Diversity and Defence in Depth for Security - A Probabilistic Approach (D3S)

安全的一个重要部分是深度防御：多层防御用于降低对系统或组织的成功攻击的概率。至关重要的是，对于纵深防御，这些防御必须在检测和/或防止入侵企图的能力上多样化。在这方面，如同在一般安全方面一样，需要通过数量办法来支持决定，设法回答以下问题：“是否应将现有预算用于某个特定的防御X，还是用于两个较弱的防御Y和Z，但如果这两个防御结合起来，安全性会比单独用于X更好？“，“在这种威胁环境中，一次成功入侵在一年内达到D级损害的可能性有多大？这个项目的目的是产生方法来回答这些问题，不可避免地在概率方面，有多少信任可以放在这些方法的清晰的理解。 我们将考虑这些防御层：防病毒（AV）产品，入侵检测系统（IDS），防火墙，以及由被攻击的应用程序和平台（例如不同的操作系统和应用程序）的固有鲁棒性创建的隐式防御层。从这项研究中产生的概率模型将分为两大类：- 概念模型-模型，用于概念化问题域，并能够理解不同因素的相对重要性和各种保护层的多样性好处的理论限制，但这些模型是在相当高的抽象级别上定义的，因此难以观察和量化这些参数实践中的模式;- 操作模型-其参数可以观察到的模型，并且该模型可以在操作中用于安全评估和预测。成功的操作模型实现预测，给定一系列先前的观察结果，在有限的变化存在。成功的概念模型更温和地澄清非直观的普遍真理，并有助于分析场景（例如，显示最好和最坏情况下的影响，而不是可能的影响），其中数据不足以预测开放的问题，我们解决有关评估的潜在收益，从防御深度包括：-设计多层防御。设计至少有三个维度：-多样性架构的选择：有多少设备，有多少类型的设备等。- 它们是如何组合的（例如，对于标记可能的攻击的产品，安全响应是否需要多个层之间的共识，或仅一个层发出警报，或需要一定的多数）。- 要保护的资产的性质。- 安全要求通常用（至少）三个组成属性来表示：机密性、完整性和可用性（CIA）。一个重要的问题是，改善其中一个属性的设计可能会使其他属性变得更糟，而概率模型有助于管理这些权衡。衡量一个防御系统过去的安全程度与预测它未来的安全程度是有区别的，因为攻击者开发了新技术，安全供应商也在努力适应。我们需要的方法，使我们能够预测一个（或几个）防御层的安全性的基础上，我们已经看到在过去。预测可能是在概率方面：下一次攻击的时间;在给定的时间间隔内，我们可以预期的攻击率;存在于一组防御中的漏洞等;由于这些永远不会是绝对可靠的，我们需要评估它们表现如何的方法，以便它们的用户知道对这些预测有多大的信心。

An important part of security is defence in depth: multiple layers of defence used to reduce the probability of a successful attack on a system or organisation. Crucially, for defence in depth these defences must be diverse in their ability to detect and/or prevent intrusion attempts. Here, as in security in general, there is a need to support decisions through quantitative approaches, seeking to answer questions like: "should a given available budget be spent on a specific defence X or two weaker defences Y and Z which, however, if combined promise better security than X alone?", "in this threat environment, what is the likelihood of a successful intrusion achieving damage worth D over one year?" etc. This project aims to produce methods for answering such questions, inevitably in probabilistic terms, with clear understanding of how much trust can be put in these methods. We will consider these layers of defence: AntiVirus (AV) products, Intrusion Detection Systems (IDS), Firewalls, as well as the implicit layers for defence created by the inherent robustness to attack of the applications and platforms being attacked (e.g. diverse operating systems and applications). The probabilistic models that will result from this research will be of two broad types: - Conceptual models - models that are used to conceptualise the problem domain and enable understanding of relative importance of different factors and theoretical limits of the benefits of diversity with the various protection layers but that are defined at a reasonably high level of abstraction making it difficult to observe and quantify the parameters of these models in practice; - Operational models - models the parameters of which can be observed and the model can be used in operation for security assessment and prediction. Successful operation models achieve prediction, given a sequence of previous observations, in the presence of limited change. Successful conceptual models more modestly clarify non-intuitive universal truths and help to analyse scenarios (e.g. showing best- and worst-case effects rather than likely effects) for which data are insufficient for prediction The open problems that we address regarding the assessment of the potential gains from defence in depth include: - Designing multi-layered defences. There are at least three dimensions to the design: - The choice of diversity architecture: how many devices, how many types of devices etc.) - How they are combined (e.g., for products that flag possible attacks, whether a security response requires consensus among multiple layers, or just one to give an alarm,or a certain majority is required). - The nature of the assets to be protected. - Security requirements are usually expressed in terms of (at least) three constituent attributes: Confidentiality, Integrity and Availability (CIA). An important issue is that designs that improve one of these attributes may make others worse, and probabilistic models help to manage these trade-offs.- There is a difference between measuring how secure a defence system has been in the past and predicting how secure it will be, as attackers develop new techniques and security vendors try to adapt. We need methods that allow us to predict the security of one (or several) layers of defences based on what we have seen in the past. Predictions may be in terms of the probabilities of: the time to next attack; the rate of attacks that we can expect in a given time interval; vulnerabilities existing in a set of defences etc; and since these will never be infallible we need methods for assessing how well they perform so that their users know how much confidence to have in these predictions.