Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

inside the corresponding detection rulesignature managed by some IntrusionDetection System. We should note here thatthe reaction must be consistent with theminimal security policy. As a matter of fact, if aservice should be active for any circumstancethen a reaction, which consists in stopping thisservice, should not be launched.The intermediate level of reaction is based ona diagnosis of the intrusion process (forinstance provided by CRIM) and used toimprove the reaction process. Activating anautomatic or a manual response depends onthe confidence level of the diagnosis and theautomatic choice may be performed bymeasuring the impact of the correspondingreaction. At the intermediate level, anticorrelation[10] may be used as a way to findautomatically a set of reactions in order to stopa global attack scenario. Some correlation andfusion tools, implemented during the lastdecade, provide a set of counter measures thatmay be either activated automatically or let theadministrator choose the appropriate ones forsecurity agility considerations.Finally, the global level reaction aims todynamivally trigger new rules of the securitypolicy according to the current threat. For thisgoal, contexts are used for renewing thesecurity policy according to the detectedthreat. Three steps are performed at this level;activating contexts, triggering generic policyrules accordingly and producing a coherent setof rules to deploy while ensuring conflictresolution with the minimal securityrequirements. As a result of this level, a newpolicy security is redeployed as long as thethreat or its consequences remain present. Areturn to a non threat situation is thenperformed by the threat context deactivationoperation.ConclusionIn this work, we aim at connecting monitoringsystems (intrusion detection) with securitypolicies in order to provide response to threat.The OrBAC formalism is used to accomplishthis task. A prototype of the threat responsesystem is developed [2] to dynamicallyactivate security rules in response to alertsthanks to a mapping strategy which providesmeans not only to react specifically to aconsidered intrusion, but also to goballyprotect other threatened entities of theinformation system.References[1] H. Debar, Y. Thomas, N. Boulahia-Cuppens, F. Cuppens. Using contextualsecurity policies for threat response . ThirdInternational Conference on Detection ofIntrusions & Malware, and VulnerabilityAssessment (DIMVA). Berlin, Germany. Juillet2006.[2] H. Debar, Y. Thomas, N. Boulahia-Cuppens, F. Cuppens. Threat response throughthe use of a dynamic security policy. Journal ofComputer Virology, Springer, 2007.44 Extract of Pracom’s Annual Report 2008