Preface |
|
xxiii | |
Contributors |
|
xxvii | |
|
|
1 | (16) |
|
|
|
|
|
|
|
1 | (2) |
|
Information Assurance: Dependability and Security of Networked Information Systems |
|
|
3 | (4) |
|
|
7 | (7) |
|
The Three Parts of the Book |
|
|
7 | (1) |
|
|
8 | (1) |
|
Security for Distributed Systems: Foundations of Access Control |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
9 | (1) |
|
Taxonomy and Framework for Integrating Dependability and Security |
|
|
9 | (1) |
|
Stochastic Models/Techniques for Secure and Survivable Systems |
|
|
10 | (1) |
|
Integrated Dependability and Security Evaluation Using Game Theory and Markov Models |
|
|
10 | (1) |
|
Scenario Graphs Applied to Network Security |
|
|
11 | (1) |
|
Vulnerability-Centric Alert Correlation |
|
|
11 | (1) |
|
Monitoring and Detecting Attacks in All-Optical Networks |
|
|
11 | (1) |
|
Robustness Evaluation of Operating Systems |
|
|
12 | (1) |
|
Intrusion Response Systems: A Survey |
|
|
12 | (1) |
|
Secure and Resilient Routing: A Framework for Resilient Network Architectures |
|
|
13 | (1) |
|
Wireless Systems Security and Survivability |
|
|
13 | (1) |
|
Integrated Fault and Security Management |
|
|
14 | (1) |
|
|
14 | (3) |
|
|
14 | (3) |
|
Part I: Foundational Background on Security and Dependability Techniques |
|
|
17 | (130) |
|
|
19 | (20) |
|
|
|
|
19 | (1) |
|
Network Attacks and Security Issues |
|
|
19 | (8) |
|
|
20 | (3) |
|
Some Example Security Attacks |
|
|
23 | (3) |
|
Security Attacks, Services, and Architecture |
|
|
26 | (1) |
|
Protection and Prevention |
|
|
27 | (7) |
|
Firewalls and Perimeter Security |
|
|
27 | (3) |
|
|
30 | (4) |
|
|
34 | (2) |
|
|
36 | (1) |
|
|
37 | (2) |
|
|
37 | (2) |
|
Security for Distributed Systems: Foundations of Access Control |
|
|
39 | (42) |
|
|
|
|
39 | (1) |
|
Identification and Authentication |
|
|
40 | (6) |
|
Password-Based Authentication |
|
|
41 | (1) |
|
Insecure Communication Channels |
|
|
42 | (1) |
|
Challenge-Response Systems |
|
|
42 | (1) |
|
Authentication in Distributed Systems |
|
|
43 | (3) |
|
|
46 | (14) |
|
Access Control Based on Subject-Object Relationships |
|
|
48 | (1) |
|
|
48 | (5) |
|
An Information Flow Policy for Confidentiality |
|
|
53 | (2) |
|
|
55 | (1) |
|
|
56 | (3) |
|
Role-Based Access Control |
|
|
59 | (1) |
|
Access Control in Distributed Systems |
|
|
60 | (12) |
|
Overview of Relevant Standards |
|
|
61 | (4) |
|
|
65 | (7) |
|
Digital Identity Management |
|
|
72 | (4) |
|
|
73 | (1) |
|
|
74 | (1) |
|
|
75 | (1) |
|
|
75 | (1) |
|
|
76 | (5) |
|
|
77 | (4) |
|
|
81 | (32) |
|
|
|
|
|
81 | (2) |
|
|
83 | (1) |
|
Survivable Network Design and Traffic Restoration Concepts |
|
|
84 | (7) |
|
Typical Network Architecture |
|
|
84 | (2) |
|
Basic Survivability Concepts |
|
|
86 | (1) |
|
Basic Network Management Concepts |
|
|
87 | (1) |
|
Protection versus Restoration |
|
|
88 | (1) |
|
|
89 | (2) |
|
Transport Network Recovery Techniques |
|
|
91 | (10) |
|
Automatic Protection Switching |
|
|
91 | (2) |
|
|
93 | (2) |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
97 | (1) |
|
|
98 | (3) |
|
Survivable Network Design Techniques |
|
|
101 | (3) |
|
|
104 | (3) |
|
