Deception, both offensive and defensive, is a fundamental tactic in warfare and a well-studied topic in biology. Living organisms use a variety deception tools, including mimicry, camouflage, and nocturnality. Evolutionary biologists have published a variety of formal models for deception in nature. Deception in these models is fundamentally based on misclassification of signals between the entities of the system, represented as a tripartite relation between two signal senders, the "model" and the "mimic", and a signal receiver, called the "dupe". Examples of relations between entities include attraction, repulsion and expected advantage gained or lost from the interaction. Using this representation, a multitude of deception systems can be described. Some deception systems in cybersecurity are well-known. Consider, for example, all of the many different varieties of "honey-things" used to ensnare attackers. The study of deception in cybersecurity is limited compared to the richness found in biology. While multiple ontologies of deception in cyber-environments exist, these are primarily lists of terms without a greater organizing structure. This is both a lost opportunity and potentially quite dangerous: a lost opportunity because defenders may be missing useful defensive deception strategies; dangerous because defenders may be oblivious to ongoing attacks using previously unidentified types of offensive deception. In this paper, we extend deception models from biology to present a framework for identifying relations in the cyber-realm analogous to those found in nature. We show how modifications of these relations can create, enhance or on the contrary prevent deception. From these relations, we develop a framework of cyber-deception types, with examples, and a general model for cyber-deception. The signals used in cyber-systems, which are not directly tied to the "Natural" world, differ significantly from those utilized in biologic mimicry systems. However, similar concepts supporting identity exist and are discussed in brief.

The most effective approach to evaluating the security of complex systems is to deliberately construct the systems using security patterns specifically designed to make them evaluable. Just such an integrated set of security patterns was created decades ago based on the Reference Monitor abstraction. An associated systematic security engineering and evaluation methodology was codified as an engineering standard in the Trusted Computer System Evaluation Criteria (TCSEC). This paper explains how the TCSEC and its Trusted Network Interpretation (TNI) constitute a set of security patterns for large, complex and distributed systems and how those patterns have been repeatedly and successfully used to create and evaluate some of the most secure government and commercial systems ever developed.

Contemporary cloud environments are built on low-assurance components, so they cannot provide a high level of assurance about the isolation and protection of information. A "multi-level" secure cloud environment thus typically consists of multiple, isolated clouds, each of which handles data of only one security level. Not only are such environments duplicative and costly, data "sharing" must be implemented by massive, wasteful copying of data from low-level domains to high-level domains. The requirements for certifiable, scalable, multi-level cloud security are threefold: 1) To have trusted, high-assurance components available for use in creating a multi-level secure cloud environment; 2) To design a cloud architecture that efficiently uses the high-assurance components in a scalable way, and 3) To compose the secure components within the scalable architecture while still verifiably maintaining the system security properties. This paper introduces a trusted, high-assurance file server and architecture that satisfies all three requirements. The file server is built on mature technology that was previously certified and deployed across domains from TS/SCI to Unclassified and that supports high-performance, low-to-high and high-to-low file sharing with verifiable security.

Although one senior security professional has emphasized that “it is unconscionable to use overly weak components” in a multilevel security (MLS) context, the majority of current transfer guards do exactly that. Basic guard technology is well-developed and has a long history, but most guards are built on low-assurance systems vulnerable to software subversion, and the lack of assurance limits the range of transfers. This paper describes a virtual guard architecture that leverages mature MLS technology previously certified and deployed across domains from TS/SCI to Unclassified. The architecture permits a single guard system to simultaneously and securely support many different transfer functions between many different domain pairs. Not only does this architecture substantially address software subversion, support adaptable information transfer policies, and have the potential to dramatically reduce (re)certification effort, the virtualized guard execution environment also promises to significantly enhance efficient and scalable use of resources.

research-article Using a high assurance TCB for infrastructure security Share on Authors: Mark Heckman View Profile , Roger Schell View Profile , Edwards Reed View Profile Authors Info & Claims CSIIRW '11: Proceedings of the Seventh Annual Workshop on Cyber Security and Information Intelligence ResearchOctober 2011 Article No.: 55Pages 1https://doi.org/10.1145/2179298.2179359Online:12 October 2011Publication History 2citation190DownloadsMetricsTotal Citations2Total Downloads190Last 12 Months2Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

U.S. Government agencies and major vendors are acti vely attempting to secure critical infrastructure networ ks, but those efforts depend on patching unsecure, commodit y systems, installing add-on security appliances, and applying other industry “best practices” that are ineffective against new attacks and software subver sion. This has unfortunately led to the conclusion that i t is impossible to secure critical infrastructure networ ks and even that a completely new, “alternative” Internet is needed. These conclusions disregard known and prove n techniques for building secure, high-assurance, tru sted systems – techniques developed as a result of years of research and engineering experience and systematica lly codified in the Trusted Computer System Evaluation Criteria (TCSEC) and related documents. Those techniques have not since been improved upon or adequately replaced, not even by the more recent Common Criteria for Information Technology Security Evaluation. In this paper, we sketch how the truste d systems technology codified in the TCSEC can be app lied today to create a secure infrastructure network.

