Risk Propagation Assessment for Network Security E-Book

Mohamed Slim Ben Mahmoud

• Herausgeber: John Wiley & Sons
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch

Seitenzahl: 121

Veröffentlichungsjahr: 2013

Beschreibung

The focus of this book is risk assessment methodologies for network architecture design. The main goal is to present and illustrate an innovative risk propagation-based quantitative assessment tool. This original approach aims to help network designers and security administrators to design and build more robust and secure network topologies. As an implementation case study, the authors consider an aeronautical network based on AeroMACS (Aeronautical Mobile Airport Communications System) technology. AeroMACS has been identified as the wireless access network for airport surface communications that will soon be deployed in European and American airports mainly for communications between aircraft and airlines. It is based on the IEEE 802.16-2009 standard, also known as WiMAX.

The book begins with an introduction to the information system security risk management process, before moving on to present the different risk management methodologies that can be currently used (quantitative and qualitative). In the third part of the book, the authors' original quantitative network risk assessment model based on risk propagation is introduced. Finally, a network case study of the future airport AeroMACS system is presented. This example illustrates how the authors' quantitative risk assessment proposal can provide help to network security designers for the decision-making process and how the security of the entire network may thus be improved.

Leseprobe

Contents

LIST OF FIGURES

LIST OF TABLES

INTRODUCTION

PART 1: NETWORK SECURITY RISK ASSESSMENT

CHAPTER 1. INTRODUCTION TO INFORMATION SYSTEM SECURITY RISK MANAGEMENT PROCESS

1.1. On the importance of network security for network designers

1.2. On the impact of risk assessment in the decision-making process for network security designers

1.3. Quantitative versus qualitative risk assessment approaches

1.4. Network security risk propagation concept

CHAPTER 2. SECURITY RISK MANAGEMENT BACKGROUND

2.1. Qualitative security risk management methods

2.2. Quantitative security risk assessment approaches

2.3. Toward a quantitative propagation-based risk assessment methodology

CHAPTER 3. A QUANTITATIVE NETWORK RISK ASSESSMENT METHODOLOGY BASED ON RISK PROPAGATION

3.1. Quantifying methodology parameters

3.2. Network security risk assessment process

3.3. Conclusion

PART 2: APPLICATION TO AIRPORT COMMUNICATION NETWORK DESIGN

CHAPTER 4. THE AEROMACS COMMUNICATION SYSTEM IN THE SESAR PROJECT

4.1. Overview of the European SESAR project

4.2. Overview of aeronautical communications operating concept and requirements

4.3. Introduction to the AeroMACS communication system

CHAPTER 5. AERONAUTICAL NETWORK CASE STUDY

5.1. Experimental parameters

5.2. AeroMACS case study: experimental results

5.3. Improving AeroMACS network security

CONCLUSION

BIBILOGRAPHY

INDEX

First published 2013 in Great Britain and the United States by ISTE Ltd and John Wiley & Sons, Inc.

Apart from any fair dealing for the purposes of research or private study, or criticism or review, as permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored or transmitted, in any form or by any means, with the prior permission in writing of the publishers, or in the case of reprographic reproduction in accordance with the terms and licenses issued by the CLA. Enquiries concerning reproduction outside these terms should be sent to the publishers at the undermentioned address:

ISTE Ltd27-37 St George’s RoadLondon SW19 4EUUK

www.iste.co.uk

John Wiley & Sons, Inc.111 River StreetHoboken, NJ 07030USA

www.wiley.com

© ISTE Ltd 2013The rights of Mohamed Slim Ben Mahmoud, Nicolas Larrieu and Alain Pirovano to be identified as the author of this work have been asserted by them in accordance with the Copyright, Designs and Patents Act 1988.

Library of Congress Control Number: 2012954206

British Library Cataloguing-in-Publication Data

A CIP record for this book is available from the British Library

ISSN: 2051-2481 (Print)

ISSN: 2051-249X (Online)

ISBN: 978-1-84821-454-5

List of Figures

1.1 General information system security risk management process

1.2 Risk transitivity between correlated nodes

1.3 Network security risk propagation example

4.1 COCR phases 1 and 2 concept evolution over time

4.2 General airspace decomposition

4.3 Cleveland-Hopkins airport AeroMACS testbed

4.4 AeroMACS protocol stack

4.5 AeroMACS network reference architecture

4.6 Isolated AeroMACS network topology scenario

4.7 Integrated AeroMACS network topology

5.1 Risk assessment framework using MARIONNET

5.2 Individual risks for all network nodes

5.3 Individual risk evolution as a function of vulnerabilities for all nodes

5.4 Vulnerability CVSS statistics

5.5 Propagated risk evolution as function of connected nodes for all network nodes

5.6 Percentage of network risk per node risk

5.7 ASN gateway propagated risk contribution per connected node

5.8 Vulnerability CVSS score distribution for EAP and RSA

5.9 Individual risks for base stations and the ASN gateway

5.10 Propagated risks for all nodes (EAP vs. RSA)

5.11 Percentage of network risk per node risk (EAP vs. RSA)

5.12 AeroMACS network topology: extended isolated scenario

5.13 Comparison of CVSS score distribution (with and without operational server vulnerabilities)

5.14 Comparison of propagated risks as a function of the number of connected nodes (with and without operational server vulnerabilities)

