InJung Kim

Design of an on-line intrusion forecast system with a weather forecasting model

Information protection for information systems is the major concern for most of the institutes, but there are a limited number of activities for the prevention of intrusion. Though each institute establishes and operates information protection solutions such as information security control systems, counter-measures against intrusions are generally applied only after intrusions have taken place in most cases. Delayed counter-measures lead to delays in damage recovery as well as failure of timely actions to mitigate the damages. In this paper, we propose the design of an online intrusion forecast system using a weather forecasting model, allowing administrators to minimize the effects of damages in advance through an online intrusion prediction of the probable vulnerability and risks. Both the information from the sensors of information security control systems and the profiles of the information system assets are used to analyze vulnerabilities and to predict intrusion routes and the scope of damages.

A time-variant risk analysis and damage estimation for large-scale network systems

Risk analysis for preventing network intrusions and attacks and estimation of damages resulting from intrusions and attacks are routine exercises for large-scale network systems. However, previous methodologies for risk analysis and network administration techniques for controlling system failures have been limited to the offering of safeguards based on identification of assets and resources at risks, potential threats and system vulnerabilities. They fail to provide exact estimations as to the effect of eliminating threats and vulnerabilities, which may be done through real-time analysis, or to assess the scope of damage, in the event of an attack, incurred until the final recovery. In this paper, we propose a time-variant risk analysis technique, which, based on previous risk analysis models for large-size networking systems and used in conjunction with the safeguards developed by these models, is able to identify real-time risk levels. Furthermore, to assess the scope of system damages resulting from a network intrusion, we propose a method for estimating the total cost incurred from the point of the occurrence of damage to that of recovery.

A method for detecting the exposure of OCSP responder's session private key in D-OCSP-KIS

D-OCSP-KIS proposed by Koga and Sakurai not only reduces the number of OCSP Responders certificate but also offers the certificate status validation about OCSP Responder to the client. Therefore, D-OCSP-KIS is an effective method that can reduce the communication cost, computational time and storage consumption in client, but it has some problems. In case an attacker accidentally acquires an OCSP Responders session private key in a time period (e.g., one day), she cannot derive any other OCSP Responders private key unless she obtains master private key. And she cannot derive the hash value of previous period because the hash value is impossible in inverse computation. But, the attacker can disguise as the OCSP Responder in the time period unless the OCSP Responder recognizes. She can offer the wrong response to the client using the hash value intercepted. And the server and user on E-commerce can have a serious confusion and damage. And the computation and releasing of hash chain can be a load to CA. Thus, we propose a method detecting immediately the exposure of OCSP Responders session private key and the abuse of hash value in D-OCSP-KIS. In our proposal, the hash value is only used one time for the status validation of OCSP Responders session private key and the load for computation of X-chain in CA is distributed to each OCSP Responder.

A probabilistic approach to estimate the damage propagation of cyber attacks

With rapid development in the Internet technology, business management in an organization becomes dependent on network dependency and cohesiveness in a critical information and communications infrastructure. However, the occurrence of cyber attacks has increased, targeted against vulnerable resources in information systems. Hence, in order to protect private information and computer resources, risk analysis and damage propagation need to be studied. However, the existing models present mechanisms for risk management, and these models can only be applied to specified threats such as a virus or a worm. Therefore, a probabilistic model for damage propagation based on Markov process is proposed, which can be applied to diverse threats in information systems. The proposed model enables us to predict the occurrence probability and occurrence frequency of each threat in the information systems.

Security risk vector for quantitative asset assessment

There are standard risk analysis methodologies like GMITS and ISO17799, but new threats and vulnerabilities appear day by day because the IT organizations, its infrastructure, and its environment are changing. Accordingly, the methodologies must evolve in step with the change. Risk analysis methods are generally composed of asset identification, vulnerability analysis, safeguard identification, risk mitigation, and safeguard implementation. As the first process, the asset identification is important because the target scope of risk analysis is defined. This paper proposes a new approach, security risk vector, for evaluating assets quantitatively. A case study is presented.

Changes of cyber-terrorism: autonomous terrors and counter-measures

Recently many autogenous terrors are occurred in many countries, and this kind of terrors are spread mostly through the Internet. Therefore, there should be regulations and tools to monitor suspicious Internet activities. Recently, due to the increased number of cyber terrors, many countries try to enact regulations against web server misuses. But, the establishment of such laws is slowed by the concerns of privacy of web users. This paper proposed legislative measures against cyber terrors as well as the proposed scheme to collect terror-related information from web servers. The result of this research can reduce overall costs of anti-terror activities in the Internet.

