-Several vulnerability databases and standards are currently available for assessing the degree of security of IT infrastructures in general. These standards focus on different aspects of the systems, while generally failing to provide support for holistic analyses - a key aspect in ensuring a secure IT infrastructure. This work aims to address this gap by presenting a new methodology for evaluating the overall security risks of a networked system that adopts an ontology-based approach we presented in previous work. We leverage current security standards and databases, while also considering the human factors to build a broader and interconnected view. Our methodology is meant to achieve a more realistic picture of the network security, hence improving situation awareness for its administrators. To illustrate our approach, this paper brings a case study applying the new methodology to a few target networks. The proof of concept is meant to underscore the methodology's effectiveness in assessing the security of the whole network.
I. INTRODUCTION
Cyber security assessment has a importance role in a modern society. has become more interconnected through computer systems and networks. It is well-established that cyber threats can cause on corporations severe economic losses and damages to their reputation [1]. As a result, investments on cyber security has been growing significantly, even during market crises [2].
A basic standard for cyber security assessment is the Common Vulnerabilities and Exposures (CVE), which is the de facto standard to report and communicate software vulnerabilities between organizations and entities. Currently, the CVE has been standardized by the Telecommunication Standardization Sector of the International Telecommunication Union (ITUT) [3] and is being heavily used by automatic security assessment tools (e.g., Nessus and OpenVAS) to identify software vulnerabilities on target hosts.
On top of CVE, another standard was established to score the vulnerabilities with respect to their severity, impact and exploitation capacity. This standard is called Common Vulnerability Scoring System (CVSS). One of the most important CVSS databases is hosted and managed by the National Vulnerability Database (NVD), which provides the scores for most known vulnerabilities.
Although those standards are very efficient in cataloging and prioritizing software vulnerabilities, system administrators are usually interested in knowing how vulnerable is their entire network, no only individual hosts.
For instance, if a web server is highly protected against external threats, but vulnerable hosts in the same local area network have open access to the server, this condition should impact the overall score of the system. In addition, users can also be considered vulnerabilities of the system, as they could be deceived (or “exploited”) somehow to execute malicious software. Then, security unaware or careless users should also impact the overall score of the system.
In this work we propose to analyze those aspects (CVE, CVSS and human factors) in a unified manner for a target network, where vulnerabilities scores are propagated through the network’s trusted relationships (intentional or not). This way, we provide an overall security metric that can be used to classify entire networks.
This work is organized as follows: Sec. II briefly details the main attributes of CVE and CVSS; Sec. III presents the proposed metric; and Sec. IV concludes with final remarks.
The Common Vulnerabilities and Exposures (CVE) is a standard for cataloging vulnerabilities of computer systems. It consists of a list of information of security vulnerabilities and exposures, mainly reported by the community, aiming to provide common names for publicly known problems. It allows to share data about vulnerability capabilities (tools, repositories, and services).
The main attributes of a CVE are: • CVE identifier number (i.e., CVE-1999-0067); • Vulnerability type: buffer overflow, cross site request forgery (CSRF), cross site scripting (XSS), directory traversal, incorrect access control, insecure permissions, integer overflow, missing SSL certificate validation, SQL injection, XML external entity (XXE), and others or unknown; • Vendor of the product(s); • List of vulnerable products and versions; • Attack type: context-dependent, local, physical, remote, other; • Impact: code execution, denial of service, escalation of privileges, information disclosure, other.
Currently, the MITRE Corporation is responsible for managing CVE identifiers generation and publication through its web site [4]. In addition, MITRE also delegates this attribution to its several CVE numbering authorities (CNAs).
Usually, the CVSS is represented as a vector string, a
compressed textual representation of the values used to derive
the score. String (
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
(
The equations adopted to calculate the CVSS base score are provided in Sec. III.
Human factors play an important role in the security of an organization, since users are used as both targets and vectors of attacks. Several social engineering methods can be employed to obtain key information and select the most vulnerable employees.