Conclusion and Future Research Areas |
|
|
107 | (6) |
|
|
108 | (5) |
|
|
113 | (34) |
|
|
Introduction and Background |
|
|
113 | (2) |
|
Survivability and the Impact of Fault Models |
|
|
115 | (4) |
|
Dependability Considerations |
|
|
116 | (2) |
|
Survivability Considerations |
|
|
118 | (1) |
|
|
119 | (7) |
|
Identification of Essential Functionalities |
|
|
121 | (2) |
|
|
123 | (1) |
|
Dealing with Common-Mode Faults |
|
|
124 | (1) |
|
Applying the Notion of Optimality |
|
|
125 | (1) |
|
|
126 | (2) |
|
Survivability of Large Distributed Systems |
|
|
128 | (5) |
|
Borrowing from Well-established Fields |
|
|
133 | (8) |
|
|
133 | (3) |
|
|
136 | (3) |
|
Case Study: Autonomous Mobile Agents |
|
|
139 | (2) |
|
|
141 | (6) |
|
|
142 | (5) |
|
Part II: Modeling the Interaction between Dependability and Security |
|
|
147 | (158) |
|
Taxonomy and Framework for Integrating Dependability and Security |
|
|
149 | (22) |
|
|
|
|
|
149 | (1) |
|
Basic Concepts and Related Work |
|
|
150 | (4) |
|
|
150 | (2) |
|
Integration of Dependability and Security |
|
|
152 | (2) |
|
Proposed Taxonomy and Framework |
|
|
154 | (1) |
|
Key Notations of the Feedback Control System Model |
|
|
154 | (1) |
|
Definitions of Basic Concepts of Dependability and Security within the Proposed Framework |
|
|
155 | (1) |
|
Dependability, Security, and their Attributes |
|
|
155 | (9) |
|
|
157 | (7) |
|
The Means to Attain Dependability and Security |
|
|
164 | (4) |
|
|
164 | (2) |
|
|
166 | (1) |
|
|
166 | (2) |
|
|
168 | (3) |
|
|
168 | (3) |
|
Stochastic Modeling Techniques for Secure and Survivable Systems |
|
|
171 | (38) |
|
|
|
|
|
171 | (2) |
|
Survivability and Security |
|
|
172 | (1) |
|
Analytical Modeling Techniques |
|
|
173 | (6) |
|
|
174 | (2) |
|
|
176 | (1) |
|
Higher-Level Model Formalisms |
|
|
177 | (2) |
|
|
179 | (11) |
|
Intrusion-Tolerant Systems [ 3] |
|
|
180 | (8) |
|
Security Modeling of SITAR Security System [ 4] |
|
|
188 | (2) |
|
|
190 | (15) |
|
|
192 | (13) |
|
|
205 | (4) |
|
|
205 | (4) |
|
Integrated Dependability and Security Evaluation Using Game Theory and Markov Models |
|
|
209 | (38) |
|
|
|
|
|
209 | (4) |
|
|
212 | (1) |
|
|
213 | (1) |
|
|
213 | (8) |
|
|
215 | (1) |
|
Modeling Intrusion as Transitions |
|
|
216 | (1) |
|
|
217 | (1) |
|
Obtaining System Measures |
|
|
218 | (2) |
|
|
220 | (1) |
|
Predicting Attacker Behavior |
|
|
221 | (4) |
|
|
222 | (1) |
|
Modeling Interactions as a Game |
|
|
223 | (1) |
|
|
224 | (1) |
|
Defining and Solving the Game |
|
|
225 | (5) |
|
Tuning the Game Parameters |
|
|
230 | (6) |
|
One Possible Attack Action |
|
|
231 | (2) |
|
Two Possible Attack Actions |
|
|
233 | (2) |
|
|
235 | (1) |
|
|
236 | (4) |
|
|
237 | (1) |
|
|
237 | (1) |
|
|
238 | (1) |
|
|
239 | (1) |
|
|
240 | (7) |
|
|
243 | (4) |
|
Scenario Graphs Applied to Network Security |
|
|
247 | (32) |
|
|
|
247 | (1) |
|
Algorithms for Generating Scenario Graphs |
|
|
248 | (3) |
|
|
248 | (2) |
|
|
250 | (1) |
|
Attack Graphs are Scenario Graphs |
|
|
251 | (2) |
|
|
253 | (4) |
|
|
253 | (1) |
|
|
254 | (3) |
|
|
257 | (9) |
|
Example Network Components |
|
|
259 | (5) |
|
|
264 | (2) |
|
|
266 | (3) |
|
|
267 | (1) |
|
