-agnostic risk assessment frameworks, where security controls always default to worst-case risks, with a consequent impact on the cost and the applicability of proper security controls.

show abstract

Section: The Proposed Methodologymentioning

confidence: 99%

Section: The Proposed Methodologymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An Adaptive, Situation-Based Risk Assessment and Security Enforcement Framework for the Maritime Sector

Grigoriadis

Laborde

Verdier

et al. 2021

Sensors

Self Cite

View full text Add to dashboard Cite

show abstract

“…We developed a situation-awareness approach [12,13,14] to deal with such complex security management issues. In this section, we specify this use case scenario as a security situationbased model.…”

Section: Expressing Situations Using Complex Eventsmentioning

confidence: 99%

“…In [12], we developed dynSMAUG a situation-driven framework for dynamic security management. Its architecture aims at allowing the deployment of security policies including authorization and obligation policies.…”

Section: Situationsmentioning

confidence: 99%

Dynamic security management driven by situations: An exploratory analysis of logs for the identification of security situations

Benzekri

Laborde

Oglaza

et al. 2019

2019 3rd Cyber Security in Networking Conference (CSNet)

Self Cite

View full text Add to dashboard Cite

Situation awareness consists of "the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future". Being aware of the security situation is then mandatory to launch proper security reactions in response to cybersecurity attacks. Security Incident and Event Management solutions are deployed within Security Operation Centers. Some vendors propose machine learning based approaches to detect intrusions by analysing networks behaviours. But cyberattacks like Wannacry and NotPetya, which shut down hundreds of thousands of computers, demonstrated that networks monitoring and surveillance solutions remain insufficient. Detecting these complex attacks (a.k.a. Advanced Persistent Threats) requires security administrators to retain a large number of logs just in case problems are detected and involve the investigation of past security events. This approach generates massive data that have to be analysed at the right time in order to detect any accidental or caused incident. In the same time, security administrators are not yet seasoned to such a task and lack the desired skills in data science. As a consequence, a large amount of data is available and still remains unexplored which leaves number of indicators of compromise under the radar. Building on the concept of situation awareness, we developed a situation-driven framework, called dynSMAUG, for dynamic security management. This approach simplifies the security management of dynamic systems and allows the specification of security policies at a high-level of abstraction (close to security requirements). This invited paper aims at exposing real security situations elicitation, coming from networks security experts, and showing the results of exploratory analysis techniques using complex event processing techniques to identify and extract security situations from a large volume of logs. The results contributed to the extension of the dynSMAUG solution.

show abstract

Adaptive Security for Self-Protection of Mobile Computing Devices

et al. 2019

View full text Add to dashboard Cite

A situation-driven framework for dynamic security management

Abstract: A situation-driven framework for dynamic security management. (2019) Annals of Telecommunications, 74 (3-4). 185-196.

Cited by 6 publications

References 21 publications

An Adaptive, Situation-Based Risk Assessment and Security Enforcement Framework for the Maritime Sector

An Adaptive, Situation-Based Risk Assessment and Security Enforcement Framework for the Maritime Sector

Dynamic security management driven by situations: An exploratory analysis of logs for the identification of security situations

Adaptive Security for Self-Protection of Mobile Computing Devices

Contact Info

Product

Resources

About