The Right Tool for the Job: A Case for Common Input Scenarios for Security Assessment

  • Xinshu Dong
  • Sumeet Jauhar
  • William G. Temple
  • Binbin Chen
  • Zbigniew Kalbarczyk
  • William H. Sanders
  • Nils Ole Tippenhauer
  • David M. Nicol
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9987)

Abstract

Motivated by the practical importance of security assessment, researchers have developed numerous model-based methodologies. However, the diversity of different methodologies and tool designs makes it challenging to compare their respective strengths or integrate their results. To make it more conducive to incorporate them for practical assessment tasks, we believe it is critical to establish a common foundation of security assessment inputs to support different methodologies and tools. As the initial effort, this paper presents an open repository of Common Input Scenarios for Security Assessment (CISSA) for different model-based security assessment tools. By proposing a CISSA design framework and constructing six initial scenarios based on real-world incidents, we experimentally show how CISSA can provide new insights and concrete reference points to both security practitioners and tool developers. We have hosted CISSA on a publicly available website, and envision that community effort in building CISSA would significantly advance the scientific and practical values of model-based security assessment.

Notes

Acknowledgements

This study is supported by the research grant for the Human-Centered Cyber-physical Systems Programme at the Advanced Digital Sciences Center from Singapore’s Agency for Science, Technology and Research (A*STAR).

References

  1. 1.
    Public Repository for CISSA. http://www.illinois.adsc.com.sg/cissa
  2. 2.
    Abrams, M., Weiss, J.: Malicious control system cyber security attack case study - Maroochy water services, Australia (2008)Google Scholar
  3. 3.
    Aorato Labs: The untold story of the target attack step by step, August 2014. http://www.aorato.com/blog/untold-story-target-attack-step-step/
  4. 4.
    Byres, E., Ginter, A., Langill, J.: How stuxnet spreads - a study of infection paths in best practice systems. www.tofinosecurity.com/how-stuxnet-spreads
  5. 5.
    Chen, B., Kalbarczyk, Z., Nicol, D.M., Sanders, W.H., Tan, R., Temple, W.G., Tippenhauer, N.O., An Hoa, V., Yau, David, K.Y.: Go with the flow: toward workflow-oriented security assessment. In: NSPW (2013)Google Scholar
  6. 6.
    Command Five Pty Ltd.: SK Hack by an Advanced Persistent Threat, September 2011. http://www.commandfive.com/papers/C5_APT_SKHack.pdf
  7. 7.
    Falliere, N., Murchu, L.O., Chien, E.: Symantec security response: W32.stuxnet dossier. www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf
  8. 8.
    iSightPartners: Kaptoxa point of sale compromise, January 2014. http://www.securitycurrent.com/resources/files/KAPTOXA-Point-of-Sale-Compromise.pdf
  9. 9.
    Kaspersky Lab Global Research and Analysis Team: Energetic bear - crouching yeti, July 2014. http://securelist.com/files/2014/07/EB-YetiJuly2014-Public.pdf
  10. 10.
    Kordy, B., Mauw, S., Radomirović, S., Schweitzer, P.: Foundations of attack-defense trees. In: FAST, pp. 80–95 (2011)Google Scholar
  11. 11.
    Kordy, B., Pietre-Cambacedes, L., Schweitzer, P.: DAG-based attack, defense modeling: don’t miss the forest for the attack trees (2013). CoRR arXiv:1303.7397
  12. 12.
    Kriaa, S., Bouissou, M., Pietre-Cambacedes, L.: Modeling the stuxnet attack with BDMP: towards more formal risk assessments. In: Proceedings of International Conference on Risk and Security of Internet and Systems (CRiSIS), pp. 1–8, October 2012Google Scholar
  13. 13.
    Langill, J.: Defending against the dragonfly cyber security attacks (2014). http://www.belden.com/docs/upload/Belden-White-Paper-Dragonfly-Cyber-Security-Attacks.pdf
  14. 14.
    LeMay, E., Ford, M., Keefe, K., Sanders, W.H., Muehrke, C.: Model-based security metrics using ADversary VIew Security Evaluation (ADVISE). In: QEST (2011)Google Scholar
  15. 15.
    Lippmann, R.P., Ingols, K.W.: An annotated review of past papers on attack graphs (2005)Google Scholar
  16. 16.
    Mandiant, a FireEye Company: Beyond the breach (2014). https://dl.mandiant.com/EE/library/WP_M-Trends2014_140409.pdf
  17. 17.
    North American Electric Reliability Corporation: Critical infrastructure protection standards. http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
  18. 18.
    Ou, X., Boyer, W.F.: A scalable approach to attack graph generation. In: CCS (2006)Google Scholar
  19. 19.
    Xinming, O., Govindavajhala, S., Appel, A.W.: Mulval: a logic-based network security analyzer. In: USENIX Security (2005)Google Scholar
  20. 20.
    PCI Security Standards Council: PCI SCC data security standards overview. https://www.pcisecuritystandards.org/security_standards/
  21. 21.
    Phillips, C., Swiler, L.: A graph-based system for network-vulnerability analysis. In: NSPW (1998)Google Scholar
  22. 22.
    Piètre-Cambacédès, L., Bouissou, M.: Attack and defense modeling with BDMP. In: Kotenko, I., Skormin, V. (eds.) MMM-ACNS 2010. LNCS, vol. 6258, pp. 86–101. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  23. 23.
    Pietre-Cambacedes, L., Bouissou, M.: Beyond attack trees: dynamic security modeling with Boolean logic driven Markov processes (BDMP). In: EDCC (2010)Google Scholar
  24. 24.
    Sanders, W.: Quantitative security metrics: unattainable holy grail or a vital breakthrough within our reach? IEEE-SPM 12, 67–69 (2014)Google Scholar
  25. 25.
    Schneier, B.: Attack trees: modeling security threats. Dr. Dobb’s J. 24, 21–29 (1999)Google Scholar
  26. 26.
    Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.: Automated generation and analysis of attack graphs. In: IEEE S&P (2002)Google Scholar
  27. 27.
    Sommestad, T., Ekstedt, M., Holm, H.: The cyber security modeling language: a tool for assessing the vulnerability of enterprise system architectures. IEEE Syst. J. 7(3), 363–373 (2013)CrossRefGoogle Scholar
  28. 28.
    Symantec Security Response: Dragonfly: cyberespionage attacks against energy suppliers, July 2014. http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf
  29. 29.
    Verendel, V.: Quantified security is a weak hypothesis. In: NSPW (2009)Google Scholar
  30. 30.
    Vu, A.H., Tippenhauer, N.O., Chen, B., Nicol, D.M., Kalbarczyk, Z.: CyberSAGE: a tool for automatic security assessment of cyber-physical systems. In: Norman, G., Sanders, W. (eds.) QEST 2014. LNCS, vol. 8657, pp. 384–387. Springer, Heidelberg (2014)Google Scholar

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  • Xinshu Dong
    • 1
  • Sumeet Jauhar
    • 1
  • William G. Temple
    • 1
  • Binbin Chen
    • 1
  • Zbigniew Kalbarczyk
    • 2
  • William H. Sanders
    • 2
  • Nils Ole Tippenhauer
    • 3
  • David M. Nicol
    • 2
  1. 1.Advanced Digital Sciences CenterSingaporeSingapore
  2. 2.University of Illinois at Urbana-ChampaignChampaignUSA
  3. 3.Singapore University of Technology and DesignSingaporeSingapore

Personalised recommendations