5.15 Comparison of the percentage of network risk per node risk (with and without operational server vulnerabilities)

5.16 The new isolated network topology using two ASN gateways

5.17 Comparison of network risk values

5.18 WiMAX forum NWG end-to-end network model

5.19 Final comparison of CVSS scores distribution

5.20 Final comparison of total number of vulnerabilities

5.21 Final comparison of average CVSS score

5.22 Final comparison of network risk values

5.23 Final comparison of the percentage of network risk per node risk

5.24 DHCP key management using a DHCP relay

5.25 Mobile IP registration – PMIP case

5.26 Mobile IP key management – PMIP case

5.27 Mobile IP registration – CMIP case

List of Tables

1.1 Qualitative versus quantitative risk assessment approaches

2.1 ISSRM standards and methods summary

2.2 Quantitative risk assessment approaches summary

3.1 Risk parameter notations

4.1 AeroMACS reference point interface description

5.1 Node function values

5.2 Aeronautical class values

5.3 Node values for aeronautical network domains

5.4 From qualitative to quantitative COCR values mapping

5.5 AeroMACS topology emulation parameters

5.6 Vulnerability CVSS statistics

5.7 Propagated risks for all network nodes

5.8 Node risk results

5.9 EAP vs. RSA vulnerability statistics (all nodes)

5.10 Node risk statistics – EAP vs. RSA

5.11 Emulation parameters (without operational server vulnerabilities)

5.12 Updated vulnerability CVSS statistics

5.13 Updated individual risk results

5.14 Updated propagated risk results

5.15 Updated network and node risk results

5.16 Simulation parameters (scenario with two ASN gateways)

5.17 Updated individual risk values (isolated scenario with two ASN gateways)

5.18 Updated propagated risk values (two ASN gateways)

5.19 Updated node risk values (two ASN gateways)

5.20 Simulation parameters (Integrated AeroMACS Topology)

5.21 Updated vulnerability CVSS statistics (integrated network topology)

5.22 Updated individual risk values (integrated scenario)

5.23 Updated propagated risk values (integrated scenario)

5.24 Updated network risk values (integrated scenario)

Introduction

Risk assessment is generally considered as the core of the computational framework in a risk management process for a network information system. This process is mandatory and crucial for the protection of interconnected systems that provide various services to their clients or users. Traditionally, system vulnerabilities are identified, determining the occurrence of threats being exploited, and evaluating the consequences of attacks that could take advantage of these security weaknesses. Having assessed the risks, security countermeasures (which could be technical or operational) are identified and then implemented to mitigate those risks.

In the literature, there is a plethora of risk assessment methodologies defined for network security. Nevertheless, most of them rely on a quantitative security analysis. In such approaches, security experts evaluate the potential likelihood and impact of each identified threat to determine the risk level for the network system. This is a big issue as security expertise is expensive financially speaking, and relatively slow compared to an automated risk assessment procedure: several workshops and appointments have to be held in order to catch the subjective assessment of the experts. Furthermore, the assessment risk processes are often based on a ranking scale (e.g. low, medium, high). Using such an evaluation methodology allows us possibly to compare two different risk levels (for instance, between high and low), but it is impossible to estimate the distance between them (for instance, between two security levels ranked as high). This can be confusing for a security network administrator willing to improve the overall security level of the network.

The Improving Network Security Using a Risk Propagation-based Quantitative Assessment Methodology book deals with risk assessment methodologies for network architecture design. The main goal is to present and illustrate an innovative risk propagation-based quantitative assessment tool. This risk assessment methodology takes into account the inherent characteristics of any computer network in general (such as interconnection between nodes). This contribution is motivated, first by the shortcomings noticed in qualitative risk assessment methodologies. Second, the existing quantitative risk assessment models for network security generally missed out an essential concept in network security risk evaluation, namely risk propagation. In this book, we fill this gap showing how important risk propagation can be in the network risk computation step. Furthermore, this original approach helps network and security administrators to design and build more robust and secure network topologies.

As an implementation case study, a new aeronautical communication system called AeroMACS (Aeronautical Mobile Airport Communications System) is considered. AeroMACS has been recently identified as the future wireless access network for airport surface communications, which will be soon deployed at European and American airports. It is based on the IEEE 802.16-2009 standard, which is also known as WiMAX1. Indeed, aeronautical communications are about to shift the paradigm of digital data in the near future.

Owing to the progress made in information technology (IT) in the last decades, aviation industry stakeholders are enhancing and expanding their networks not only to overcome congestion issues related to voice radio communications but also to modernize the air traffic management (ATM) environment through worldwide collaborative projects like Single European Sky ATM Research (SESAR). The introduction of data communication technologies, such as AeroMACS, emphasizes the need for secure systems to protect against cyber attacks and external threats.

