How to Repair Compromised Information Systems Quickly ?

Despite decades of research on computer security, there are no such things as un-breakable systems. Social engineering is one class of techniques that exploit human weaknesses to gain unauthorized accesses to technically secure systems. Insider threats are another class of attacks that are almost impossible to defeat in real time with absolute certainty. At the same time, according to Gartner Group’s estimate, on the average more than 70% of the cost associated with a computer security breach is attributed to the productivity/revenue loss due to data loss or service disruption, and/or additional workloads imposed on the IT staff to repair the damage that the intruders leave behind. The facts that it is impossible to seal all conceivable security holes and that the real loss due to a system break-in arises from data/service unavailability, argue strongly for an intrusion-tolerance approach to secure system design. Economically, the total cost of ownership (TCO) of an information system is widely believed to be 5 to 10 times the initial acquisition cost of the associated hardware and software, and about one third to one half of the TCO is related to recovering from or preparing for system failures [9, 7]. Therefore, being able to effectively facilitate the process of “preparing for and recovering from failures” could also result in a significant reduction in the TCO. From an information system user’s standpoint, computer security breach has the same effects as system failures, and therefore the ultimate goal of computer security system design should be the same as that of faulttolerant system design: maximizing system availability. In particular, because the financial penalty of a security breach is strongly tied with the degree of availability of the victim system, maximizing system availability directly minimizes the resulting loss. In the context of computer security, the availability metric is defined as , where MTTB refers to mean time between breaches and MTTR refers to mean time to repair. As in fault-tolerant systems, pushing the MTTB beyond a certain level may become exponentially more expensive for every fixed increment of improvement. e.g., from 0.9999 to 0.99999. Therefore the most cost-effective approach to highly available system design in the presence of malicious attacks may well be a combination of MTTB maximization and MTTR minimization. Whereas most past computer security research concentrated on the design of better protection mechanisms to detect or prevent intrusion, it’s time to accept that computer systems cannot be absolutely impenetrable, and to shift at least some of the research focus to the development of system design techniques that can minimize the cost of computer security breach by facilitating postintrusion system clean-up and restoration. Even absent malicious attacks, humans make mistakes, which in turn lead to data damages or service outages. In a recent study [9], an analysis on PSTN and Internet sites’ operational statistics shows consistently that operator errors are the leading cause of system failures, as compared with software/hardware faults or input overloads. Because the system damage caused by an error is indistinguishable from that by an intrusion, for the rest of this proposal we will mainly focus on intrusion damage and its repair.