Defending against the Unknown Enemy: Applying FlipIt to System Security

Abstract

Abstract. Most cryptographic systems carry the basic assumption that entities are able to preserve the secrecy of their keys. With attacks today showing ever increasing sophistication, however, this tenet is eroding. "Advanced Persistent Threats" (APTs), for instance, leverage zero-day exploits and extensive system knowledge to achieve full compromise of cryptographic keys and other secrets. Such compromise is often silent, with defenders failing to detect the loss of private keys critical to protection of their systems. The growing virulence of today's threats clearly calls for new models of defenders' goals and abilities. In this paper, we explore applications of FL I PIT, a novel game-theoretic model of system defense introduced in [14]. In FL I PIT, an attacker periodically gains complete control of a system, with the unique feature that system compromises are stealthy, i.e., not immediately detected by the system owner, called the defender. We distill out several lessons from our study of FL I PIT and demonstrate their application to several real-world problems, including password reset policies, key rotation, VM refresh and cloud auditing.

Threshold FlipThem: When the Winner Does Not Need to Take All

“…For example the paper [2] examines the FlipIt game as applied to various different situations in computer security; for example password reset strategies, key management, cloud auditing and virtual machine refresh methodologies.…”

“…Note that µ * = λ * = 0 is an equilibrium of the game defined by equations in (2). This is an artefact of assuming the existence of a unique distribution for all µ, λ, where as when λ = µ = 0 the Markov chain never makes any transitions.…”

FlipThem: Modeling Targeted Attacks with FlipIt for Multiple Resources

“…Table 1 contains the most important difference in notation between the original FlipIt game and our FlipThem game. FlipIt [13,2] is a two-player, zero-sum game modeling stealthy takeovers, in which both players are trying take control of a single resource. One of the players is called the defender (denoted by D), while the other player is called the attacker (denoted by A).…”

“…Existing work [13,2,11] studies a single resource, yet in practice the security of a key asset depends on multiple resources that an attacker has to compromise at the same time. Also, the severity of an attack typically depends on the number of compromised assets.…”

Multi-rate Threshold FlipThem

“…To model such long term stealthy attacks researchers have turned to game theory [1,21,24,28], adding to a growing body of work looking at game theory in cybersecurity in various scenarios [7,15,34]. Probably the most influential work applying game theory in the security area has been the FlipIt game [33]; with the follow up paper [5] demonstrating applications of FlipIt to various examples including credential management, virtual machine refresh and cloud auditing for service-level-agreement. FlipIt has gained traction and popularity due to the assumption that the adversary can always get into the system; thus aligning with the new rhetoric in the security industry that compromise avoidance is no longer a realistic possibility and it is now about limiting the amount of compromise as quickly and efficiently as possible.…”