Invalidating Policies using Structural Information

Abstract

Insider threats are a major threat to many organisations. Even worse, insider attacks are usually hard to detect, especially if an attack is based on actions that the attacker has the right to perform. In this paper we present a step towards detecting the risk for this kind of attacks by invalidating policies using structural information of the organisational model. Based on this structural information and a description of the organisation's policies, our approach invalidates the policies and identifies exemplary sequences of actions that lead to a violation of the policy in question. Based on these examples, the organisation can identify real attack vectors that might result in an insider attack. This information can be used to refine access control system or policies.

Transforming Graphical System Models to Graphical Attack Models

“…For every possible actor in the system, the goal of the transformation is then to generate an attack that results in the actor having obtained this asset. The overall transformation is a generalised version of policy invalidation [10,11]: . .…”

“…While we present them in the setting of the TRE S PASS model, the general approach can be applied to any graphical system model. The transformations described in this work can be used as the core technique for policy invalidation [10,11], where policies describe both access control to locations and data, as well as system-wide policies such as admissible actions and actor behaviour. We have implemented the transformations presented in this work in an attack tree generator for TRE S PASS models.…”

Isabelle Modelchecking for Insider Threats

“…The original approach of invalidation of a global policy based on local policies of infrastructure scenarios [18] uses the idea of Modelchecking: the attempt to prove a security property fails but provides a trace of steps in the infrastructure leading to a state in which the property is violated but more importantly providing a refined attack trace providing detailed steps leading to the attack.…”

“…The original invalidation idea [18] uses the advantages of Modelchecking to find attacks by Insiders on infrastructures. Starting from an invalidated policy, the attempt to modelcheck fails producing an attack vector.…”

Understanding How Components of Organisations Contribute to Attacks

“…Attacks are generated from a socio-technical system model [8,9] and are the basis of computing the risk faced by an organisation if one or more of the identified attacks are realised. Properties of interest of these attacks include required resources, such as time or money, likelihood of success, or impact of the attack.…”