Security Risk Analysis Based on the Policy Formalization and the Modeling of Big Systems

Security risk models have been successful in estimating the likelihood of attack for simple security threats. However, modeling complex system and their security risk is even a challenge. Many methods have been proposed to face this problem. Often difficult to manipulate, and not enough all-embracing they are not as famous as they should with administrators and deciders. We propose in this paper a new tool to model big systems on purpose. The software, takes into account attack threats and security strength. Keywords—Security, risk management, threat, modelization. I. NOTION OF SECURITY POLICY S ECURITY policy is a document that states in writing how the compagny plans to protect the compagny’s physical and information technology assets. This contains the set of laws, rules and practices to manage, protect and distribute sensitive information. Let see the main concept about modeling security policy. A. A security policy based on access control Most often, notably in the military domain, system security is based on the concept of information access. 1) Biba and Bell-LaPadula concept: Biba’s model and Bell-LaPadulla’s one[8], [1], [2], [5] is an access control model using Mandatory Access Control (MAC) which spreads the discretionary model of matrix access control. The main goal of this model is to express the multi-level security policy for confidentiality and integrity management. This control mechanism of information access cannot be broken. Now, the information is mobile and receives in a given time, diverse means of protection, more or less vulnerable. This information can be ciphered for privacy but its mechanism is potentially vulnerable and cannot be 100% trustable. We lose then the guarantee on the author of the message and the information becomes accessible to whomever. This model also relies on mechanisms which are under control. Unfortunately our systems are more and more complex and depend on third part systems which are potentially dangerous (bugs or backdoors), leading to a bad application of the access policy. 2) Or-Bac Model: The Model Or-Bac[3] allows to adapt rules according to the context and also takes into account the negative access control, allowing banning. This model, more complete, than the precedent one suffers nevertheless Luc CESSIEUX is working for the french Navy. He is the Security Officer at DIRISI Toulon, France, cessieux@hotmail.fr Adrien DEROCK is working in the information security department at DCNS, the french naval ship builder, Toulon, France, adrien.derock@dcnsgroup.com / He is also affiliated as researcher at ESIEA/IMATH laboratory, France with the same weaknesses statements than the model presented in the previous paragraph. And if we take into account the notion of negative access, this one is not however equal to the notion of possible illegal access. We talk about here, the faculty of an aggressor to have access, since nothing was specified and because this one has means (technical, human and organizational) allowing to by-pass the established security policy. B. Behavior conformity observation Vianney Darmaillacq and Nicolas Stouls[6] propose an interesting solution of approved communication formal modeling from a security policy. The main inconvenience of this methodology is its limitation and still does not take the security in its global nature. C. A security policy based on safety If the notion of safety exists since a long time[7], notably within the framework of the nuclear safety, it is necessary to admit that with the computerization of our environment, this one becomes very complex to model. It is also very delicate to apply this kind of model to predict environmental threats as earthquakes, floods or fires which can strike a blow at the system availability. D. Security policy based on information system analysis It is interesting to notice in the formalization of security policy that the notion of access right prevails[3] in analyses and proposed solutions, to the detriment of other elements of the security as the management of the quality of code or process of information circulation in its physical environment. We want to surround all the security problems and we want to be able to formalize a global security policy of an information system. It thus adorned us necessities to begin by modeling the information system in its global nature by taking into account either its logical than physical and human environment. Thus it is necessary to model at first the system before defining security policies and making the management of risk. II. EXHIBITION OF THE MODEL We consider an object O as a material or immaterial entity of the information system which is provided with a set of property. For example: a computer, a person, a premises, a policy, an information system or even more an information. It is also possible to categorize certain objects following two criteria defined below: World Academy of Science, Engineering and Technology International Journal of Computer and Systems Engineering Vol:3, No:6, 2009 1498 International Scholarly and Scientific Research & Innovation 3(6) 2009 ISNI:0000000091950263 O pe n Sc ie nc e In de x, C om pu te r an d Sy st em s E ng in ee ri ng V ol :3 , N o: 6, 2 00 9 pu bl ic at io ns . w as et . o rg /1 35 59 /p df Definition 1: The object O can be the composition of one or several objects. It is for example possible to consider an ”information system” object as the association of several computers in a premises, accompanied with inverters and with means of air conditioning in the premises. We designate with Ω all the objects On with n ∈ N with matching the definition above. Definition 2: the object O can be also considered as ”Essential” if it characterizes the security requirements of the other surrounding objects. For example, the confidentiality requirement of a server determines the requirement of ”capacity hosting” of the premises in which the server is set up. In that case object will be qualified as ”Essential by the person in charge of the model. A. Properties of an object An object O consists of a triplet (I, B, M) of a set of properties. These properties are cut in three big families: • The properties of identity and operating • The security properties. – With the properties of security requirements – The properties of threat Definition 3: Let be Oi = (I, B, M) with: • I all the properties of identity and operating • B all the properties of security requirements • M all the properties of threats And I = (I0,., Ix) a finished set with x ∈ N And B = (B0,., By) a finished set with y ∈ N And M = (M0,., Mz) a finished set with z ∈ N 1) The properties of identity and operating (PIO): Some of these properties are compulsory and necessary for the functioning of the posterior analysis. Other properties are free and in the just appreciation of the writer of the model. Whatever property we consider, it will always consist in couples of element: • A title; • A value. Let us take the example of a software object, it can have for instance as couple: • Manufacturer; • Microsoft. Definition 4: Let the couple Ik equal to (a, b) with a representing the identity and b the value. And I = (I0,., Ik,., In) a finished set with n, k ∈ N To simplify the notation we note the access in one PIO of an object thanks to the symbol ”. ”. We thus obtain the following symbolism: