Configuration of and Interaction Between Information Security Technologies: The Case of Firewalls and Intrusion Detection Systems

Abstract

P roper configuration of security technologies is critical to balance the needs for access and protection of information. The common practice of using a layered security architecture that has multiple technologies amplifies the need for proper configuration because the configuration decision about one security technology has ramifications for the configuration decisions about others. Furthermore, security technologies rely on each other for their operations, thereby affecting each other's contribution. In this paper we study configuration of and interaction between a firewall and intrusion detection systems (IDS). We show that deploying a technology, whether it is the firewall or the IDS, could hurt the firm if the configuration is not optimized for the firm's environment. A more serious consequence of deploying the two technologies with suboptimal configurations is that even if the firm could benefit when each is deployed alone, the firm could be hurt by deploying both. Configuring the IDS and the firewall optimally eliminates the conflict between them, ensuring that if the firm benefits from deploying each of these technologies when deployed alone, it will always benefit from deploying both. When optimally configured, we find that these technologies complement or substitute each other. Furthermore, we find that while the optimal configuration of an IDS does not change whether it is deployed alone or together with a firewall, the optimal configuration of a firewall has a lower detection rate (i.e., allowing more access) when it is deployed with an IDS than when deployed alone. Our results highlight the complex interactions between firewall and IDS technologies when they are used together in a security architecture, and, hence, the need for proper configuration to benefit from these technologies.

A game-theory approach to manage decision errors

“…Probability of detection is P D, probability of false negative is 1−P D ; Probability of false positive is P F. P D = P (classified as attacker | attacking transaction); P F = P (classified as attacker | normal transaction); [10]. Because of the inaccuracy inherent in the IDS, manual investigations from a human security expert are necessary to verify the signal given by the IDS.…”

Strategic analysis of complex security scenarios.

“…The academic research community, in contrast, has aimed to shift focus on providing specific guidance about security investments, though in many cases this guidance is in very specific security contexts, such as whether or not to deploy a firewall or an IDS, and how to configure it if deployed [113,107,32,29,31,33]. The corresponding approaches are either decision theoretic, modeling threats as unaffected by mitigation policies [113,107,32], or game theoretic, accounting for the impact of security policies on attackers' incentives [32,29,31,33].…”

“…The corresponding approaches are either decision theoretic, modeling threats as unaffected by mitigation policies [113,107,32], or game theoretic, accounting for the impact of security policies on attackers' incentives [32,29,31,33].…”

“…For example, the standard approach to security risk management in the industry is to consider consequences in terms of asset value, consequence of a threat on that value, and frequency of threat, but either treats assets as independent, or abstracts away the complex interdependencies in a single cost/value measure [72]. Research in IT security management has largely been in line with this framework [113,107,32,29,43,31,88,30,33,15]. The strands that explicitly model interdependent risk focus on spillover effects among many organizations or entities, rather than policy to secure interdependent assets [73,89].…”

The Assumptions and Profiles Behind IT Security Behavior

“…In the following paragraphs, we give a brief overview of the literature on IT security before describing the methodology and the analysis sections. The IT security literature is extensive, covering such manifold topics as information sharing among peers [11], disclosure of vulnerabilities in software [16], disclosure of security breaches [23], technical capabilities against outside attacks [2] and technical capabilities against opportunistic employees [12]. Several published reviews of the ITsec literature provide comprehensive meta-analyses of technical and behavioral ITsec research [25], of the deterrence approach in compliance [8], and of the different approaches to increase employee compliance to ITsec policies [1].…”