Threat Inferencing for Autonomic Security Management of IoT Systems

BlackBerry提供名为统一终端管理器(UEM)的企业移动系统管理(EMM)软件，该软件提供固定和移动计算系统(包括具有物联网设备的系统)的设计、开发、部署和管理功能。黑莓希望通过为安全策略提供新的管理自动化来帮助驯服现代企业系统策略管理的复杂性。随着物联网和移动混合部署日益复杂，指定有效的情景敏感安全策略来缓解潜在威胁是一件令人望而生畏的事情，而且验证和调试它们也很困难。当物联网平台提供的策略规范语言表现力不足时，这些问题尤其令人困扰。新的自动安全策略管理技术将使BlackBerry能够为客户提供更具吸引力的解决方案，因为它们减少了常见的重要痛点，同时还提供了潜在的改进的安全性。*为了开发针对这些问题的有用子集的自动化，我们将利用并采用IBM推出的自主计算范式来设计和实现一个监视-分析-计划-执行循环加知识库(即，MAPE-k系统)，以基于更抽象的安全策略自动管理具体的安全策略。这种方法的基本价值是利用MAPE-k方法的能力在发生变化时对安全策略操作进行推理。为此，我们将向系统灌输对威胁和应对措施进行推理所需的知识和逻辑，其中应对措施包括安装监控器和实施政策控制。随着功能和操作环境的变化，系统可以自主调整以响应。我们将使用代表当前黑莓客户问题的原型系统探索解决方案空间。*

BlackBerry supplies enterprise mobile systems management (EMM) software called Unified Endpoint Manager (UEM), which offers functionality for the design, development, deployment, and management of fixed and mobile computing systems, including those with IoT devices. BlackBerry wishes to help tame the complexity of policy administration for modern enterprise system by offering new management automation for security policies. With increasingly complex mixed IoT and mobile deployments, it is daunting to specify effective context-sensitive security policies to mitigate against potential threats, and it is also difficult to validate and debug them. The problems are particularly vexatious when the policy specification languages offered by the IoT platforms are insufficiently expressive. New automatic security policy management techniques would allow BlackBerry to offer solutions more attractive to customers because they reduce common significant pain points, while also offering potentially improved security.****To develop automations for a useful subset of those problems we will leverage and adopt the autonomic computing paradigm, introduced by IBM, to design and implement a Monitor-Analyze-Plan-Execute loop plus knowledge base (i.e., MAPE-k system) to automatically manage concrete security policies based on a more abstract security policy. The essential value of this approach is leveraging the ability of the MAPE-k methods to reason about security policy actions in the presence of change. To do this, we will imbue the system with the knowledge and logic required to reason about threats and responses to them, where responses include installation of monitors and implementation of policy controls. As capabilities and operating environments change, the system can autonomically adapt in response. We will explore the solution space using a prototype system representing a current BlackBerry customer problem.********