# PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation
###### Abstract  
Small and medium enterprises are significantly hampered by cyber-threats as they have inherently limited skills and financial capacities to anticipate, prevent, and handle security incidents. The EU-funded PALANTIR project aims at facilitating the outsourcing of the security supervision to external providers to relieve SMEs/MEs from this burden. However, good practices for the operation of SME/ME assets involve avoiding their exposure to external parties, which requires a tightly defined and timely enforced security policy when resources span across the cloud continuum and need interactions. This paper proposes an innovative architecture extending Network Function Virtualisation to externalise and automate threat mitigation and remediation in cloud, edge, and on-premises environments. Our contributions include an ontology for the decision-making process, a Fault-and-Breach-Management-based remediation policy model, a framework conducting remediation actions, and a set of deployment models adapted to the constraints of cloud, edge, and on-premises environment(s). Finally, we also detail an implementation prototype of the framework serving as evaluation material. Security-as-a-Service; security orchestration; policy-driven management; virtual network functions; finite state machines; constraints programming +
Footnote †: journal: Sensors  
0000-0001-589-7000-0000-0000-0000-0000-0000-0000-0000-0000-0000-0000-00  
In addition to the restricted budget availability, this trend is even more worrying for SMEs when considering that more than half of data breaches impacted SMEs in 2021 [4] and, furthermore, that the prevalent size of such organisations can be reduced to just a few employees (less than the aforementioned average of 25 in the US), depending on the country's economic dynamics. In this sense, small and microsized enterprises have the losing hand due to their scarce resources and funds, which directly translates to a lack of availability of security expertise, and sometimes even in networking and IT itself. Without adequate knowledge, such businesses can barely implement best practices to reduce the chance of attacks, are not likely to monitor their infrastructure for anomalous behaviour, and will not have the means to identify active threats and decide the best mitigation actions. In the end, smaller businesses can only rely on external outsourcing of security to secure their software and to make up for the missing knowledge and techniques while keeping cost at bay. A possible option to reduce costs related to security outsourcing is to virtualise and automate the typical security life cycle, consisting of (i) continued monitoring to detect anomalies; (ii) the extraction of threat intelligence to determine the attack vector and behaviour; and (iii) the selection of the best measure to apply (security enabler and configuration) during the incident response. Cloud-related technologies, architectures, and standards are key enablers to achieve the aforementioned results, provided they are supported by adequate deployment models to access resources needing protection. For instance, the Network Functions Virtualisation (NFV) architecture is a good candidate to provide the substrate for the virtualisation of the security services and its automated deployment. The NFV technology encompasses different standards that lay out the principles to adequately manage the network and provision the network services on top of it. Different families of standards compose NFV, such as Interfaces and Architecture (NFV IFA), Management and Orchestration (NFV MANO), or Security (NFV SEC). This architecture usually goes hand-in-hand in the literature with the Software-Defined Networking (SDN) paradigm, as both are complementary to realise the latest advances in networks such as 5G [5], Beyond 5G (BG5), and, predictably, also 6G. The EU-funded PALANTIR project [6] is an innovation action from the European commission that targets the facilitation of the management of cyber risks and incidents by small and medium enterprises.