Signature-based network intrusion-detection systems (NIDSs) often report a massive number of simple alerts of low-level security-related events. Many of these alerts are logically involved in a single multi-stage intrusion incident and a security officer often wants to analyze the complete incident instead of each individual simple alert. This paper proposes a well-structured model that abstracts the logical relation between the alerts in order to support automatic correlation of those alerts involved in the same intrusion. The basic building block of the model is a logical formula called a capability . We use capability to abstract consistently and precisely all levels of accesses obtained by the attacker in each step of a multistage intrusion. We then derive inference rules to define logical relations between different capabilities. Based on the model and the inference rules, we have developed several novel alert correlation algorithms and implemented a prototype alert correlator. The experimental results of the correlator using several intrusion datasets demonstrate that the approach is effective in both alert fusion and alert correlation and has the ability to correlate alerts of complex multistage intrusions. In several instances, the alert correlator successfully correlated more than two thousand Snort alerts involved in massive scanning incidents. It also helped us find two multistage intrusions that were missed in auditing by the security officers.

: The goal of any intrusion detection, anti-virus, firewall or other security mechanism is not simply to stop attacks, but to protect a computing resource so that the resource can continue to perform its function. A computing resource, however, is only a component of a larger system and mission. Sometimes, the efforts made to stop an attack on a resource may be as bad as the attack itself in terms of affecting the overall ability of the system to complete its mission. What is needed is a method of choosing responses to attacks on components that still allows the system to achieve its goals. We present a model of computing resources and of how the loss or degradation of resources impacts the ability of a system to complete its mission. A human or robot analyst can use the model to assess the security status of a monitored system and to allocate resources in an optimal way.

This paper presents a technique for the verificationof "full" distributed computing systems, building onthe CLI stack which addresses verification of a layered sequential system. This paper also presents the application of our technique to the verification of adistributed system of three layers: a small high-leveldistributed programming language (microSR); a multiple processor architecture consisting of an instruction set and system calls; and a network interface.MicroSR programs are implemented by a compilerfrom microSR to the multiprocessor layer. Systemcalls (for interprocess message passing) are implemented by network services. This work demonstratesthat the correctness of a distributed program, mostnotably its interprocess communication, is verifiablethrough layers that guarantee the correctness of thecompiled code that makes reference to operating system calls, of the operating system calls in terms ofnetwork calls, and of the network calls in terms ofnetwork transmission steps. The Cambridge HOLsystem is used for the specification and the proofs.

: This paper presents research towards the formal specification and verification of a secure distributed system and secure application programs that run on it. We refer to the whole system from hardware to application programs written in a concurrent programming language as the Silo and to a simplified view of the Silo as the minisilo. Both minisilo and Silo consist of a collection of microprocessors interconnected by a network a distributed operating, system and a compiler for a distributed programming language. Our goal is to verify the full Silo by mechanized layered formal proof using the higher order logic theorem proving system HOL. This paper describes our current results for verifying the minisilo and our incremental approach for evolving the verification of the minisilo into the verification of the full Silo. Scalability is addressed in part - extending, the distributed operating, system with additional server which in turn provide services that extend the programming language.

The Royal Signals and Radar Establishment (RSRE) and members of the Hardware Verification Group at Cambridge University conducted a joint effort to prove the correspondence between the electronic block model and the top level specification of Viper. Unfortunately, the proof became too complex and unmanageable within the given time and funding constraints, and is thus incomplete as of the date of this report. This report describes an independent attempt to use the HOL (Cambridge Higher Order Logic) mechanical verifier to verify Viper. Deriving from recent results in hardware verification research at UC Davis, the approach has been to redesign the electronic block model to make it microcoded and to structure the proof in a series of decreasingly abstract interpreter levels, the lowest being the electronic block level. The highest level is the RSRE Viper instruction set. Owing to the new approach and some results on the proof of generic interpreters as applied to simple microprocessors, this attempt required an effort approximately an order of magnitude less than the previous one.

We describe our approach to multilevel database security and show that we can support element-level labeling in a Class A1 database system without the need to verify the entire database system, or even most of it. We achieve both the high degree of assurance required for Class A1 and the flexibility of element-level labeling by layering the TCB, where the lowest TCB layer is a reference monitor enforcing mandatory security; and by decomposing multilevel relations into single-level relations that are managed by the reference monitor. This decomposition means that multilevel relations are actually views over single-level base relations, which suggests that our multilevel relational system could be implemented on a standard (untrusted) relational system running on a reference monitor.

The SeaView formal security policy model admits a range of designs for a multilevel secure relational database system. The requirement for a near-term implementation suggests that the design should utilize existing technology to the extent possible. Thus the design uses an existing database management system ported to an existing TCB (trusted computing base) environment. A preprocessor translates key constructs of the SeaView multilevel relational data model to those of the standard relational model used by the commercial database system. The underlying reference monitor enforces mandatory and basic discretionary controls with A1 assurance. By combining single-level data into a multilevel view, it is possible to use a commercial database system and classify data at the relation level to implement the SeaView model, with element-level classification.<>

A multilevel relational data model that meets the basic operational requirements for a multilevel database system is described. The model is an extension of the standard relational model, and consists of multilevel relations, which contain classification attributes as well as data attributes; multilevel relational integrity rules, which extend the integrity constraints of the relational model in order to pro vide consistency for data at different access classes, including data that becomes "polyinstantiated," a decomposition method for mapping all multilevel real relations into standard (single-level) base relations; and multilevel relational operators, which perform the functions of their counterparts in the standard relational model, while also labeling derived tuples with access classes. The model is defined in terms of the standard relational model, but lends itself to a design and implementation that offers a high level of assurance for mandatory security.