A Software-Defined Security Strategy for Supporting Autonomic Security Enforcement in Distributed Cloud

Abstract

We propose in this paper a software-defined security framework, for supporting the enforcement of security policies in distributed cloud environments. These ones require security mechanisms able to cope with their multi-tenancy and multi-cloud properties. This framework relies on the autonomic paradigm to dynamically configure and adjust these mechanisms to distributed cloud constraints, and exploit the software-defined logic to express and propagate security policies to the considered cloud resources. The proposed framework is evaluated through a set of validation scenarios corresponding to a realistic use cases including cloud resource allocation/deallocation, cloud resource state change, and dynamic access control.

SmartX Multi-Sec: A Visibility-Centric Multi-Tiered Security Framework for Multi-Site Cloud-Native Edge Clusters

“…Also, the visibility and semi-automated deployment features to cope with the increasing scale of distributed clusters are not clearly proposed in the work. On the other hand, SDSec [13] proposes a hierarchical architecture with protocols to effectively manage security rules across multisite edge-boxes. Even though this work has similar focuses in managing rules of security functions, its targets are limited to physical and virtual boxes.…”

“…Meanwhile, many novel security schemes for detection accuracy and management effectiveness have been proposed [9]- [13]. Some of the suggested schemes are touching the use of edge as defense belts for a centralized cloud by mitigating DDoS (distributed denial of service) attack or proactive ML (machine learning)-based IDS (intruder detection system).…”

Towards a Software-Defined Security Framework for Supporting Distributed Cloud

“…In accordance with [3] where we give the basement of our software-defined security approach, the autonomic paradigm is tied to endorse the continuous security policy enforcement able to cope with the changes occurring on the security policy, the tenant configuration and the protected resource state. We extend our previous work by detailing each components and protocols supporting our framework, and giving a critical analysis and implementation considerations based on realistic scenarios.…”

“…We have already highlighted the benefits of software-defined security for distributed cloud environments in [3]. We detail in this paper the different components and protocols of our security framework relying on software-defined and autonomic paradigms, and provides a critical analysis of the proposed solution considering a set of validation scenarios based on a realistic use case.…”

Cyber-Sicherheit für kritische Energieinfrastrukturen – Handlungsempfehlungen zur Umsetzung einer Zero-Trust-Architektur

“…Typische Angriffsszenarien auf kritische Energieinfrastrukturen sind hierbei u. a. Angriffe auf Software-Lieferketten sowie die Verbreitung von Schadcode über reguläre Update-Mechanismen (Bundesamt für Sicherheit in der Informationstechnik 2022). Herkömmliche (Netzwerk-) Sicherheitsarchitekturen zum Schutz kritischer Infrastrukturen sind diesen Gegebenheiten nicht ausreichend gewachsen (Compastié et al 2016). Die meisten der entsprechend zugrunde liegenden Konzepte beruhen noch auf einer Trennung zwischen internen und externen Netzwerken, wie Buck et al (2021) erläutern.…”