Risk-aware framework for activating and deactivating policy-based response

Wael Kanoun (1, 2) , Nora Cuppens-Bouhlahia (1, 3) , Frédéric Cuppens (4, 1) , Samuel Dubus (2)

1 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
2 Bell Labs (Alcatel Lucent)
3 Lab-STICC - Laboratoire des sciences et techniques de l'information, de la communication et de la connaissance (UMR 3192)
4 Lab-STICC_TB_CID_SFIIS

With the growth of modern systems and infrastructures, automated and intelligent response systems become the holy grail of the security community. An interesting approach proposes to use dynamic access control policies to specify response policies for such systems. These policies should be enforced when an ongoing attack, that threatens the monitored system, is detected. However, existing work do not present a clear methodology to specify the Response policies. In particular, the deactivation issue is not yet tackled. In this paper, we first present how to specify response policies. Second, a risk-aware framework is proposed to activate and deactivate response policies. Hence, the success likelihood of the threat, and the cumulative impact of both of the threat and the response, are all considered.

Mots clés: Response context; Activation/deactivation; Cumulative impact; Success likelihood; Response policy; Threat context

Domaines: Architectures Matérielles [cs.AR]; Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Wael Kanoun, Nora Cuppens-Bouhlahia, Frédéric Cuppens, Samuel Dubus. Risk-aware framework for activating and deactivating policy-based response. NSS : IEEE International Conference on Network and System Security, Sep 2010, Melbourne, Australia. ⟨hal-00540839⟩