In this work we propose to model the users’ “vulnerabilities” as a CVSS-like metric. In other words, the users would also be rated by the impact and exploitability subscores. As an example, users with high privileges in the network would have a high impact factor, because if they get “compromised” that would grant intruders deeper access to the network.
On the other hand, users unaware of security issues or careless about it can be considered highly “exploitable”, that is, they can be easily deceived to execute malicious software on their computers. There are numerous methods to do so, such as telephone calls from fake IT staff, phishing campaigns, malicious websites, etc.
To prevent such situations, the staff should perform security awareness training. Besides, the corporation should have a solid information security policy and all means should be employed to enforce it.
The Common Vulnerability Scoring System (CVSS) is an open framework for describing specific characteristics of software vulnerabilities. It consists of three metric groups: III. THE PROPOSED METRIC base, temporal, and environmental. System administrators usually focus heavily in protecting
The base group represents the intrinsic qualities of a vul- their networks against external cyber attacks. For this reason, nerability, the temporal group reflects the characteristics of a the insider threats might receive insufficient attention and, vulnerability that changes over time, and the environmental consequently, the security can be impacted. Considering that group represents characteristics of a vulnerability that are every host connected to the Internet is a potential attack vector unique to the user’s environment. through phishing campaigns (someone trying to convince the
In this work, we focus on the base metric, which produces user to execute the malicious code) and applications vulneraa score ranging from 0.0 to 10.0. It is composed by the impact bilities (browsers, e-mail and document readers), and that the subscore (ranging from 0 to 6) and the exploitability subscore protection against known hosts is reduced, then a single host (ranging from 0 to 4). However, the overall CVSS score of can severely compromise the security of the entire network. a single vulnerability is also impacted by the temporal and The proposed metric in this work is obtained by a fiveenvironmental metrics. Readers are encouraged to refer to [5] step approach, each one being required for computing the for more information on CVSS specifications and formulas. overall security of a given network. The technique involves The main attributes of CVSS base score are: building a graph representing the overall network as well as • Attack vector (AV): network (N), adjacent network (A), the relationship between each step. The relative importance local (L), and physical (P); of each step is assessed using multi-criteria decision analysis • Attack complexity (AC): low (L), high (H); concepts. • Privileges required (PR): none (N), low (L), high (H); There are different approaches for building such graph • User interaction (UI): none (N), required (R); and defining the metric. However, the specific aspects of the • Scope (S): unchanged (U), changed (C); cyber security domain involving different perspectives (e.g. • Confidentiality impact (C): none (N), Low (L), high (H); technical, human factor, standards, etc.) naturally led us to • Integrity impact (I): none (N), Low (L), high (H); reuse/adopt the ontology-based approach previously presented • Availability impact (A): none (N), Low (L), high (H); in [6]. The general idea is to use semantic techniques in supporting the definition of the target mission, its support task, as well as the services and network configuration required to accomplish a mission. As in the aforementioned previous version, in this work we use the DoDAF Conceptual Data Model to represent the concepts involved in the mission.
The difference, however, is that in this work we extend this approach by incorporating time and event descriptions [7].
The ontology is presented in Figure 2, which conveys the queries that can be performed in cyber-situation awareness: WHAT (Activity), WHY (Goal and Desire Effect), HOW (Resource and Guidance), WHO (Performer), WHERE (Location), and WHEN (Timestamp and Event).
1) Complete inventory: The first step consists in obtaining a complete and detailed asset inventory record of the target network, including hubs, switches, routers, software list, etc.
This is fundamental for every security approach and should not be a problem for security aware corporations.
2) Communications: The second step consists in mapping the communication between the assets (including the users).
If the network contains N assets, this can be mapped into a N ⇥ N matrix.
Taking Fig. 1 as example, we can derive its access matrix as presented in Table I, where the rows represent the asset with communication initiative, the columns represent the communication destination, and a cell filled with a ‘Y’ informs that such communication is allowed (or that there is nothing forbidding such communication).
