Analysis of operating system diversity for intrusion tolerance

Abstract

One of the key benefits of using intrusion-tolerant systems is the possibility of ensuring correct behavior in the presence of attacks and intrusions. These security gains are directly dependent on the components exhibiting failure diversity. To what extent failure diversity is observed in practical deployment depends on how diverse are the components that constitute the system. In this paper, we present a study with operating system's (OS's) vulnerability data from the NIST National Vulnerability Database (NVD). We have analyzed the vulnerabilities of 11 different OSs over a period of 18 years, to check how many of these vulnerabilities occur in more than one OS. We found this number to be low for several combinations of OSs. Hence, although there are a few caveats on the use of NVD data to support definitive conclusions, our analysis shows that by selecting appropriate OSs, one can preclude (or reduce substantially) common vulnerabilities from occurring in the replicas of the intrusion-tolerant system. ‡ A specific type of bug, regarding security, is usually called a vulnerability. Once a vulnerability is discovered, it can be maliciously exploited. If the exploited vulnerability leads to the software system deviating from its intended requirements or security policy, then the system is deemed to have failed. The system can fail on a single or combination of the following security properties: confidentiality, availability, and integrity. In the rest of this paper, we will use the terms fault and vulnerability interchangeably. 736 M. GARCIA ET AL.faulty. To satisfy this provision, system components need to exhibit failure diversity, that is, the probability that a majority of components fail at the same time should be negligible (or else the system as a whole will fail). This failure diversity assumption is easier to justify when one is concerned with accidental faults, such as power outages, disk crashes, or message corruption due to noise in communication lines. However, for design faults of any kind, including security vulnerabilities, the assumption is difficult to guarantee. If multiple components contain the same vulnerabilities, then a single attack can compromise all of them, therefore defeating the aim of intrusion tolerance system in providing improved security.To reduce the probability of vulnerabilities existing in more than one component, design diversity [3] can be employed: each component uses diverse software to perform the same functions, with the expectation that the differences will reduce the occurrence of common vulnerabilities, that is, vulnerabilities that exist in more than one system. Byzantine fault-tolerant replication often suggest the use of replica diversity (e.g., [4][5][6][7][8][9][10][11][12][13][14]), under the (sometimes implicit) assumption that they exhibit failure diversity. In this work, we want to empirically assess to what extent failure diversity is exhibited in a complex category of OTS software, namely operating systems (OSs).We focus our study on OS because they are a...

Diversity, Safety and Security in Embedded Systems: Modelling Adversary Effort and Supply Chain Risks

“…Compared with a single version, for ( < 0.5 using three diverse versions reduces the probability of integrity breach but increases the probability of confidentiality breach: the well known, common trade-off between confidentiality and integrity. As may be expected by analogy with 2-out-of-3 voted systems, with q>0.5 diversity increases risk 7 .…”

“…an early survey and references [3]; a more recent one in [7]). Apart from the various proposals of architectures using them (usually with limited and often simplistic modelling; see the discussion in [3]) there is empirical work on the effectiveness of diversity and defence in depth with specific products [8], [9], [7], [10] distribution of the number of flawed versions in the system is hypergeometric.…”

Software-Defined Networking: A Comprehensive Survey

“…Interoperability can be leveraged to increase the diversity of the control platform element. Indeed, diversity increases the system robustness by reducing the probability of common faults, such as software faults [210].…”

“…If anything wrong happens with the network, operators should be able to safely figure out the root cause of the problem and put the network to work on a secure operation mode as fast as possible. Additionally, techniques to tolerate faults and intrusions, such as state machine replication [515], proactivereactive recovery [516], and diversity [210], can be added to control platforms for increasing the robustness and security properties by automatically masking and removing faults. Put differently, SDN controllers should be able to resist against different types of events (e.g., power outages, network disruption, communication failures, network partitioning) and attacks (e.g., DDoS, resource exhaustion) [357], [213].…”

Diversity with intrusion detection systems: An empirical study

“…-phpBB (phpBB.com) -a widely used forum solution. Table I shows the total number of benign demands (crawling actions) and successful attacks 8 for each application. Each IDS inspected the same traffic for each application.…”