Advertisement

Modeling and Mitigating the Insider Threat of Remote Administrators in Clouds

  • Nawaf Alhebaishi
  • Lingyu Wang
  • Sushil Jajodia
  • Anoop Singhal
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10980)

Abstract

As today’s cloud providers strive to attract customers with better services and less downtime in a highly competitive market, they increasingly rely on remote administrators including those from third party providers for fulfilling regular maintenance tasks. In such a scenario, the privileges granted for remote administrators to complete their assigned tasks may allow an attacker with stolen credentials of an administrator, or a dishonest remote administrator, to pose severe insider threats to both the cloud tenants and provider. In this paper, we take the first step towards understanding and mitigating such a threat. Specifically, we model the maintenance task assignments and their corresponding security impact due to privilege escalation. We then mitigate such impact through optimizing the task assignments with respect to given constraints. The simulation results demonstrate the effectiveness of our solution in various situations.

Notes

Acknowledgements

The authors thank the anonymous reviewers for their valuable comments. This work was partially supported by the National Institutes of Standard and Technology under grant number 60NANB16D287, by the National Science Foundation under grant number IIP-1266147, and by Natural Sciences and Engineering Research Council of Canada under Discovery Grant N01035.

References

  1. 1.
    National Institute of Standards and Technology: Cloud Computing Service Metrics Description (2015). http://www.nist.gov/itl/cloud/upload/RATAX-CloudServiceMetricsDescription-DRAFT-20141111.pdf. Accessed 17 June 2015
  2. 2.
    Amazon Web Services (2018). https://aws.amazon.com/. Accessed 28 Feb 2018
  3. 3.
    Google Cloud Platform (2018). https://cloud.google.com/. Accessed 28 Feb 2018
  4. 4.
    Microsoft Azure (2018). https://azure.microsoft.com. Accessed 28 Feb 2018
  5. 5.
    Alhebaishi, N., Wang, L., Jajodia, S., Singhal, A.: Threat modeling for cloud data center infrastructures. In: Cuppens, F., Wang, L., Cuppens-Boulahia, N., Tawbi, N., Garcia-Alfaro, J. (eds.) FPS 2016. LNCS, vol. 10128, pp. 302–319. Springer, Cham (2017).  https://doi.org/10.1007/978-3-319-51966-1_20CrossRefGoogle Scholar
  6. 6.
    Althebyan, Q., Panda, B.: A knowledge-base model for insider threat prediction. In: 2007 IEEE SMC Information Assurance and Security Workshop, pp. 239–246, June 2007Google Scholar
  7. 7.
    Bakshi, K.: Cisco cloud computing-data center strategy, architecture, and solutions (2009). http://www.cisco.com/web/strategy/docs/gov/CiscoCloudComputing_WP.pdf
  8. 8.
    Bishop, M., Engle, S., Peisert, S., Whalen, S., Gates, C.: We have met the enemy and he is US. In: Proceedings of the 2008 New Security Paradigms Workshop, NSPW 2008, pp. 1–12. ACM, New York (2008)Google Scholar
  9. 9.
    Bleikertz, S., Kurmus, A., Nagy, Z.A., Schunter, M.: Secure cloud maintenance: Protecting workloads against insider attacks. In: Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security, ASIACCS 2012, pp. 83–84. ACM, New York (2012)Google Scholar
  10. 10.
    Borbor, D., Wang, L., Jajodia, S., Singhal, A.: Diversifying network services under cost constraints for better resilience against unknown attacks. In: Ranise, S., Swarup, V. (eds.) DBSec 2016. LNCS, vol. 9766, pp. 295–312. Springer, Cham (2016).  https://doi.org/10.1007/978-3-319-41483-6_21CrossRefGoogle Scholar
  11. 11.
    Chinchani, R., Iyer, A., Ngo, H.Q., Upadhyaya, S.: Towards a theory of insider threat assessment. In: 2005 International Conference on Dependable Systems and Networks (DSN 2005), pp. 108–117, June 2005Google Scholar
  12. 12.
    Claycomb, W.R., Nicoll, A.: Insider threats to cloud computing: directions for new research challenges. In: 2012 IEEE 36th Annual Computer Software and Applications Conference, pp. 387–394, July 2012Google Scholar
  13. 13.
    Cloud Security Alliance. Security guidance for critical areas of focus in cloud computing v 3.0 (2011)Google Scholar
  14. 14.
    Cloud Security Alliance. Top threats to cloud computing (2018). https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf
  15. 15.
    Dahbur, K., Mohammad, B., Tarakji, A.B.: A survey of risks, threats and vulnerabilities in cloud computing. In Proceedings of the 2011 International Conference on Intelligent Semantic Web-Services and Applications, ISWSA 2011, pp. 12:1–12:6. ACM, New York (2011)Google Scholar
