A Vulnerability-Centric Approach to Network Security Metrics

点击翻译按钮获取中文摘要

As today's critical infrastructures and enterprises increasingly rely on networked computer systems, the security of such systems becomes crucial to the economy and society. However, before we can improve the security of a network, it is desirable to be able to measure it, since "you cannot improve what you cannot measure". A network security metric is desirable since it will allow for a direct measurement of how secure a network currently is, and how secure it would be after introducing new security mechanisms or configuration changes. Such a capability will make the effort of network hardening a science rather than an art. Emerging efforts on network security metrics, including the Common Vulnerability Scoring System (CVSS-SIG) standard, typically assign numeric scores to vulnerabilities as their relative exploitability or likelihood. The assignment is usually based on known facts about each vulnerability (e.g., whether it requires an authenticated user account). Such approaches share several limitations. First, by considering vulnerabilities on an individual basis, a network security administrator could be misled in a situation where individual vulnerabilities scores are low but these vulnerabilities can be combined to compromise a critical resource. Second, the methodology is no longer applicable when considering zero day vulnerabilities about which we have no prior knowledge or experience, which in fact leads to a major criticism of existing efforts on security metrics, that is, unknown zero day vulnerabilities are not measurable. Third, the numerical scores assigned to vulnerabilities usually lack a well defined semantic, and are not generally related to other measures that can be easily interpreted by human analysts, such as time or dollars. The proposed research will address these pressing issues by proposing a novel vulnerability-centric approach to quantitatively modeling vulnerability information through security metrics.