Automated Security Configuration Management
- First Online:
- Cite this article as:
- Al-Shaer, E., Kalmanek, C.R. & Wu, F. J Netw Syst Manage (2008) 16: 231. doi:10.1007/s10922-008-9105-1
- 131 Views
With the explosive growth of Internet connectivity that includes not only end-hosts but also pervasive devices, secure and reliable Internet becomes a requirement for enterprises as well as home users. Although a significant effort has been made by the research community to develop defense techniques against security attacks, efficient management of security configuration has been overlooked. Network security devices, such as Firewalls, IPSec gateways, Intrusion Detection and Prevention Systems, as well as end-host access control servers, operate based on locally configured policies. Yet these policies are not necessarily independent as they interact with each other to form global end-to-end security.
Managing these security policies are complex and error prone. Intra- and inter-policy conflicts or inconsistency is one of the main challenges for deploying effective security. In addition, the complexity of changing, testing, and validating security configuration in real-time environment become a major hindrance for evaluating security. Last but not least, security configurations such as policy rules are mostly defined in low level abstraction and represented in isolation of each other, which makes discovering misconfiguration in large-scale network intractable. As a result, the complexity of integrated security management not only makes modifying and enhancing policies a nightmare for administrators, but it also increases the risk of network vulnerabilities and security breaches.
This special issue includes four rigorously reviewed papers selected from 29 papers. These papers present original contributions in the area of management and analysis of security configurations for networks. This special issue covers a wide range of issues including security configuration analysis and refinement, secure, flexible and efficient administration of configuration in multi-domain and mobility environments.
Narain, Levin, Malik, and Kaul present a system called ConfigAssure that translates the configuration requirements into low-level configuration variables deployable in network devices. ConfigAssure provides automatic network configuration management based on declarative logic specification. It can also be used to diagnose and apply cost-effective repair misconfiguration based on user-predefined costs. ConfigAssure uses a Requirement Solver that takes as input a configuration database containing variables, and requirements as constraints on configurations in first-order logic, and then computes as output, values for variables that make the requirement true or provides a proof of insolvability.
Noel and Jajodia describe an algorithm for intrusion detection sensor placement and show how the attack graph can be used to prioritize the handling of alerts from the IDS systems. They automatically construct a set of all network paths that constitutes attacks to critical assets. Then they select the minimum number of IDS sensors that can cover the attack graph. This optimal configuration will help maximizing quality of protection, while maintaining low cost.
Damiani, Bertino, and Silvestri address the problem of configuring access control to sensitive resources based on the position of mobile users. They propose an automated location-based or spatially aware role-based access control management for Role-Based Access Control (RBAC). They introduce an administration model for the location-based GEO-RBAC model that includes a language for the specification of GEO-RBAC policies. The present model support complex structure of RBAC that involves objects sharing and mobility across different domains.
Seitz, Selander, Rissanen, Ling and Sadighi address the issue of secure access control to configuration data. This is important for network operators to manage and regulate access to configuration records appropriately. They propose an access control model for the IETF NETCONF network configuration protocol, based on the OASIS XACML access control standard. This allows for flexible and fine-grained control with minimal extension or modification to the NETCONF protocol and the configuration data-model.
These papers address many of the critical issues and technical challenges including configuration refining from high-level requirement, optimal IDS configuration to balance security and cost, and managing access control configuration in mobile environment, and secure and regulated access to configuration data. Although security configuration faces many more challenges, we believe that these four papers in this special issue reflect the state-of-the-art in this area and significantly advance the understanding of the research community.
We would like to thank all the authors and reviewers who made this special issue possible. Finally, we would like to express our gratitude to Dr. Manu Malek, the Editor-in-Chief of Journal of Network and System Management, for his acceptance and support of this special issue.