Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

eported alerts have to be managed by thesecurity administrator, which has to manuallylaunch countermeasures ensuring that thesecurity policy is no longer violated. However,triggering the most adequate countermeasureis far from being trivial, for at least tworeasons: (1) the security administrator requiresa strong expertise of the information systemconfiguration, and (2) he has to analyze ahuge number of alerts to select acountermeasure. This opens a time window ofopportunity for an attacker to successfullyexploit its advantage. Consequently, we arguethat one should focus on automated reactiontowards threat. Our work is based on the factthat a lot of work has been done both in thefields of intrusion detection and securitypolicies formalization. We assume thatintrusion detection diagnosis is reliable enoughto provide dynamic reconfiguration of thesecurity policy in order to respond to threat.This work is realized between InstitutTELECOM/TELECOM Bretagne and FranceTelecom R&D, through the PhD thesis ofYohann Thomas. It is also supported by ANRT(CIFRE convention).RealizationWe propose to make use of OrBAC(Organization-based Access Control) to definea security policy that dynamically adapts tocurrent threats. Threat is characterizedthrough intrusion detection diagnoses. Oursystem triggers threat contexts whichdynamically activate security policy rulesensuring response [2]. In addition, OrBACprovides means to define a generic policy atthe abstract level, which is locally enforced atthe concrete level. This methodology facilitatesthe deployment of the policy at a large scale,and ensures to take local countermeasures,which are well-suited to face the detectedthreat.Figure 1. Threat response system architectureFigure 1 shows the proposed architecture for athreat response system. An Alert CorrelationEngine (ACE) is due to collect events fromvarious sensors on the network and to providerelevant alerts as an input for the system. APolicy Instantiation Engine (PIE) is in charge oftriggering threat contexts considering alertsand activating new policy rules ensuringresponse to threat. Policy rules instantiated atthe PIE level are then processed by a PolicyDecision Point (PDP), which is able to decidehow to manage enforcement. Thus, asopposed to the PIE, the PDP is a localdecisional entity, aware of the PolicyEnforcement Points (PEPs) capabilities. ThePDP decides what configurations are to beactually pushed to the PEPs to effectively applythe new policy rules. Note that PEPs may be ofvarious kinds: a firewall, an authenticationserver, a mailserver, a router, a quarantinesystem, etc.ConclusionIn this work, we aim at connecting monitoringsystems (intrusion detection) with securitypolicies in order to provide response to threat.We show that the OrBAC formalism allows toaccomplish this task. A prototype of the threatresponse system is developed [3] todynamically activate security rules in responseto alerts thanks to a mapping strategy whichprovides means not only to react specifically toa considered intrusion, but also to protectother threatened entities of the informationsystem.References[1] H. Debar, B. Morin, F. Cuppens, F. Autrel,L. Mé, B. Vivinis, S. Benferhat, M. Ducassé etR. Ortalo. Corrélation d'alertes en détectiond'intrusions . TSI, éditions Hermes. June 2004.[2] H. Debar, Y. Thomas, N. Boulahia-Cuppens, F. Cuppens. Using contextualsecurity policies for threat response . ThirdInternational Conference on Detection ofIntrusions & Malware, and VulnerabilityAssessment (DIMVA). Berlin, Germany. Juillet2006.[3] H. Debar, Y. Thomas, N. Boulahia-Cuppens, F. Cuppens. Threat response throughthe use of a dynamic security policy. Journal ofComputer Virology, Srpinger, 2007.42 Extract of Pracom’s Annual Report 2008