Assessing computer security vulnerability

ABSTRACT

The lack of a standard gauge for quantifying computer system vulnerability is a hindrance to communicating information about vulnerabilities, and is thus a hindrance to reducing those vulnerabilities. The inability to address this issue through uniform semantics often leads to uncoordinated efforts at combating exposure to common avenues of exploitation. The de-facto standard for evaluating computer security is the government's Trusted Computer Evaluation Criteria, also known as the Orange Book. However, it is a generally accepted fact that the majority of non-government multi-user computer systems are classified into one of its two lower classes. The link between the higher classes and government classified data, makes the measure unsuitable for commercial use.This project presents a feasible approach for resolving this problem by introducing a standardized assessment. It introduces a method, termed the System Vulnerability Index (SVI), that analyzes a number of factors that affect security. These factors are evaluated and combined, through the use of special rules, to provide a measure of vulnerability. The strength of this method is in its abstraction of the problem, which makes it applicable to various operating systems and hardware implementations. User and superuser actions, as well as clues to a potentially breached state of security, serve as the basis for the security relevant factors. Facts for assessment are presented in a form suitable for implementation in a rule-based expert system.

REFERENCES

• 1: [1] D. Denning, Cryptography and Data Security, Addison-Wesley, Reading, MA 1981.
• 2: Simson Garfinkel , Gene Spafford, Practical UNIX security, O'Reilly & Associates, Inc., Sebastopol, CA, 1991
• 3: Morrie Gasser, Building a secure computer system, Van Nostrand Reinhold Co., New York, NY, 1988
• 4: [4] B. Landreth, Out of the Inner Circle, Tempus Books (Microsoft Press), Redmond, WA, 1989.
• 5: Elaine Rich, Artificial intelligence, McGraw-Hill, Inc., New York, NY, 1983
• 6: Deborah Russell , G. T. Gangemi, Sr., Computer security basics, O'Reilly & Associates, Inc., Sebastopol, CA, 1991
• 7: [7] C. Stoll, The Cuckoo's Egg, Doubleday, NY, NY, 1989.
• 8: [8] "Department of Defense Trusted Computer System Evaluation Criteria," DoD 5200.28- STD, December 1985.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS

  K. Computing Milieux
  K.1 THE COMPUTER INDUSTRY
      Subjects: Standards

General Terms:
Design, Management, Measurement, Performance, Reliability, Security, Standardization, Theory