NDLI: A property based security risk analysis through weighted simulation

Content Provider	IEEE Xplore Digital Library
Author	Winkelvos, T. Rudolph, C. Repp, J.
Copyright Year	2011
Description	Author affiliation: Fraunhofer Institute for Secure Information Technology, SIT, Rheinstraße 75, 64295 Darmstadt, Germany (Winkelvos, T.; Rudolph, C.; Repp, J.)
Abstract	The estimation of security risks in complex information and communication technology systems is an essential part of risk management processes. A proper computation of risks requires a good knowledge about the probability distributions of different upcoming events or behaviours. Usually, technical risk assessment in Information Technology (IT) systems is concerned with threats to specific assets. However, for many scenarios it can be useful to consider the risk of the violation of particular security properties. The set of suitable qualities comprises authenticity of messages or non-repudiability of actions within the system but also more general security properties like confidentiality of data. Furthermore, as current automatic security analysis tools are mostly confined to a technical point of view and thereby missing implications on an application or process level, it is of value to facilitate a broader view including the relation between actions within the IT system and their external influence. The property based approach aims to help assessing risks in a process-oriented or service level view of a system and also to derive a more detailed estimation on a technical level. Moreover, as systems' complexities are growing, it becomes less feasible to calculate the probability of all patterns of a system's behaviour. Thus, a model based simulation of the system is advantageous in combination with a focus on precisely defined security properties. This paper introduces the first results supporting a simulation based risk analysis tool that enables a security property oriented view of risk. The developed tool is based on an existing formal validation, verification and simulation tool, the Simple Homomorphism Verification Tool (SHVT). The new simulation software provides a graphical interface for a monitor automaton which facilitates the explicit definition of security properties to be investigated during the simulation cycles. Furthermore, in order to model different likelihoods of actions in a system, weighting factors can be used to sway the behaviour where the occurrence of events is not evenly distributed. These factors provide a scheme for weighting classes of transitions. Therefore, the tool facilitates probabilistic simulation, providing information about the probability distribution of satisfaction or violation of specified properties.
Starting Page	1
Ending Page	8
File Size	243319
Page Count	8
File Format	PDF
ISBN	9781457714818
e-ISBN	9781457714832
DOI	10.1109/ISSA.2011.6027534
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-08-15
Publisher Place	South Africa
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Analytical models Security Properties Computational modeling Risk Assessment Simulation Automata Security Analyisis Models Security Risk management Monitoring
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in