Automating Security Mediation Placement

Abstract

Abstract. We present a framework that automatically produces suggestions to resolve type errors in security-typed programs, enabling legacy code to be retrofit with comprehensive security policy mediation. Resolving such type errors requires selecting a placement of mediation statements that implement runtime security decisions, such as declassifiers and authorization checks. Manually placing mediation statements in legacy code can be difficult, as there may be several, interacting type errors. In this paper, we solve this problem by constructing a graph that has the property that a vertex cut is equivalent to the points at which mediation statements can be inserted to allow the program to satisfy the type system. We build a framework that produces suggestions that are minimum cuts of this graph, and the framework can be customized to find suggestions that satisfy programmer requirements. Our framework implementation for Java programs computes suggestions for 20,000 line programs in less than 100 seconds, reduces the number of locations a programmer must consider by 90%, and selects suggestions similar to those proposed by expert programmers 80% of the time.

Transforming commodity security policies to enforce Clark-Wilson integrity

“…Given available security policies, we claim that building system-wide infor- mation flow problems can be largely automated, resulting a similar effort as configuring information flow problems for single entities (programs or MAC policies). We design an automated method to produce mediator placements from such problems that is an extension of the basic graph cut idea [37,19] to address general lattices and constrained mediators.…”

“…Researchers had the insight that placing a mediator to resolve information flow errors for a lattice policy containing two levels li and lj is tantamount to generating an edge cut 4 of the data flow graph with the nodes mapped to li as the sources and the nodes mapped to lj as the sinks [37,19]. This property is called Cut-Mediation Equivalence.…”

“…In the context of security lattices, researchers previously suggested a simple greedy solution to the problem that returns the union of the solutions for each individual cut problem [19].…”

“…Our goal is to use the system's available security policies to produce a system-wide policy with the minimal mediation necessary to resolve the system's information flow errors as defined in Definition 2.1. We are motivated by prior work that demonstrated that a placement of mediators that resolves all information flow errors is equivalent to a cut of error paths in the data flow graph [37,19]. However, to make this idea practical, we explore how to produce an information flow policy for the example web application that resolves its local and remote threats.…”

Monitor placement for large-scale systems

“…However, building either attack trees or attack graphs currently requires knowledge about the likely vulnerabilities on individual hosts, which may be incomplete (i.e., previously-unknown vulnerabilities may be missed) and brittle (i.e., vulnerabilities may be patched). Alternatively, researchers have developed methods to place security monitoring to block or limit adversary access to prevent attacks based on classical problems [27,30,17]. These methods focus on only one layer of the system, such as the network, a single host, or a single program because the size of the graphs becomes prohibitive.…”