Monitoring and Intrusion Detection

Abstract

Ideally, an application of the techniques of control and monitoring is perfectly established: a security policy specifies exactly the wanted permissions and prohibitions; administrators correctly and completely declare the policy, which subsequently is fully represented within the computing system; and the control and monitoring component can never be bypassed, and it enforces the policy without any exception. As a result, all participants are expected to be confined to employing the computing system precisely as intended. Unfortunately, reality often differs from the ideal; for instance, the following shortcomings might arise:

• • The security policy is left imprecise or incomplete.

• • The declaration language is not expressive enough.

• • The internal representation contains flaws.

• • The enforcement does not cover all access requests.

• • Administrators or users disable some control facilities for efficiency reasons.

• • Intruders find a way to circumvent the control and monitoring component.