The following is an excerpt from Information assurance: Dependability and security in networked systems, by Yi Qian, James Joshi, David Tipper and Prashant Krishnamurthy. It is reprinted here with permission from Morgan Kaufmann, a division of Elsevier; Copyright 2008. Read the excerpt below or download a free .pdf of this chapter: " Information assurance: Dependability and security of networked information systems."
Recent advances in computer networks and information technology (IT) and the advent and growth of the Internet have created unprecedented levels of opportunities for the connectivity and interaction of information systems at a global level. This has provided significant new possibilities for advancing knowledge and societal interactions across the spectrum of human endeavors, including fundamental scientific research, education, engineering design and manufacturing, environmental systems, health care, business, entertainment, and government operations. As a result, our society has already become intrinsically dependent on IT. In fact, networked information systems have been recognized as one of the basic critical infrastructures of society. A consequence of the increasing dependence on networked information systems has been the significantly heightened concerns regarding their security and dependability. In particular, the interconnections, interactions, and dependencies among networked information systems and other critical infrastructure systems (e.g., electric power grids) can dramatically magnify the consequence of damages resulting from even simple security violations and/or faults. Hence, there is an urgent need to ensure that we have in place a solid foundation to help us justify the trust that we place on these information technologies and infrastructures.
Research and development activities focused on ensuring that a networked information system (a) functions correctly in various operational environments, and (b) provides the protection of critical information and resources associated with them, have been pursued within both the security and dependability communities. Although the security and dependability communities appear to focus on significantly overlapping concerns (e.g., availability), the efforts to converge their approaches and accumulated knowledge to generate innovative solutions have not been forthcoming or has been very slow at best. At the same time, the threats to the emerging networks and infrastructures, as well as the sophistication level of automated attack tools and malicious agents to easily inflict serious damages, are growing rapidly. It is a common belief now that ensuring absolute security is an unachievable practical goal. Hence, a growing concern is that of ensuring that networks and systems provide an assured level of functionalities even in the presence of disruptive events that attempt to violate their security and dependability goals. The capability of a system has been described by various terms, such as, survivability, resilience, disruption tolerance, and so on. A plethora of solutions has also been generated within these communities to address their respective, albeit overlapping, concerns related to increasing the trustworthiness of the overall system. We believe that efforts should be directed toward exploiting the synergies that exist among various piecemeal solutions from both security and dependability areas to seek out integrated, holistic solutions that allow us to provide assurances about the trustworthiness of the networks and systems that we use. It is worth noting that similar sentiments have recently been expressed in the research community.
We have conceived of this book as an effort toward the key goal of exploring the issues related to the integration of and interaction between approaches, models, architectures, and so on, prevalent in the security and dependability areas. In particular, we view information assurance (IA) as a growing area that can form an umbrella to bring together the efforts in security and dependability areas, mainly because their primary goal is to provide an adequate level of assurance that the networked information systems and infrastructures can be relied upon and trusted. Furthermore, the interaction between dependability and security is only beginning to be addressed in the research literature but is a crucial topic for successfully building IA into IT systems. @47414
To the best of our knowledge, there is currently no comprehensive book that focuses on such an integrated view of IA. This book is an initial attempt to fill this gap. The goal of this book is to present a sample of the state-of-the- art survey of dependability and security techniques followed by an in-depth look at how these two components interact in providing IA and what the challenges are for the assurance of emerging systems. Our hope here is that by bringing both areas together, we will make a start toward integrating the approaches.
Information assurance: Dependability and security of networked information systems
As mentioned earlier, we view IA as encompassing both dependability and security areas. In this section, we briefly introduce key terminologies from these areas and present our view on the need for such an integrated view.
Information or computer security primarily focuses on the issues related to confidentiality, integrity, and availability (CIA) of information. Confidentiality refers to ensuring that highly sensitive information remains unknown to certain users. Integrity refers to the authenticity of information or its source. Availability refers to ensuring that information or computer resources are available to authorized users in a timely manner. Other key security issues often added include accountability, non-repudiation, and security assurance. Accountability ensures that an entity's action is traceable uniquely to that entity; non-repudiation refers to ensuring that an entity cannot deny its actions; and security assurance refers to the confidence that the security requirements are met by an information system. Policy models, mechanisms, and architectural solutions have been extensively investigated by the security community to address issues related to specification and enforcement of the security requirements of networked information systems. In addition to proactive, preventive techniques, reactive techniques that involve detection followed by response and recovery continue to be developed to address the overall protection issues. Cryptographic techniques are widely used as mechanisms to achieve the above mentioned security goals.
The dependability area, on the other hand, has primarily focused on how to quantitatively express the ability of a system to provide its specified services in the presence of failures, through the measures of reliability, availability, safety, and performability. Reliability refers to the probability that a system provides its service throughout the specified period of time. Availability, a key goal of security also, more specifically refers to the fraction of time that a system can be used for its intended purpose within a specified period of time. Safety refers to the probability that a system does not fail in such a way as to cause a major damage. Performability quantitatively measures the performance level of a system in the presence of failures. An important observation that can be made here is that of the richness of the quantitative techniques within the dependability area in contrast to the scarcity of such techniques in the security area. One reason for this is the difficulty in applying quantitative techniques for confidentiality and integrity issues, as well as the cryptographic techniques. Confidentiality and integrity issues were the primary security concerns for the security community for a considerable period of time and several "formal" approaches focused on these were developed to address the issues of verification and qualitative validation of security properties. Interestingly, both confidentiality and integrity issues are also sometimes considered as relevant dependability goals.
