Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

Security Analysis and ValidationAnalysis and deployment of security policiesResearch Staff : Frédéric Cuppens, Nora Cuppens-Boulahia, Laurent ToutainPh.D. Students: Stere PredaKeywords : Security component configuration, rule rewriting, policy aggregationApplications : Automatic deployment of security policiesPartners & Funding : partially funded by ANR in the framework of the RNRT Politess project and byConseil Régional de Bretagne through the Sec6 grant.IntroductionThe configuration of network securitycomponents, such as firewalls and networkintrusion detection systems (NIDSs), is usuallybased on the distribution of security rules thatstate what is permitted and what is prohibitedin a system during normal operations. Thisconfiguration must be consistent, addressingthe same decisions under equivalentconditions, and not repeating the same actionsmore than once. Otherwise, the existence ofanomalies in these rules may lead to weaksecurity policies (potentially easy to be evadedby unauthorized parties). Our research workproposes the combination of two mainstrategies in order to manage this problem.The first strategy is the use of an auditmechanism that analyzes already deployedconfigurations, signals inconsistencies, andyields consistent configurations. Moreover,through this mechanism we can fold existingpolicies and create a consistent and global setof rules — easy to maintain and manage byusing a single syntax. The second strategy isthe use of a refinement mechanism thatguarantees the proper deployment of suchrules into the system, yet free ofinconsistencies.This work was partially done in Politess(POLitiques de sécurité pour des systèmesd’information en réseau: modélisation,déploiement, TESt et surveillance), a RNRTproject, which aims at improving theconfidence in security policies by the use ofdeployment, monitoring techniques andconformance testing.RealizationTo achieve the automatic deployment ofsecurity rules, we first express formally thesecurity policy to be enforced using the OrBACmodel (Organization Base Access Control).Then we take advantage of the hierarchicalstructure of OrBAC entities (organizations,roles, activities, views contexts, permissionsand prohibitions) to automatically derive otherprivileges using the inheritance mechanisms.So the inheritance of positive or negativeauthorizations (permissions and prohibitions)has been analyzed and formally stated [1].Conflict Management has also been studied.The derivation of the security rules is a threephaseprocess (see figure below).Or-BAC NetworkSecurity policyXMLGenericXSLTXSLTrulesfirewallXMLCheckpoint . . . PIX rules NetFilter IpFilter . . .rulesrulesrulesThe process has been used to generatesecurity rules for an open source firewall(Netfilter), Netasq IPS (Intrusion ProtectionSystem) and also for the intrusion detectionsystem Snort [2].Our proposed strategies have beenimplemented as an extension of a softwareprototype called MIRAGE (which stands forMIconfiguRAtion manaGEr). Actually, MIRAGEimplements two different approaches. First,MIRAGE implements an audit process to detectand fix configuration errors over componentsalready deployed. Second, MIRAGE alsoimplements a refinement process to properlydeploy the global set of rules over the system'scomponents [3]. This refinement mechanismguarantees that the set of rules deployed over32 Extract of Pracom’s Annual Report 2008