1. Using security assessment methods to enhance the feedback from security training Jonas Hallberg Division of Information Systems Swedish Defence Research Agency (FOI) www.foi.se/securityassessment jonas.hallberg@foi.se Jonas Hallberg Division of Information Systems Swedish Defence Research Agency (FOI) www.foi.se/securityassessment jonas.hallberg@foi.se

2. Training environment

3. jonas.hallberg@foi.se Security assessment focus

4. jonas.hallberg@foi.se Security assessment context

5. jonas.hallberg@foi.se Security assessment method XMASS - eXtended Method for Assessment of System Security

6. jonas.hallberg@foi.se XMASS – systems modeling Systems are modeled as interconnected components Two main classes of components: 1.Traffic generators, e.g. PCs and PDAs 2.Traffic mediators, e.g. firewalls and hubs Two types of relations: 1.Physical, e.g. network connections 2.Logical, e.g. node dependencies The abstraction level is not fixed Systems are modeled as interconnected components Two main classes of components: 1.Traffic generators, e.g. PCs and PDAs 2.Traffic mediators, e.g. firewalls and hubs Two types of relations: 1.Physical, e.g. network connections 2.Logical, e.g. node dependencies The abstraction level is not fixed

7. jonas.hallberg@foi.se XMASS – security values Entity profiles Security profiles consist of security features with corresponding elementary security values Filtering profiles describes the ability of traffic mediators to block malicious traffic Entity relations Inter-component relations are modeled with a set of functions System-dependent security profiles Computed for each component based on component security profiles and relations System security values Based on the system-dependent security profiles Entity profiles Security profiles consist of security features with corresponding elementary security values Filtering profiles describes the ability of traffic mediators to block malicious traffic Entity relations Inter-component relations are modeled with a set of functions System-dependent security profiles Computed for each component based on component security profiles and relations System security values Based on the system-dependent security profiles

8. jonas.hallberg@foi.se XMASS – tasks

9. jonas.hallberg@foi.se Requirement collections Security feature# requirements Access Control19 Security Logging12 Intrusion Prevention 17 Intrusion Detection 12 Protection against Malware 16

10. jonas.hallberg@foi.se Security profile template

11. jonas.hallberg@foi.se Security profiles

14. jonas.hallberg@foi.se Workflow Preparation Model network Export network model In action Accept tokens Update model After-action review Documentation Preparation Model network Export network model In action Accept tokens Update model After-action review Documentation

15. jonas.hallberg@foi.se Preparation

16. jonas.hallberg@foi.se In action

17. jonas.hallberg@foi.se After-action review

18. jonas.hallberg@foi.se Enhanced training Support the specification of the network Provides in-training security status overview Supports the after-action review Support the specification of the network Provides in-training security status overview Supports the after-action review