  16. 16.
    Gruschka, N., Jensen, M.: Attack surfaces: a taxonomy for attacks on cloud services. In: 2010 IEEE 3rd International Conference on Cloud Computing, pp. 276–279. IEEE (2010)Google Scholar
  17. 17.
    Gupta, M., Rees, J., Chaturvedi, A., Chi, J.: Matching information security vulnerabilities to organizational security profiles: a genetic algorithm approach. Decis. Support Syst. 41(3), 592–603 (2006). Intelligence and Security InformaticsCrossRefGoogle Scholar
  18. 18.
    Hany, M.: VMware VSphere in the Enterprise. http://www.hypervizor.com/diags/HyperViZor-Diags-VMW-vS4-Enterprise-v1-0.pdf. Accessed 05 Feb 2015
  19. 19.
    ISO Std IEC. ISO 27017. Information technology- Security techniques- Code of practice for information security controls based on ISO/IEC 27002 for cloud services (DRAFT) (2012). http://www.iso27001security.com/html/27017.html
  20. 20.
    Li, M., Zang, W., Bai, K., Yu, M., Liu, P.: Mycloud: supporting user-configured privacy protection in cloud computing. In: Proceedings of the 29th Annual Computer Security Applications Conference, ACSAC 2013, pp. 59–68. ACM, New York (2013)Google Scholar
  21. 21.
    Luna, J., Ghani, H., Germanus, D., Suri, N.: A security metrics framework for the cloud. In: 2011 Proceedings of the International Conference on Security and Cryptography (SECRYPT), pp. 245–250, July 2011Google Scholar
  22. 22.
    Luna, J., Ghani, H., Germanus, D., Suri, N.: A security metrics framework for the cloud. In: 2011 Proceedings of the International Conference on Security and Cryptography (SECRYPT), pp. 245–250. IEEE (2011)Google Scholar
  23. 23.
    Mathew, S., Upadhyaya, S., Ha, D., Ngo, H.Q.: Insider abuse comprehension through capability acquisition graphs. In: 2008 11th International Conference on Information Fusion, pp. 1–8, June 2008Google Scholar
  24. 24.
    Openstack. Openstack Operations Guide. http://docs.openstack.org/openstack-ops/content/openstack-ops_preface.html. Accessed 27 Aug 2015
  25. 25.
    di Vimercati, S.C., Syverson, P., Gollmann, D. (eds.): ESORICS 2005. LNCS, vol. 3679. Springer, Heidelberg (2005).  https://doi.org/10.1007/11555827CrossRefGoogle Scholar
  26. 26.
    Roy, A., Sural, S., Majumdar, A.K., Vaidya, J., Atluri, V.: On optimal employee assignment in constrained role-based access control systems. ACM Trans. Manage. Inf. Syst. 7(4), 10:1–10:24 (2016)CrossRefGoogle Scholar
  27. 27.
    Sandhu, R.S., Coyne, E.J., Feinstein, H.L., Youman, C.E.: Role-based access control models. Computer 29(2), 38–47 (1996)CrossRefGoogle Scholar
  28. 28.
    Saripalli, P., Walters, B.: Quirc: a quantitative impact and risk assessment framework for cloud security. In: 2010 IEEE 3rd International Conference on Cloud Computing, pp. 280–288, July 2010Google Scholar
  29. 29.
    Sarkar, A., Khler, S., Riddle, S., Ludaescher, B., Bishop, M.: Insider attack identification and prevention using a declarative approach. In: 2014 IEEE Security and Privacy Workshops, pp. 265–276, May 2014Google Scholar
  30. 30.
    Shaikh, F.B., Haider, S.: Security threats in cloud computing. In: 2011 International Conference for Internet Technology and Secured Transactions (ICITST), pp. 214–219, December 2011Google Scholar
  31. 31.
    Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.M.: Automated generation and analysis of attack graphs. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, pp. 273–284 (2002)Google Scholar
  32. 32.
    Sze, W.K., Srivastava, A., Sekar, R.: Hardening openstack cloud platforms against compute node compromises. In: Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, ASIA CCS 2016, pp. 341–352. ACM, New York (2016)Google Scholar
  33. 33.
    Wang, L., Jajodia, S., Singhal, A., Cheng, P., Noel, S.: k-zero day safety: a network security metric for measuring the risk of unknown vulnerabilities. IEEE Trans. Dependable Secure Comput. 11(1), 30–44 (2014)CrossRefGoogle Scholar

Copyright information

© IFIP International Federation for Information Processing 2018

Authors and Affiliations

  • Nawaf Alhebaishi
    • 1
    • 2
  • Lingyu Wang
    • 1
  • Sushil Jajodia
    • 3
  • Anoop Singhal
    • 4
  1. 1.Concordia Institute for Information Systems EngineeringConcordia UniversityMontrealCanada
  2. 2.Faculty of Computing and Information TechnologyKing Abdulaziz UniversityJeddahSaudi Arabia
  3. 3.Center for Secure Information SystemsGeorge Mason UniversityFairfaxUSA
  4. 4.Computer Security DivisionNational Institute of Standards and TechnologyGaithersburgUSA

Personalised recommendations