Expression and Deployment of Reaction Policies

Cuppens, Frédéric; Cuppens-Boulahia, Nora; Bouzida, Yacine; Kanoun, Waël; Croissant, Aurélien

doi:10.1109/sitis.2008.96

Cited by 6 publications

(4 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Then, the module generates the appropriate scripts to reconfigure these PEPs, in order to enforce the activation (or deactivation) of response rules in the monitored system [28]. j) Policy Enforcement Point: These modules are reconfigured, using the scripts generated by the previous module, in order to enforce OrBAC rules, and thus to activate or to deactivate response polices in the monitored system [12], [13].…”

Section: Policies Instantiation Engine (Pie)mentioning

confidence: 99%

See 1 more Smart Citation

Risk-Aware Framework for Activating and Deactivating Policy-Based Response

Kanoun

Cuppens-Boulahia

Cuppens

et al. 2010

2010 Fourth International Conference on Network and System Security

Self Cite

View full text Add to dashboard Cite

With the growth of modern systems and infrastructures, automated and intelligent response systems become the holy grail of the security community. An interesting approach proposes to use dynamic access control policies to specify response policies for such systems. These policies should be enforced when an ongoing attack, that threatens the monitored system, is detected. However, existing work do not present a clear methodology to specify the Response policies. In particular, the deactivation issue is not yet tackled. In this paper, we first present how to specify response policies. Second, a risk-aware framework is proposed to activate and deactivate response policies. Hence, the success likelihood of the threat, and the cumulative impact of both of the threat and the response, are all considered.

show abstract

Section: Policies Instantiation Engine (Pie)mentioning

confidence: 99%

“…tactical), the latter has a far larger scope and acts as 'strategic' response model. [12] and [13] show that the two approaches are complementary, and combine them in a single response workflow. Thus, response may be performed at two levels: intermediate level (i.e.…”

Section: Introductionmentioning

confidence: 99%

Risk-Aware Framework for Activating and Deactivating Policy-Based Response

Kanoun

Cuppens-Boulahia

Cuppens

et al. 2010

2010 Fourth International Conference on Network and System Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…To our best knowledge, OrBAC is the only access control model known in the literature, that offers this expressiveness. As an example, the OrBAC high level policy specification has been used as the final stage in a voice over IP (VoIP) framework in order to definitively react against intrusions [11]. However, OrBAC expresses only contexts over privileges.…”

Section: Introduction and Related Workmentioning

confidence: 99%

Concrete- and abstract-based access control

Bouzida

Logrippo

Mankovski

2011

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

Access control models allow expressing access control rules (also called policies) stating that certain subjects (or users) have or do not have the right (or privilege) to access certain objects in order to execute certain actions under certain conditions. Several existing models allow expressing rules only for specific subjects, objects and actions. Rolebased access control (RBAC) introduced the notion of role, which is an abstraction over subjects. Organization-based access control (OrBAC) generalized further, by allowing specifying rules involving abstract subjects, abstract actions and abstract objects. We propose here a model that allows expressing rules involving any combinations of abstract or concrete subjects, actions and objects, as well as conditions over them. For this reason, our model is called concrete-and abstract-based access control model (CABAC). The semantics of our model is expressed in terms of first order predicate logic. Temporal, spatial, knowledge and historical contexts can be specified and combined. We show how in this model it is possible to express hierarchies of subjects, objects and actions as well as propagation of policies over hierarchies. Further, while in most models subjects, objects and actions, whether concrete or abstract, must be specified statically, it is possible in our model to specify subjects, actions and objects dynamically, i.e., according to conditions that can vary over time. Access control rules can also be explicitly revoked and Y. Bouzida · L. Logrippo (B) Université du Québec en Outaouais,

show abstract

“…The taxonomy in [1] thus confirms the need for more complex and dynamic response mechanisms. Cuppens et al propose in [2] a reaction workflow which links the local response decisions to the higher level of security policy. They state that local response decisions should be assisted by global decisions managed at the policy level.…”

Section: Introductionmentioning

confidence: 99%

A Service Dependency Modeling Framework for Policy-Based Response Enforcement

Kheir

Debar

Cuppens³

et al. 2009

Detection of Intrusions and Malware, and Vulnerability Assessment

Self Cite

View full text Add to dashboard Cite

Abstract. The use of dynamic access control policies for threat response adapts local response decisions to high level system constraints. However, security policies are often carefully tightened during system design-time, and the large number of service dependencies in a system architecture makes their dynamic adaptation difficult. The enforcement of a single response rule requires performing multiple configuration changes on multiple services. This paper formally describes a Service Dependency Framework (SDF) in order to assist the response process in selecting the policy enforcement points (PEPs) capable of applying a dynamic response rule. It automatically derives elementary access rules from the generic access control, either allowed or denied by the dynamic response policy, so they can be locally managed by local PEPs. SDF introduces a requires/provides model of service dependencies. It models the service architecture in a modular way, and thus provides both extensibility and reusability of model components. SDF is defined using the Architecture Analysis and Design Language, which provides formal concepts for modeling system architectures. This paper presents a systematic treatment of the dependency model which aims to apply policy rules while minimizing configuration changes and reducing resource consumption.

show abstract

Expression and Deployment of Reaction Policies

Cited by 6 publications

References 22 publications

Risk-Aware Framework for Activating and Deactivating Policy-Based Response

Risk-Aware Framework for Activating and Deactivating Policy-Based Response

Concrete- and abstract-based access control

A Service Dependency Modeling Framework for Policy-Based Response Enforcement

Contact Info

Product

Resources

About