Matching Items (2)
Description
With the growth of IT products and sophisticated software in various operating systems, I observe that security risks in systems are skyrocketing constantly. Consequently, Security Assessment is now considered as one of primary security mechanisms to measure assurance of systems since systems that are not compliant with security requirements may lead adversaries to access critical information by circumventing security practices. In order to ensure security, considerable efforts have been spent to develop security regulations by facilitating security best-practices. Applying shared security standards to the system is critical to understand vulnerabilities and prevent well-known threats from exploiting vulnerabilities. However, many end users tend to change configurations of their systems without paying attention to the security. Hence, it is not straightforward to protect systems from being changed by unconscious users in a timely manner. Detecting the installation of harmful applications is not sufficient since attackers may exploit risky software as well as commonly used software. In addition, checking the assurance of security configurations periodically is disadvantageous in terms of time and cost due to zero-day attacks and the timing attacks that can leverage the window between each security checks. Therefore, event-driven monitoring approach is critical to continuously assess security of a target system without ignoring a particular window between security checks and lessen the burden of exhausted task to inspect the entire configurations in the system. Furthermore, the system should be able to generate a vulnerability report for any change initiated by a user if such changes refer to the requirements in the standards and turn out to be vulnerable. Assessing various systems in distributed environments also requires to consistently applying standards to each environment. Such a uniformed consistent assessment is important because the way of assessment approach for detecting security vulnerabilities may vary across applications and operating systems. In this thesis, I introduce an automated event-driven security assessment framework to overcome and accommodate the aforementioned issues. I also discuss the implementation details that are based on the commercial-off-the-self technologies and testbed being established to evaluate approach. Besides, I describe evaluation results that demonstrate the effectiveness and practicality of the approaches.
ContributorsSeo, Jeong-Jin (Author) / Ahn, Gail-Joon (Thesis advisor) / Yau, Stephen S. (Committee member) / Lee, Joohyung (Committee member) / Arizona State University (Publisher)
Created2014
Description
Our goals in our project are to enable management of distributed systems from one central location, record system logs and audit system based on these logs, and to demonstrate feasibility of platform-independent management of distributed systems based on CIM schema. In order to achieve these goals, we will have to overcome research challenges such as identifying meaningful CIM classes and attributes that could help to achieve this goal, how to gather managed objects of these CIM classes to collect such attributes on a given platform, and to research whether a platform's implementation of CIM is complete or incomplete so as to decide which platform would be the best to implement our solution. Even if a platform's implementation of CIM is incomplete, would we be able to create our own solution to a missing attribute and perhaps provide our own extension of the implementation? One major practical accomplishment will include developing a tool to allow distributed systems management regardless of a target system's platform. However, our research accomplishments will include having found the CIM classes that would be advantageous for system management and determining which platform would be best to work with managed objects of these classes.
ContributorsTrang, Patrick D (Author) / Ahn, Gail-Joon (Thesis director) / Chen, Yinong (Committee member) / Wilson, Adrian (Committee member) / Barrett, The Honors College (Contributor) / Computer Science and Engineering Program (Contributor)
Created2013-05