A Framework for Adaptive Security Management Systems

Filip Schepers
M.Sc. in Information Security Project Report
Royal Holloway and Bedford New College, Univ. of London
Supervisor: Prof. Dr. C. Mitchell

October 1998

 

 

 

 

 

Royal Holloway and Bedford New College
University of London
M.Sc. in Information Security

 

 

 

A Framework for Adaptive Security Management Systems

Filip Schepers

 

 

Abstract

The security requirements of an organization have both technical and economical aspects. We argue that a comprehensive solution to simultaneously address the various problems can only be attained through standardization of security components. Together these components form a dynamic security management system; a model is described that can act as a framework for the standardization. Examples of how the modules can interact to provide a number of security services support this approach. No security solution can provide 100% safety; apart from its features, we therefore also discuss the potential vulnerabilities that the model may induce.

Supervisor: Prof. Dr. C. Mitchell

10 October 1998 - Rev. 3 (language & spelling)

 

To Bhavani

 

• Preface
  • Acknowledgements
• Contents
• 1. Introduction
  • 1.1 Security in computing
  • 1.2 The paradigm shift: from passive to proactive security management
  • 1.3 The need for a general framework
• 2. An adaptive security system framework
  • 2.1 Components of an adaptive security system
    • 2.1.1 The monitoring application
    • 2.1.2 The decision enforcement application
    • 2.1.3 The central security management service
      • 2.1.3.1 The knowledge base
    • 2.1.4 The security definition application and management console
    • 2.1.5 The logging and auditing application
    • 2.1.6 Security service provision applications
    • 2.1.7 Other adaptive security management services
  • 2.2 Communication between the adaptive security management components
    • 2.2.0.1 Back- and front-end processors
    • 2.2.0.2 The adaptive security application programming interface (AS-API)
    • 2.2.0.3 Communications security
• 3. Adaptive security system applications
  • 3.1 Interactions in adaptive security management systems
    • 3.1.1 Interactions within the security engines
    • 3.1.2 Security engine interactions
    • 3.1.3 Security management service interactions
    • 3.1.4 Provision of security management services
      • 3.1.4.1 Authentication
      • 3.1.4.2 Key management
      • 3.1.4.3 Access control
      • 3.1.4.4 Confidentiality and integrity
      • 3.1.4.5 Non-repudiation and trusted third party services
  • 3.2 Use of formal security models
    • Example
• 4. Adaptive security system vulnerabilities
  • 4.1 Management of the adaptive security management system
  • 4.2 Performance versus risk
  • 4.3 Software development and acquisition
  • 4.4 System configuration
  • 4.5 Physical access
• 5. Discussion of the framework
  • 5.1 Features of the framework
    • 5.1.1 Separation of policy from mechanism implementation
    • 5.1.2 Proactive, active and reactive security
    • 5.1.3 Adaptive and unobtrusive control
    • 5.1.4 Extensibility
    • 5.1.5 Integration
    • 5.1.6 Embedded security and survivability
  • 5.2 Ease of use, cost-efficiency and effectiveness
  • 5.3 A need for standards, evaluation criteria and independent accreditation
• 6. Summary
• 7. Introduction to security management
  • 7.1 Developing and managing a security strategy
  • 7.2 Cost aspects of security
  • 7.3 A gentle introduction to risk analysis
  • 7.4 The security policy
• 8. Concepts of network security
  • 8.1 General concepts in network security
    • 8.1.1 Threats in networks - network security services
    • 8.1.2 Network layers - placement of security services
  • 8.2 Network security controls
    • 8.2.1 Encryption
    • 8.2.2 Access control
    • 8.2.3 Authentication of distributed systems
    • 8.2.4 Traffic control
    • 8.2.5 Data integrity
  • 8.3 ISO transport and network layer security - physical layer security
    • 8.3.1 Transport layer security
    • 8.3.2 Network layer security
    • 8.3.3 Physical layer security
  • 8.4 Internet TCP/IP security
    • 8.4.1 TCP level security
    • 8.4.2 IP level security
• List of Figures
• List of Tables
• Bibliography
• About this document ...