Critical Action Set Minimization |
|
|
267 | (2) |
|
|
269 | (3) |
|
|
269 | (2) |
|
|
271 | (1) |
|
|
272 | (2) |
|
Future Work and Conclusion |
|
|
274 | (5) |
|
|
276 | (3) |
|
Vulnerability-Centric Alert Correlation |
|
|
279 | (26) |
|
|
|
|
279 | (3) |
|
Review of Alert Correlation and Related Techniques |
|
|
282 | (2) |
|
|
284 | (3) |
|
Alert Correlation, Hypothesis, Prediction, and Aggregation |
|
|
287 | (13) |
|
Alert Correlation in Offline Applications |
|
|
287 | (2) |
|
Vulnerability-Centric Alert Correlation |
|
|
289 | (3) |
|
Alert Hypothesis and Prediction |
|
|
292 | (4) |
|
|
296 | (2) |
|
|
298 | (2) |
|
|
300 | (1) |
|
|
300 | (5) |
|
|
301 | (4) |
|
Part III: Design and Architectural Issues for Secure and Dependable Systems |
|
|
305 | (218) |
|
Monitoring and Detecting Attacks in All-Optical Networks |
|
|
307 | (42) |
|
|
|
|
307 | (4) |
|
Security Problems in All-Optical Networks |
|
|
308 | (1) |
|
|
308 | (1) |
|
All-Optical Network Attack Types |
|
|
309 | (1) |
|
Issues in Crosstalk Attack Diagnostic Algorithms |
|
|
310 | (1) |
|
Crosstalk Attack Features and Monitoring Techniques |
|
|
311 | (4) |
|
Crosstalk Attack Features |
|
|
311 | (1) |
|
|
312 | (1) |
|
Overview of Current Monitoring Methods |
|
|
313 | (2) |
|
Node, Attack, and Monitor Models |
|
|
315 | (5) |
|
|
315 | (1) |
|
|
315 | (3) |
|
|
318 | (2) |
|
Necessary and Sufficient Conditions for Crosstalk Attack Detection |
|
|
320 | (5) |
|
Single Crosstalk Attack in a Network |
|
|
320 | (1) |
|
|
320 | (5) |
|
One-Crosstalk Attack Diagnosable Conditions |
|
|
325 | (4) |
|
Detecting the Status of a Connection under One-Original Attack Flow Conditions |
|
|
327 | (2) |
|
|
329 | (1) |
|
k-Crosstalk Attacks in the Network |
|
|
329 | (7) |
|
k-Crosstalk Attack Diagnosable Condition |
|
|
330 | (4) |
|
Detecting Global Status of Connections |
|
|
334 | (1) |
|
|
335 | (1) |
|
Sparse Monitoring and Routing Algorithms |
|
|
336 | (6) |
|
Sparse Monitoring, Test Connection, and Routing for a Single Original Attack Flow Policy I |
|
|
336 | (1) |
|
|
337 | (1) |
|
Sparse Monitoring, Test Connection, and Routing Policy II |
|
|
338 | (2) |
|
Connection Routing Algorithm in One-Original Attack Flow Networks |
|
|
340 | (1) |
|
|
341 | (1) |
|
Sparse Monitoring, Test Connection, and Routing for More than One Original Attack Flow |
|
|
342 | (3) |
|
|
343 | (2) |
|
|
345 | (4) |
|
|
345 | (4) |
|
Robustness Evaluation of Operating Systems |
|
|
349 | (28) |
|
|
|
|
349 | (3) |
|
|
351 | (1) |
|
|
352 | (1) |
|
|
353 | (1) |
|
|
353 | (2) |
|
|
354 | (1) |
|
Error Model and Workload Selection |
|
|
355 | (6) |
|
|
356 | (2) |
|
|
358 | (1) |
|
|
358 | (1) |
|
|
358 | (1) |
|
|
359 | (2) |
|
|
361 | (4) |
|
|
362 | (3) |
|
Presentation and Interpretation of Results |
|
|
365 | (4) |
|
|
369 | (8) |
|
|
370 | (7) |
|
Intrusion Response Systems: A Survey |
|
|
377 | (40) |
|
|
|
|
|
|
|
|
377 | (4) |
|
Static Decision-making Systems |
|
|
381 | (6) |
|
Generic Authorization and Access Control---Application Programming Interface |
|
|
381 | (3) |
|
|
384 | (1) |
|
McAfee Internet Security Suite |
|
|
385 | (1) |
|
|
386 | (1) |
|
Dynamic Decision-making Systems |
|
|
387 | (10) |
|
|
