How Secure Is Your Network? NIST Model Knows

(PhysOrg.com) -- Data breaches are a recurring nightmare for IT managers responsible for securing not only their company’s confidential data, but possibly also sensitive information belonging to their clients, such as social security numbers or health or financial records. To help managers safeguard valuable information most efficiently, computer scientists at the National Institute of Standards and Technology are applying security metrics to computer network pathways to assign a probable risk of attack to guide IT managers in securing their networks.

“We analyze all of the paths that system attackers could penetrate through a network,” says computer scientist Anoop Singhal, “and assign a risk to each component of the system. Decision makers can use our assigned probabilities to make wise decisions and investments to safeguard their network.” The research was presented at a conference earlier this month.

Computer networks are made up of components varying from individual computers, to servers and routers. Once inside a network’s firewall, for a seemingly mild-mannered purpose as posting an image to a file transfer protocol (FTP) site, a hacker can travel through the network through a variety of routes to hit the jackpot of valuable data. In addition to hardware, the hacker can break in through software on the computers, especially file-sharing applications that have been blamed for some major data breaches recently.

NIST researchers evaluate each route and assign it a risk based on how challenging it is to the hacker. The paths are determined using a technique called “attack graphs.” A new analysis technique based on attack graphs was jointly developed by Singhal and research colleagues at George Mason University. A patent is pending on the technique.

Singhal and his team determine risk by using these attack graphs and NIST’s National Vulnerability Database (NVD). This government repository includes a collection of security-related software weaknesses that hackers can exploit. NVD data was collected from software vendors and scores are assigned from most to least insecure by experts.

For example in a simple system there is an attacker on a computer, a firewall, router, an FTP server and a database server. The goal for the attacker is to find the simplest path into the jackpot—the database server. Attack Graph Analysis determines three potential attack paths. For each path in the graph, the NIST researchers assign an attack probability based on the score in the NVD database.

Because it takes multiple steps to reach the goal, the probabilities of each component are multiplied to determine the overall risk. One path takes only three steps. The first step has an 80 percent chance of being hacked, the second, a 90 percent chance. The final step requires great expertise, so there is only a 10 percent probability it can be breached. By multiplying the three probabilities together, that path is pretty secure with a less than 10 percent chance of being hacked.

The next step is for the researchers to expand their research to handle large-scale enterprise networks.

Citation: L. Wang, T. Islam, T. Long, A. Singhal and S. Jajodia. An Attack Graph Based Probabilistic Security Metric. IFIP WG 11.3 Conference on Data and Application Security, London, United Kingdom.

Provided by NIST

Related stories:

Computer hardware 'guardians' protect users from undiscovered bugs
As computer processor chips grow faster and more complex, they are likely to make it to market with more design bugs. But that may be OK, according to University of Michigan researchers who have devised a system that lets chips work around all functional bugs, even those that haven't been detected.
Computer hardware 'guardians' protect users from undiscovered bugs
(PhysOrg.com) -- As computer processor chips grow faster and more complex, they are likely to make it to market with more design bugs. But that may be OK, according to University of Michigan researchers who have devised a system that lets chips work around all functional bugs, even those that haven't been detected.
System thwarts Internet eavesdropping
The growth of shared Wi-Fi and other wireless computer networks has increased the risk of eavesdropping on Internet communications, but researchers at Carnegie Mellon University's School of Computer Science and College of Engineering have devised a low-cost system that can thwart these "Man-in-the-Middle" (MitM) attacks.
Security from chaos
There’s safety (and security) in numbers … especially when those numbers are random. That’s the lesson learned from a DHS-sponsored research project out of the University of Southern California (USC). The research is already helping to beef up security at LAX airport in Los Angeles, and it could soon be used across the country to predict and minimize risk.
Does raising the terrorism alert level cause undue stress?
The U.S. Department of Homeland Security’s color-coded system for warning the public of the risk of a terrorist attack does not appear to cause undue stress among law enforcement officers, according to a study by researchers at the Johns Hopkins Bloomberg School of Public Health and the University of Medicine and Dentistry of New Jersey.
Rich terrorist, poor terrorist
New research suggests political freedom and geographic factors contribute significantly to causes of terrorism, challenging the common view that terrorism is rooted in poverty.
Peace paradox and air terror
Peace agreements, stability and regional prosperity, in an interesting paradox, increase the risk of air terror in Israel, according to new research conducted by Lieutenant Colonel Ron Tuegeman under the supervision of Prof. Arnon Sofer of the University of Haifa.
Researchers create next-generation software to identify complex cyber network attacks
Researchers in George Mason University’s Center for Secure Information Systems have developed new software that can reduce the impact of cyber attacks by identifying the possible vulnerability paths through an organization’s networks.

News discussion:

Technology news