Tolerating Intrusions Through Secure System Reconfiguration Dennis Heimbigner and Alexander Wolf University of Colorado at Boulder John Knight University of Virginia Prem Devanbu, Michael Gertz, and Karl Levitt University of California at Davis

Distributed Active Mngmt. & Control (before/during/after) ATTACKS Intrusion Tolerance Mechanism Critical System Secure System Configuration/ Reconfiguration Secure System Configuration/ Reconfiguration Project Overview Solution Requirements Timely Assured Mediated Automated Driving Principles Bend, don’t break Proactive and reactive Specification/model-based Dynamic tolerance evolution Critical Systems Families Distributed Networked Componentized Configurability Specifications Configurability Specifications Privilege Specifications Privilege Specifications Survivability Specifications Survivability Specifications

Posturing Anticipated Attacks Anticipated Attacks Intelligence Information Intelligence Information Vulnerability Analysis Vulnerability Analysis Operational Experience Operational Experience Analysis Posture AttackedThreatenedOver hardened Secure System Configuration/ Reconfiguration Secure System Configuration/ Reconfiguration No requirement to mask faults

Survivability Architecture (Logical View) Reactive Active Control Active Control Proactive Active Management Active Management New Postures New Postures Commands Operator Administrator Intelligence Analysis Development Trust boundary During Attack Before and After Attack

Survivability Architecture (Physical View) Field Reconfiguration Controller Mediator + Authority Configured Components Activated System Activated System Event Service Coordination Service Depot CIDF Models Agents Models Agents Configured Components Reconfiguration control and/or data channel Event channel Application control and/or data channel Component activation Component deactivation Standard reconfiguration interface Models Agents Components Depot Models Agents Components Mediator Field Reconfiguration Controller Mediator

Integrated Technology Strategy u Application reconfiguration for survivability –RAPTOR modeling system –Survivability specification u Agent-based software configuration and deployment –Software Dock software deployment system –Siena wide-area event notification service u Agent and information security –Secure, flexible information access –Trusted code on untrustworthy platforms

RAPTOR Modeling System u Arbitrary network topologies u Large model support u Demonstration: –FedWire payment system – banks –Terrorist bombs –Coordinated attacks u Windows 2000 platform u Available for download soon Vulnerabilities Network Topology Node Semantics Symptoms Network Model Visualization Run-time input Model specification

Software Dock Release Retire Install Update Reconfig Adapt Activate Remove Deactivate Development Producer-side Consumer-side Event Service Event Service Field docks represent the consumer and provide an interface to the consumer site Wide-area event service provides connectivity Agents provide deployment process functionality Release docks represent the producer and are a repository of configurable releases Release Dock Release Dock Field Dock Field Dock Field Dock Field Dock Agent u Automated wide-area software deployment u Declarative family configurability u Comprehensive life cycle coverage

Secure, Flexible Information Access Publisher 1 Publisher n Owner 1 Owner n Agent Mediator Authority Trusted UntrustedSometimes trusted u Mediators provide to agents information obtained from model owners via publishers u Two complementary forms of security: –Publishers answer queries from mediators, and are untrusted, online, and distinct from owners; they use no secret keys –Authorities, under administrative control, can certify and revoke owner keys and privileges

Evaluation u Continuous assessment –Increasingly sophisticated models –Increasingly capable prototypes u Scenario-based approach –Increasingly complex attacks –Informed by interaction with domain experts »banking and finance, power, transportation »security threats and vulnerabilities u Symptom and vulnerability injection u Metrics: speed, precision, and availability