387 | (1) |
|
|
388 | (2) |
|
Alphatech Light Autonomic Defense System |
|
|
390 | (2) |
|
Cooperating Security Managers and Adaptive, Agent-Based Intrusion Response Systems |
|
|
392 | (2) |
|
|
394 | (2) |
|
Other Dynamic Intrusion Response Systems |
|
|
396 | (1) |
|
Intrusion Tolerance through Diverse Replicas |
|
|
397 | (6) |
|
|
398 | (1) |
|
Building Survivable Services Using Redundancy and Adaptation |
|
|
398 | (1) |
|
Scalable Intrusion-Tolerant Architecture |
|
|
399 | (1) |
|
Survival by Defense Enabling |
|
|
400 | (1) |
|
Implementing Trustworthy Services Using Replicated State Machines |
|
|
401 | (1) |
|
Distributing Trust on the Internet |
|
|
402 | (1) |
|
Responses to Specific Kinds of Attacks |
|
|
403 | (4) |
|
Primitives for Responding to DDoS |
|
|
404 | (1) |
|
|
404 | (2) |
|
Cooperative Counter-DDoS Entity |
|
|
406 | (1) |
|
Benchmarking Intrusion Response Systems |
|
|
407 | (3) |
|
Thoughts on Evolution of IRS Technology |
|
|
410 | (2) |
|
|
412 | (5) |
|
|
412 | (5) |
|
Secure and Resilient Routing: Building Blocks for Resilient Network Architectures |
|
|
417 | (42) |
|
|
|
|
417 | (2) |
|
Traffic Engineering Perspective and its Relation to Network Robustness |
|
|
419 | (4) |
|
|
421 | (2) |
|
Components of a Resilient Network Architecture |
|
|
423 | (1) |
|
Threats and Countermeasures in Link-State Routing |
|
|
424 | (11) |
|
Link-State Routing Model and Threat Model |
|
|
424 | (4) |
|
Preventive Cryptographic Countermeasures against Attacks |
|
|
428 | (7) |
|
Resilient Architecture: Virtualization and Routing |
|
|
435 | (11) |
|
An Enabling Framework for Adaptive and Secure Virtualized Networking |
|
|
435 | (5) |
|
Routing Protocol Extension: OSPF-E |
|
|
440 | (4) |
|
Network Analysis: Preliminary Results |
|
|
444 | (2) |
|
|
446 | (3) |
|
|
446 | (3) |
|
Secure Group Communication |
|
|
449 | (10) |
|
Using One-Way Function Chain to Build Key Chain |
|
|
449 | (2) |
|
|
451 | (3) |
|
|
454 | (2) |
|
|
456 | (3) |
|
Security and Survivability of Wireless Systems |
|
|
459 | (30) |
|
|
|
|
|
|
459 | (1) |
|
|
460 | (3) |
|
Current Security Approaches in Wireless Networks |
|
|
463 | (2) |
|
Current Survivability Approaches in Wireless Networks |
|
|
465 | (2) |
|
Framework for Wireless Network Survivability and Security |
|
|
467 | (3) |
|
Interaction between Survivability and Security in Wireless Networks |
|
|
470 | (14) |
|
Extending the Framework to Include Interactions between Security and Survivability |
|
|
472 | (3) |
|
Case Study I: Idle Handoffs |
|
|
475 | (1) |
|
Case Study II: Key Management in Heterogeneous Sensor Networks |
|
|
476 | (8) |
|
|
484 | (5) |
|
|
485 | (4) |
|
Integrated Fault and Security Management |
|
|
489 | (34) |
|
|
|
|
489 | (1) |
|
Active Integrated Fault Identification Framework |
|
|
490 | (16) |
|
|
490 | (1) |
|
|
491 | (1) |
|
Challenges and Problem Formalization |
|
|
492 | (3) |
|
Integrated Fault Intrusion Reasoning |
|
|
495 | (7) |
|
|
502 | (4) |
|
Fault and Security Management on High-speed Networks |
|
|
506 | (14) |
|
|
506 | (2) |
|
|
508 | (3) |
|
Architecture of the HiFIND System |
|
|
511 | (4) |
|
|
515 | (5) |
|
|
520 | (3) |
|
|
520 | (3) |
Index |
|
523 | |