11 Enterprise Security Assessment Sharing: An appetizer Yuri Gurevich Research in Software Engineering Microsoft, Redmond, WA, USA

Section: Motivation The problem of interest to us belongs to a natural class of problems. We describe the class by examples. 2

Tower of Babel 1. All men had the same language and vocabulary. 2. As they migrated from the east, they came upon a valley in the land of Shinar and settled there. 3. They said: “Let’s make bricks and burn them hard.” Brick served them as stone, and bitumen as mortar. 4. They said: “Let’s build a city and a tower with its top in the sky to glorify ourselves; otherwise we’ll be scattered over the world.” 5. The Lord came down to look at the city and tower that man built. 6. And the Lord said: “If, as one people with one language, this is how they began to act, then nothing that they may propose to do is out of their reach. 7. Let’s then go down and confound their speech, so that they shall not understand one another.” 8. Thus the Lord scattered them over the face of the earth, and they stopped building the city. 9. That’s why it’s called Babel, because there the Lord confounded the speech of the earth, and from there the Lord scattered them over the face of the earth. 3

Solutions 1. Choose a particular language and use it as lingua franca 2. A super linguist that knows all the languages 3. An army of translators 4. A mystery solution 4

Healthcare Problem Different expertise (rather than different languages) The skiing example Solutions 1. Particular language as lingua franca 2. Super physician 3. An army of translators 4. A mystery solution 5

Automated security experts Edge experts (related to network security) firewalls routers, gateways network intrusion detection, network protection systems data loss (or leak) protection, aka network extrusion detection Host experts (monitoring individual hosts) monitoring registry changes monitoring applications anti-malware, anti-spyware host fire walls host intrusion protection systems host extrusion protection health (or operation) management 6

Automated security experts (cont) Identity experts identity management monitoring (suspicious) password changes monitoring elevation of privileges Active Directory experts related to spam viruses data leakage Application and DB experts 7

Solutions Super expert Security Event Management (SEM) Security Information Management (SIM) A mystery solution 8

Distributed databases The problem Object info may be spread over a large number of local databases. Checking for consistency, infection, etc. may be involved and require expensive transactions. View local databases as experts observing different features of an object in question. Solutions A local super database A mystery solution 9

Section: Mystery solution 10