Collaborative Research: CICI: Secure and Resilient Architecture: NetSecOps -- Policy-Driven, Knowledge-Centric, Holistic Network Security Operations Architecture

大学校园的网络基础设施复杂而复杂，通常支持企业、学术、学生、研究和医疗保健数据的混合，每个数据都有自己独特的安全、隐私和优先策略。保护这一复杂且高度动态的环境极具挑战性，尤其是在校园基础设施越来越多地受到来自互联网和(通常在不知不觉中)内部校园设备的恶意攻击者攻击的情况下。校园的不同部分有非常不同的政策和法规来管理其对敏感数据的处理(例如，私人学生/员工信息、医疗保健数据、金融交易等)。此外，数据密集型科研流量通常需要正常安全策略的例外，导致临时解决方案绕过标准操作程序，使科研工作流程和整个校园都容易受到攻击。简而言之，最先进的校园安全运营仍然严重依赖人类领域专家来解释高级策略文档、通过低级别机制实施这些策略、创建例外以适应科学工作流程、解释报告和警报，并能够全天候、近乎实时地对安全事件做出反应。该项目通过名为NetSecOps(网络安全运营)的协作研究工作来应对这些挑战，该项目通过自动化当前园区网络中的许多繁琐、容易出错和其他方面有问题的操作任务来帮助信息技术(IT)安全团队。NetSecOps是策略驱动的，因为该框架将高级别的人类可读策略编码为系统的策略规范，以驱动基础设施的实际配置和操作。NetSecOps是以知识为中心的，因为该框架将有关基础设施的数据、信息和知识捕获到中央知识存储中，以通知和指导IT运营任务。建议的NetSecOps体系结构具有以下独特的功能：(1)系统地捕获园区网络安全策略的能力；(2)创建新的细粒度网络控制抽象的能力，该抽象利用现有的安全能力和新兴的软件定义网络(SDN)来实施安全策略，包括与科学工作流和IT域相关的策略；(3)能够实现策略可追溯性工具，以验证这些网络抽象是否保持高级策略的完整性；(4)能够实现知识发现工具，该知识发现工具能够跨现有安全点解决方案的数据进行推理，包括安全监控工具以及认证和授权框架；以及(5)能够根据检测到的安全事件自动调整网络的安全状态。该项目的研究成果和工具将公之于众，使学术机构能够利用这些资源，作为其最佳做法信息技术安全业务的一部分。

Network infrastructure at University campuses is complex and sophisticated, often supporting a mix of enterprise, academic, student, research, and healthcare data, each having its own distinct security, privacy, and priority policies. Securing this complex and highly dynamic environment is extremely challenging, particularly since campus infrastructures are increasingly under attack from malicious actors on the Internet and (often unknowingly) internal campus devices. Different parts of the campus have very different policies and regulations that govern its treatment of sensitive data (e.g., private student/employee information, health care data, financial transactions, etc.). Furthermore, data-intensive scientific research traffic often requires exceptions to normal security policies, resulting in ad-hoc solutions that bypass standard operational procedures and leave both the scientific workflow and the campus as a whole vulnerable to attack. In short, state-of-the-art campus security operations still heavily rely on human domain experts to interpret high level policy documents, implement those policies through low-level mechanisms, create exceptions to accommodate scientific workflows, interpret reports and alerts, and be able to react to security events in near real time on a 24-by-7 basis.This project addresses these challenges through a collaborative research effort, called NetSecOps (Network Security Operations), that assists information technology (IT) security teams by automating many of the operational tasks that are tedious, error-prone, and otherwise problematic in current campus networks. NetSecOps is policy-driven in that the framework encodes high-level human-readable policies into systematic policy specifications that drive the actual configuration and operation of the infrastructure. NetSecOps is knowledge-centric in that the framework captures data, information, and knowledge about the infrastructure in a central knowledge store that informs and guides IT operational tasks. The proposed NetSecOps architecture has the following unique capabilities: (1) the ability to capture campus network security policies systematically; (2) the ability to create new fine-grained network control abstractions that leverage existing security capabilities and emerging software defined networks (SDN) to implement security policies, including policies related to both scientific workflows and IT domains; (3) the ability to implement policy traceability tools that verify whether these network abstractions maintain the integrity of the high-level policies; (4) the ability to implement knowledge-discovery tools that enable reasoning across data from existing security point-solutions, including security monitoring tools and authentication and authorization frameworks; and (5) the ability to automatically adjust the network's security posture based on detected security events. Research results and tools from the project will be released into the public domain allowing academic institutions to utilize the resources as part of their best-practice IT security operations.