Methods and Tools for Policy Analysis

Abstract

Policy-based management of computer systems, computer networks and devices is a critical technology especially for present and future systems characterized by large-scale systems with autonomous devices, such as robots and drones. Maintaining reliable policy systems requires ecient and eective analysis approaches to ensure that the policies verify critical properties, such as correctness and consistency. In this paper, we present an extensive overview of methods for policy analysis. Then, we survey policy analysis systems and frameworks that have been proposed and compare them under various dimensions. We conclude the paper by outlining novel research directions in the area of policy analysis.

A Formal Model and Technique to Redistribute the Packet Filtering Load in Multiple Firewall Networks

“…The scientific literature about the analysis of rules is quite large and a good survey can be found in [21]. Indeed, several techniques have been proposed to assist network security administrators in detecting policy conflicts and anomalies concerning either a single device or multiple connected firewalls.…”

“…Intra-firewall contributions appeared in the literature include, for instance, (optimal) rule ordering [14]- [18], firewall compression [19], [20] and rule analysis [21], [22]. Interfirewall alternatives are frequently based on special architectures such as parallel firewalls [23]- [25]; another approach leverages the transfer of filtering rules among firewalls located in the same network [26], [27].…”

Compu Castel: An Instructional Tool for Teaching Firewall Concepts

“…Firewall policy is high-level statement defines how an organization's firewalls should handle inbound and outbound network traffic. It must align with the organization's overall information security policies [11].…”

Generative Policies for Coalition Systems - A Symbolic Learning Framework

“…The lack of policies may require involving human administrator which may be expensive and not possible in some contexts. Previous research has focused on methods and tools for analyzing policies with respect to those four requirements (see [4] for a detailed survey of the state of the art). The use of our symbolic learning framework for generating policies helps in such an analysis.…”

“…Policy-based management thus significantly increases the self-managing aspects of coalition operations. Because of the usefulness of policy-based management, policy models, languages, formalisms, and systems have been widely investigated and applied to many different domains, including access control [3], firewall systems, and more recently software defined networks [4]. Policy standards have been developed, most notably in the areas of access control (e.g., the eXtensible Access Control Markup Language (XACML) and RBAC standards).…”