Networking Aspects in the DPASA Survivability Architecture: An Experience Report Michael Atighetchi BBN Technologies

Presentation Overview Overview of DPASA The undefended JBI Application Network Oriented Defenses The defended JBI Application Red Team Results

Overview of DPASA* * DPASA stands for Designing Protection and Adaptation into a Survivability Architecture DPASA is a 2 year DARPA project led by BBN Technologies, to design and implement an architecture for building next generation survivable systems that can Survive 12 hours of sustained attacks from a class A Red Team Achieve 1000-fold alarm reduction and 1% false alarm rate DPASA strategically combines protection, detection, and adaptive reaction following the principles of Multiple Layers of Protection Redundancy and Static Diversity Use of Physical Constraints to Impose Containment Design based on Weak Assumptions Detection and Correlation Adaptive Response Base of Intrusion Tolerant DARPA Technologies: OASIS ( , 20+ projects) FTN ( , 20+ projects)

The Undefended JBI Application

The Undefended JBI – Schematic View PSQ Server Client1 Hub Client1 Emulated WAN Client LAN X Core LAN DB Server Client LAN 1

Network Oriented Defenses VPN Firewalls - use of Cisco PIX VPNs as a first line of defense on the WAN Network Hardening - TCP/IP settings, no ARP, OS patches Autonomic Distributed Firewall Cards (ADF) - only allow necessary communication encrypted over VPGs Network Detection - Signature based monitoring via Emerald NIDS appliances - Heartbeats to monitor liveliness Automatic adaptive network reconfiguration - isolate machines via ADFs - rate limiting and Access Proxy selection Core: Quadrant Isolation Switches - isolate power to corrupted core quads Core: Crumble Zone with Access Proxies - first line of host defense (like a DMZ) Core: Managed Switches - restrict communication via source port filtering

The Defended JBI

Results from the Red Team Exercise (3/05) Main objective: Determine whether the defense-enabled JBI could survive 12 hours of sustained attacks and complete its mission. Red Teams had high privilege access to the WAN switch and full access to the DPASA code. Red Team A - Flood of replayed ISAKMP causes DoS at the VPN router - However, the red team had no insight into the effectiveness of the attack and continues with unsuccessful attacks. Red Team B - Zero day attack involving the high-privileged trunk access on the WAN switch to cause DoS at the VPN router. Besides the availability of the VPN routers, neither confidentiality nor integrity were breached.