This book is split into two parts. Part 1 is related to network security risk assessment, while Part 2 concerns the aeronautical case study and the AeroMACS technology.

Part 1: Network security risk assessment

Chapter 1 provides an introduction to information system security risk management process. The objective of this chapter is to underline the importance of network security in network design and emphasize the impact of risk assessment in the decision-making process of network security policies. Furthermore, the risk propagation concept is explained.

Chapter 2 provides a state of the art of existing risk management methodologies that can be currently used (quantitative and qualitative methodologies).

In Chapter 3, an original quantitative network risk assessment model based on risk propagation is introduced. All the parameters defined in the methodology are explained. Then, the chapter goes through the network security risk assessment process.

Part 2: Application to airport communication network design

After the first part dedicated to risk assessment, an extensive case study is presented in the second part of the book. The main goal is to present to the reader a complete application of the risk assessment methodology to future airport communication network design.

Chapter 4 introduces the aeronautical background necessary to understand this case study: the European SESAR project is briefly presented and then specific aeronautical communication concepts and terminology are discussed. The chapter ends with a section dedicated to the AeroMACS technology (protocol architecture, network reference model, security features) used in the case study.

Finally, Chapter 5 presents all the experimental scenarios and their results. The risk assessment results are used at each step to improve the choices made later in the following experiments as the tool is meant to be used (a decision-making tool for network security and network design).

1http://standards.ieee.org/about/get/802/802.16.html

PART 1

Network Security Risk Assessment

1

Introduction to Information System Security Risk Management Process

Currently, network security is an important part of a network design process. Information System Security Risk Management (ISSRM) allows network engineers to maximize the network security level they want to achieve. Usually, ISSRM processes follow an overall framework composed of classical and common steps. Nevertheless, these steps can differ from one method to another and do not necessarily put the same weight on each step. For instance, some methods focus on security controls and countermeasures whereas others put more effort on risk assessment and treatment procedures.

However, a general ISSRM framework can be drawn and considered as a basis for any information security management-related work, as illustrated in Figure 1.1.

This general ISSRM framework is composed of six steps:

a) Context and asset identification: first, the communication system and its environment are described with an emphasis on the sensitive assets (devices, data, etc.) to protect.

b) Security objectives identification: security needs are then defined. Based on the previous step, security objectives are usually expressed in terms of basic security services (confidentiality, authentication, integrity, non-repudiation, availability and authorization).

Figure 1.1.General information system security risk management process

c) Risk assessment: this step consists in estimating potential risks that can harm the assets identified in step (a) and threaten the security objectives of step (b). The risk assessment procedure can be based on a qualitative or quantitative study. Note that if the risk assessment is unsatisfactory, it could be possible to go back to previous steps and restart the analysis.

d) Risk mitigation: once the risk has been clearly identified, risk treatment actions can be taken. For instance, such a measure could be to decide to retain the risk (e.g. accept the risk because it is considered low enough), reduce it (e.g. reinforce security policies) or avoid it (e.g. deactivate a risky network device).

e) Security requirements definition: security requirements can now be determined as security solutions to mitigate the identified risks, mainly if the risk reduction strategy has been chosen.

f) Security controls and countermeasures selection and implementation: finally, security requirements are instantiated into explicit security controls and countermeasures. For instance, firewalls have been selected to protect the aeronautical network we consider in the case study developed in Chapter 5 of this book.

1.1. On the importance of network security for network designers

Network security is a critical step in IT network and system design. Security countermeasures (firewalls, virtual private networks (VPNs), authentication, authorization and accounting (AAA) servers, etc.) are the first protection layer against threats and malicious actions targeting the system resources. In order to provide an effective and robust network, a sound risk analysis and a well-thought security policy are required. Hence, before deploying the network security system, network designers have to carefully think about security by respecting the following guidances:

– Security has to be a built-in feature instead of a built-on ingredient to be added when security issues begin to show up.

– Several layers of security should be deployed in order to complement each other when needed (e.g. if a firewall goes offline, another firewall will be able to provide data flow filtering). Also, security devices should be physically located into different entries of the network in order to avoid a single “point of failure”. This is usually called “defense-in-depth” security.

– IT system resources should be dispatched into different security demilitarized zones (DMZs) according to their sensitivity and criticality.

– Intrusion prevention systems (IPS) are different from firewalls and should be used because they do not perform the same role: IPS devices are about intrusion detection for later effective actions whereas firewalls are about monitoring traffic flows, compartmentalizing the network infrastructure, and controlling the communications.

– Network security should not be limited to security devices only, it should be extended to other network management and configuration tasks (e.g. setting configuration files on network devices, monitoring resource consumption activities, analyzing logging events).

– A good network security design necessary goes primarily through an efficient risk analysis and vulnerability assessment that focuses on most critical resources in the system and highlights the security flaws to be considered later when the network is effectively designed.