A survey of information security incident handling in the cloud

Data and information fusion (DIF) involves a process of combining data from multiple inputs (from one or more sources such as sensors and textual reports).1 The aim is to obtain information that is better (more useful and meaningful) than that would be derived from each of the sources individually (that is, without fusing). DIF is emerging as an important field of multidisciplinary study [113, 316]. This is due to increase in data and information flow, as well as improvement in communication, computing and sensor technology. The first applications of DIF techniques were in the military arena [177, 179, 455]. The use of DIF techniques for problem-solving has extended to many non-military applications in the commercial and industrial sectors [177, 179, 199, 228]. In general, data and information fusion can provide enhancement to the outcomes of processes for solving various application problems. Some advantages of carrying out DIF include [316]: 2 improvement in the accuracy of data, as well as reduction in uncertainty and ambiguity within data, and 2 improvement in situation awareness (SAW) and inference that lead to better decision making.

High-level Information Fusion: An Overview.

The paper presents an approach and formal framework for modeling attacks against computer network and its software implementation on the basis of a multi-agent architecture. The model of an attack is considered as a complex process of contest of adversary entities those are malefactor or team of malefactors, on the one hand, and network security system implementing a security policy, on the other hand. The paper focuses on the conceptual justification of the chosen approach, specification of the basic components composing attack model, formal frameworks for specification of the above components and their interaction in simulation procedure. The peculiarities of the developed approach are the followings: (1) malefactor's intention-centric attack modeling; (2) multi-level attack specification; (3) ontology-based distributed attack model structuring; (4) attributed stochastic LL(2) context-free grammar for formal specification of attack scenarios and its components ("simple attacks"); (5) using operation of formal grammar substitution for specification of multi-level structure of attacks; (6) state machine-based formal grammar framework implementation; (7) on-line generation of the malefactor's activity resulting from the reaction of the attacked network security system.

/pdf/attacks-against-computer-network-formal-grammar-based-2h2i2uc4t4.pdf

Attacks against computer network: formal grammar-based framework and simulation tool

During the last few years the computer network security remains a problem of great concern within information technology research area. Increase of network scale, development of advanced information technologies, and other factors enhance the number of possible targets for attacks against computer networks. These factors negatively influence upon the efficiency of the existing computer networks security systems and enable research and development of new protection models and technologies. Along with the conventionally used security tools like firewalls, intrusion detection systems (IDSs) are becoming of supreme significance. It is well known that modern realtime IDSs are not able to detect sophisticated attacks performed by professionals. Newly invented attacks are realized as coordinated distributed operations of groups of professionals; they are carried out from different locations, through different entry points, and at different time moments. On the other hand, IDS often interprets normal operation of a computer network as hostile actions thus producing many false alarms. A considerable improvement of IDS efficiency could be achieved in case of using knowledge obtained from generalization and formalization of accumulated experience regarding computer system vulnerabilities and attack cases. This is a cogent argument for the necessity of deep study and research of essence and peculiarities of coordinated distributed attacks. The study cannot be only restricted by generalization of the experience; it has also to be based on using

/pdf/multi-agent-technologies-for-computer-network-security-4sz9yvbrms.pdf

Multi-agent technologies for computer network security: Attack simulation, intrusion detection and intrusion detection learning

The paper describes the formal approach and software tool "Attack Simulator" intended for active vulnerability assessment of computer network security policy at the stages of design and deployment of network security systems. The suggested approach is based on stochastic grammar-based models of attacks and is realized via automatic imitation of remote computer network attacks of different complexity. The paper characterizes the Attack Simulator architecture and the processes of generating malicious actions against computer network model and real-life computer networks. The results of experiments that demonstrate the Attack Simulator efficiency are described in detail.

Active vulnerability assessment of computer networks by simulation of complex remote attacks

A network device is considered compromised when one of its security mechanisms is defeated by an attacker. For many networks, an attacker can compromise many devices before being discovered. However, investigating devices for compromise is costly and time-consuming, making it difficult to investigate all, or even most, of a network's devices. Further, investigation can yield false-negative results. This paper describes an intrusion–detection (ID) technique for incident-response. During an attack, the attacker reveals information about himself and about network vulnerabilities. This information can be used to identify the network's likely compromised devices (LCDs). Knowledge of LCDs is useful when limited resources allow only some of the network's devices to be investigated. During an on-going attack, knowledge of LCDs is also useful for tactical planning. The ID technique is based on the US military's battlefield-intelligence process. Models are constructed of the network, as the battlespace. Also, models are constructed of the attacker’s capabilities, intentions, and courses-of-action. The Economics of Crime, a theory which explains criminal behavior, is used to model the attacker's courses-of-action. The models of the network and the attacker are used to identify the devices most likely to be compromised.

/pdf/intrusion-detection-for-incident-response-using-a-military-418gejtc63.pdf

Intrusion-detection for incident-response, using a military battlefield-intelligence process

We explore shadow information technology (IT) at institutions of higher education through a two-tiered approach involving a detailed case study and comprehensive survey of IT professionals. In its many forms, shadow IT is the software or hardware present in a computer system or network that lies outside the typical review process of the responsible IT unit. We carry out a case study of an internally built legacy grants management system at the University of Maryland, Baltimore County that exemplifies the vulnerabilities, including cross-site scripting and SQL injection, typical of such unauthorized and ad-hoc software. We also conduct a survey of IT professionals at universities, colleges, and community colleges that reveals new and actionable information regarding the prevalence, usage patterns, types, benefits, and risks of shadow IT at their respective institutions. Further, we propose a security-based profile of shadow IT, involving a subset of elements from existing shadow IT taxonomies, that categorizes shadow IT from a security perspective. Based on this profile, survey respondents identified the predominant form of shadow IT at their institutions, revealing close similarities to findings from our case study. Through this work, we are the first to identify possible susceptibility factors associated with the occurrence of shadow IT related security incidents within academic institutions. Correlations of significance include the presence of certain graduate schools, the level of decentralization of the IT department, the types of shadow IT present, the percentage of security violations related to shadow IT, and the institution’s overall attitude toward shadow IT. The combined elements of our case study, profile, and survey provide the first comprehensive view of shadow IT security at academic institutions, highlighting tension between its risks and benefits, and suggesting strategies for managing it successfully.

/pdf/shadow-it-in-higher-education-survey-and-case-study-for-rjfxyblh.pdf

R. Forno

Papers

Intrusion-detection for incident-response, using a military battlefield-intelligence process

Shadow IT in higher education: survey and case study for cybersecurity