Enabling automated threat response through the use of a dynamic security policy

Abstract

Information systems security issues are currently being addressed using different techniques, such as authentication, encryption and access control, through the definition of security policies, but also using monitoring techniques, in particular intrusion detection systems. We can observe that security monitoring is currently totally decorrelated from security policies, that is security requirements are not linked with the means used to control their fulfillment. Most of the time, security operators have to analyze monitoring results and manually react to provide countermeasures to threats compromising the security policy. The response process is far from trivial, since it both relies on the relevance of the threat analysis and on the adequacy of the selected countermeasures. In this paper, we present an approach aiming at connecting monitoring techniques with security policy management in order to provide response to threat. We propose an architecture allowing to dynamically and automatically deploy a generic security policy into concrete policy instances taking into account the threat level characterized thanks to intrusion detection systems. Such an approach provides means to bridge the gap between existing detection approaches and new requirements, which clearly deal with the development of intrusion prevention systems, enabling a better protection of the resources and services.

An adaptive and smart security architecture for Web Service SmartWSSec Architecture

“…Tarek Bouyahia etl [21], proposed also a context aware intrusion response based on argumentation logic. Herve Debar elt [22], proposed an advanced security policy formalism, to define a contextual security policy that will be applied to the information system.…”

Robust Consistency Checking for Modern Filesystems

“…Declarative languages are also widely used for specifying and maintaining security policies [3,8,7]. Debar et al [7] describes an architecture for specifying generic security policies in Datalog.…”

“…Debar et al [7] describes an architecture for specifying generic security policies in Datalog. Whenever new threats are detected, the policies may react to the threat and enable security rules such as prohibiting TCP/IP traffic for its web servers when syn-flooding attack occurs.…”

Dynamic deployment of context-aware access control policies for constrained security devices

“…Proposals like [18] and [19] deal with the deployment of reactive policies to neutralize security threats. In [19], the threats are modeled as contexts.…”

“…Then, standard IDMEF alerts are mapped to the contexts. In [18], not only contexts but new policy instances are derived as a result of an alert. The authors discuss about context lifetime, according to the impact severity and type of an alert.…”