Information system modeling for analysis of propagation effects and levels of damage

The number of newly developed information systems has grown considerably in their areas of application, and their concomitant threats of intrusions for the systems over the Internet have increased, too. To reduce the possibilities of such threats, studies on security risk analysis in the field of information security technology have been actively conducted. However, it is very difficult to analyze actual causes of damage or to establish safeguards when intrusions on systems take place within the structure of different assets and complicated networks. Therefore, it is essential that comprehensive preventive measures against intrusions are established in advance through security risk analysis. Vulnerabilities and threats are increasing continuously, while safeguards against these risks are generally only realized some time after damage through an intrusion has occurred. Therefore, it is vital that the propagation effects and levels of damage are analyzed using real-time comprehensive methods in order to predict damage in advance and minimize the extent of the damage. For this reason we propose a modeling technique for information systems by making use of SPICE and Petri-Net, and methods for analyzing the propagation effects and levels of damage based on the epidemic model.

A Practical Security Risk Analysis Process and Tool for Information System

While conventional business administration-based information technology management methods are applied to the risk analysis of information systems, no security risk analysis techniques have been used in relation to information protection. In particular, given the rapid diffusion of information systems and the demand for information protection, it is vital to develop security risk analysis techniques. Therefore, this paper will suggest an ideal risk analysis process for information systems. To prove the usefulness of this security risk analysis process, this paper will show the results of managed, physical and technical security risk analysis that are derived from investigating and analyzing the conventional information protection items of an information system.

The Plan and Tools for Vulnerability Testing in Information Software-Based System

Abstract: Although many tests for stabilization of the software have been done, vulnerability test for a system run by combination of the software of various products has not been conducted enough. This has led to increased threats and vulnerability of system. Especially, web-based software system, which is public, has inherent possibility of exposure to attacks and is likely to be seriously damaged by an accident. Consequently, comprehensive and systematic test plans and techniques are required. Moreover, it is necessary to establish a procedure for managing and handling the results of vulnera-bility test. This paper proposes vulnerability test plans and designs for implementing automated tools, both of which can be complied with on web-based software systems. Keywords: Risk Analysis, Vulnerability, Asset, Threat 1. Introduction Software testing [1] is a very much hard task. Most of software development models repeat coding, testing and correction multiple times in order to stabilize a developed software, correct any bugs found during test and check any new bugs that might be detected. This is not true of tests of software-based systems. Once a software system is built, its testing is under restrictions. Even if the software system is found to have vulnerability, it is impossible to correct it. This is because once a software system is built and operated, it cannot be corrected or stopped arbitrarily. Therefore, cost effects coming from the revision and supplementation of vulnerability should be analyzed since unlike a bug, the vulnerability does not mean that the system has functional problems. Especially, recent developments in internet have led many organizations to establish requirements for a web-based system before starting to operate it [2]. A web-based software system can be developed easily and shorten development period since it has various and similar solutions. However, it has been found that the system has much vulnerability and has been exposed to increasingly new kinds of vulnerability since it uses TCP/IP protocol and runs on Windows or Linux platform [3]. Conventional system vulnerability testing [4][5] has been conducted in such a way that any vulnerability found by using scan tools or cracking tools is reported, followed by recom-mendations like installation of security patch or OS upgrade. This testing method may repeat same test since it does not have any proper plan and any proper knowledge of previous test cases and testing methods. Re-repeated testing for this reason increases wasted time and cost, making response to new vulnerability. There have been standardized plans and procedures for software testing [15], and there have been many studies on them. However, any testing method for software-based systems is hardly found, except for risk analysis approach [10][11] and risk management approach [12][13][14]. These methodologies require specialized knowledge of security and lots of human resources and time. For this reason, they cannot be applied well to the situation where vulnerability should be eliminated in real time. Especially, the methodologies require a long time from risk analysis and budget design to establishment of countermeasure, disabling just-in-time establishment of countermeasure [9]. This makes it difficult to establish safe system operation. It is better to apply security risk analysis methodology when changing whole system or considering a new project. Once a system is built, vulnerability should be eliminated by vulnerability testing, as occasion calls. Next, a tool [6] is developed and used for software testing. Since related developers and testers conduct similar jobs, proper information on the stress and load against software is set in the testing tool. Especially, a testing tool provides knowledge of predictable result of a bug. However, system vulnerability testing inspects various kinds of vulnerability of a system composed of a com-bination of software, in terms of rule settings, batch, composition and interlock. Vulnerability removal affects other software. Therefore, personnel, roles, methods and levels for system test planning must be clearly defined and specified, and inter-system vulnerability diffusion analysis [7][9] must be done well. To solve these problems, this paper proposes a method for software system vulnerability test planning and a design tool for its automation.