A related notion that attempts to capture both the security and dependability concerns is that of survivability. Survivability has been defined in various ways by different researchers and no consensus yet exists on its standard definition. One way to define survivability is as the capability of a system to fulfill its mission, in a timely manner, in presence of attacks, failures, or accidents. A key goal here is to provide a quantitative basis for indicating that a system meets its security and dependability goals. A key motivation towards this direction is provided by the fact that absolute security is an unachievable goal, as indicated by the undecidability of the safety problem related to security shown by Harrison, Ruzzo, and Ullman in their seminal paper. It is also virtually impossible to completely identify all the vulnerabilities in a networked information environment that is characterized by ever increasing heterogeneity of its components. In the face of such an insurmountable challenge, a key alternative is to set provisioning of an acceptable level of services in presence of disruptive events as a practical goal; in other words, a more realistic goal is that of ensuring a desired level of assurance that the required security and dependability goals are met by a system throughout its life cycle.
While there is an urgent need for solutions that integrate dependability and security, the two communities have largely remained separated, although efforts can be seen towards desirable interactions between them. A simple and often cited difference between the two areas is that dependability focuses primarily on faults and errors in the systems that are typically non-malicious in nature (primarily from the fault tolerance design area), while security focuses mainly on protection against malicious attempts to violate the security goals. However, such a difference is not accurate and can be seen in the various taxonomies developed within each community. For instance, the taxonomies for security vulnerabilities developed by Landwehr et al. and later by Avizienis et al. incorporate both intentional and unintentional sources of security vulnerabilities. The growing realization of the overlapping nature of the two areas can be seen among researchers in their efforts towards cross-pollinating the two areas in order to synthesize integrated frameworks.
This book first aims to highlight the overlapping aspect of the dependability and security areas
(Figure 1.1), an understanding which we believe is fundamental to exploiting the synergies within
the two communities. An integrated taxonomy that congregates the attributes of dependability and
security is an important goal and some efforts towards this direction can be seen (e.g., Chapter
6). A natural outcome of the overlapping concerns of the two areas is that of using the well
developed techniques in one area to address issues in the other or of synthesizing similar
techniques from the two areas to create more effective, integrated solutions. One such area of
cross-pollination can be seen in the use of fault-diagnosis techniques using fault trees in the
fault tolerance community that parallels the use of attack trees/graphs to characterize security
intrusions. Furthermore, correlating alerts and symptoms to more accurately identify the source of
a problem and/or its consequences are important diagnostic activities related to both dependability
and security. This commonality provides prospects for integrated diagnostic frameworks that can
capture disruption scenarios related to malicious activities or non-malicious events. Such
integrated fault and attack diagnosis and alert correlation approaches have already emerged as
active research foci. An important observation related to security is the non-predictability of
security threats and attacks; it makes modeling attackers significantly challenging. Furthermore,
as mentioned earlier, the security area currently lacks viable quantitative techniques. These
deficiencies add newer research
Figure 1.1 Information assurance: interaction between security and dependability.
challenges to generating integrated, holistic solutions to modeling, analysis, and evaluation of security and dependability of a networked information system to establish assurance of its quality (e.g., lack of vulnerability, or appropriate measures against possible threats) and eventually its trustworthiness. Sophisticated stochastic techniques, such as Markov models, which have been widely used for dependability analysis, are currently being adopted and extended to additionally address security issues as discussed in Chapter 7. Such quantitative techniques, as well as newer game-theory based approaches (e.g., Chapter 8), are also currently being pursued to address the challenges related to the coincident effect of all types of disruptive events. Furthermore, it is important to note that the security and dependability concerns related to different system or architectural layers/components, such as operating systems, applications, networks, wireless infrastructures, and so on, bring forth their unique challenges. In addition to developing solutions for these different types of IT environments, there is also a crucial need to synthesize these solutions to ensure the survivability of huge infrastructures against large scale cyber attacks, which could become a catastrophe for a society that now relies so much on the technology.
In summary, we characterize IA to encompass dependability and security concerns and emphasize that combined IA approaches that address security and dependability together is the needed direction because:
- Many threats to dependability and security are common or similar. Combined modeling of failures and security threats will help provide more accurate understanding of the underlying problems.
- There is a need for both qualitative and quantitative base when establishing the overall assurance that a system maintains a desired level of trustworthiness. Quantitative and qualitative techniques that are abundant in dependability and security areas, respectively, complement each other and will help create more effective IA solutions.
- In reality, all types of disruptive events (faults and attacks) may coexist within a single networked information system. Hence, all types of disruptive events should be modeled together so that any coincident effect of different disruptive events and their emergent characteristics can be more accurately understood.
- Different techniques developed within each area may be useful in the other area. For instance, design diversity and redundancy, which were typically employed in fault-tolerance community, have been beneficial for security. At the same time, a combined approach will avoid duplication of effort.
Continue reading this chapter by "downloading a free .pdf of "Information assurance: Dependability and security of networked information systems."
Read other excerpts from data management books in the Chapter Download Library.
This was first published in January 2008