To generate the aforementioned table, a SPARQL query is performed on the Mission Ontology. This greatly simplifies the otherwise complex task of discovering and mapping connections, in spite of these being hidden or not.
An alternative representation of Table I can be achieved through directed graphs, as depicted in Fig. 3. The main advantage of this approach is that it makes relatively easier to identify nodes with a higher impact higher to the overall security of the network. Also, it becomes possible to derive attack chains throughout the network.
On the sequence, the attack complexity (AC) parameter is
given by (
AC = (0.77, if AC = Low (L),
0.44, if AC = High (H).
PR = PR = 8> 0.85, if PR = None (N), <
0.62, if PR = Low (L), >: 0.27, if PR = High (H). 8> 0.85, if PR = None (N), <
0.68, if PR = Low (L), >: 0.50, if PR = High (H).
However, for modified scope (S:C), the following equation applies for PR:
Finally, the user interaction (UI) parameter can be given by (10):
For unmodified scope (S:U), the following equation applies
for the privileges required (PR) parameter:
(
0.62, if UI = Required (R).
impact sub score (↵ ) and exploitability sub score ( ), for every vulnerability found in previous steps we need to assemble a P matrix, where the first column (pi,1, 8 i) corresponds to the impact sub score (↵ ), and the second column (pj,2, 8 j) corresponds to the exploitability sub score ( ). Then, we need to append three additional points to this matrix such that its final version is according to (11):
the CVE IDs and CVSS base vector string for all N hosts of the network. There are many automated tools that can help in obtaining this information, such as the Nessus Vulnerability Scanner [8] and the Open Vulnerability Assessment System (OpenVAS) [9].
4) Calculating Scores: Once the vulnerabilities are obtained, for every CVSS string we need to compute the impact sub score ↵ and the exploitability sub score .
The impact sub score ↵ can be computed according to (
7.52 ⇥ [ISCBase >: 3.25 ⇥ [ISCBase if S = U, 0.029] 0.02]15 , if S = C where
ISCBase = 1
The attack vector (AV) parameter is given by (
. 6 6 P = 6666 pN0,1 64 max(p1,1, . . . , pN,1) 0 where the function max(· ) returns the maximum value of its arguments and N denotes the number of vulnerabilities found on previous steps.
Finally, we must compute the convex hull of the matrix P and its 2D area (considering the outmost vulnerabilities as vertices of the polygon), and divide resulting area by the highest possible CVSS subscores (6 ⇥ 4 = 24). Conducting the calculations this way ensures that the proposed metric is presented as percentage. The results are then used to rate the network security according the intervals presented on Table II.
Fig. 4 depicts an example of a fictitious network composed of three nodes. The overall vulnerability metrics has been appointed as 70.4476 %, which corresponds to the rating Highly Vulnerable, according to Table II. Every marker on this figure 4 3.5 1 0.5 0 0 3.5 4 3 Fig. 4: Vulnerability assessment using the proposed metric for a highly insecure network. corresponds to a CVSS metrics (impact and exploitability sub scores).
Likewise, Fig. 5 presents a second network with less severe individuals vulnerabilities throughout the nodes of the network. Notice that the overall vulnerability was 16.7402 %, which corresponds to the rating Low, according to Table II.
Host 1 Host 2 Host 3 Metric Host 1 Host 2 Host 3 Metric multiple-criteria analysis and modeling the human factor as CVSS v3 base scores. An example on a fictitious network was performed in order to demonstrate the practicality of the proposed metric. Further, the reuse of concepts previously defined in an existing ontology we had developed suggests that the approach can be generalized to encompass the diverse aspects that permeate the way different corporations are structured.
ACKNOWLEDGMENT
Ma´rcio Monteiro, Thalysson Sarmento and Alexandre Barreto would like to thank the financial support of the Brazilian agencies MCTI and FINEP (Ref. 04/2013/12). 3
Impact 1
IV. FINAL REMARKS
This work presented an ontology-based approach for analyzing the vulnerability of a network in a holistic way, using