All rights reserved © 2005, Alcatel Enhanced Security situational Awareness for (Enterprise) networks  Bertrand Marquet / François Cosquer  Alcatel

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 2 Agenda The security challenge Situational awareness by Security Assurance measurement How can security assurance be measured Addressing complexity Illustrations Conclusion / questions

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 3 Security challenge  Deploying new technologies, businesses are faced with challenge of : Reducing possible associated risks With increasing productivity based on confidence in current security functions deployed Security Assurance = confidence / (residual) risks Risks Confidence in counter measures Manage it in an acceptable range (ratio cost/loss) Cost too high Loss too high

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 4 Situational awareness by security assurance measurement  Assurance Measurement is characterized by : Effectiveness of the security countermeasure versus Likelihood of a risk occurrence Security Assurance = confidence / (residual) risks Risks Confidence in counter measures Measurement Cost too high loss too high Effectiveness Likelihood

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 5 How can assurance be measured ?  Mainly, using two systems, sometimes combined, Intrusion Detection System  Measure lack of effectiveness of security function  Generate too much (security) noise Vulnerability assessment / patch management  Measure likelihood of an potential vector of risk based on combination of several thousands identified vulnerabilities  Scalability challenging  Main challenge is to address complexity

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 6 Addressing complexity (1/2): Concepts Ability to assure in operation = F (1/Complexity)  Reduce the complexity to measure the assurance  Selection of points of measurement of the assurance

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 7 Addressing complexity (2/2): One implementation  Reduce selectively the complexity to measure the assurance  Phase 2 Deploy and Calibrate intelligent “probes”  Phase 2 Provide (near) real time associated indicators During operation (require light process)  Phase 1 Spot top 10(-20) “problems” in the topology Before operation (compatible with heavy process)

All rights reserved © 2005, Alcatel (Simplified) Illustration  Wireless / Mobile

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 9 Risk / Topology base station fixed nomadic access controller NMS billing system IP Backbone WiMAX Internet fixed nomadic WiFi Access Points AAA server mobile SIP phone access controller Fixed Threat level High Medium Low

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 10 Low level of security assurance base station fixed nomadic access controller NMS billing system Gateway IP Backbone WiMAX Internet fixed nomadic WiFi Access Points AAA server mobile SIP phone access controller Fixed Assurance Level High = A+B+C Medium = A +B Low = A A A A

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 11 Increased level of assurance + SOX base station fixed nomadic access controller NMS billing system Gateway IP Backbone WiMAX Internet fixed nomadic WiFi Access Points AAA server mobile SIP phone access controller Fixed Assurance Level High = A+B+C Medium = A +B Low = A Regulation specific = R B A A A B B B R

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 12 Security assurance topology B A A A B B R B A A A Metric - Successful / failed auths Calibration Statistics Metric Calibration Metric Calibration Low assurance Higher assurance

All rights reserved © 2005, Alcatel Conclusion

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 14 Conclusion  Security assurance as, a confidence factor, needs to be measured when securing (enterprise) network  Complexity of data and voice networks is a major obstacle to measure the security assurance  We are working on complementary approaches to guaranty effective security in order to protect Intellectual property (Confidentiality, Integrity) Continuity of business (Availability) But also, Justify security (investments) Provide proofs (Regulation/law compliance)  Alcatel has initiated and is involved in several research projects to address those topics Funded Canadian Defense project Funded European Consortium

All rights reserved © 2005, Alcatel

Toronto, May 19th, 2005 Page 16 Security  Reducing risks to an Enterprise Network  “Strategic, Technical” Protection of the intellectual property of the enterprise Business continuity  “Legal” Regulation and legal compliance

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 17 Countermeasures (1/2)   Giving countermeasures of potential threats to assets of the enterprise Incidentals Deliberate Internal/external  Necessary (mandatory) response for regulations compliance SOX, GLBA HIPAA, More to come ….

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 18 Countermeasures (2/2)  Protection mechanisms deployed to guaranty fundamental properties: Confidentiality, Integrity, Availability.  Of data flows through diverse and combined types of measures Preventive, Detective, Reactive.

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 19 Losses vs. costs Manage it in an acceptable range Situational awareness Security assurance $ “security level” Risk costs Risk losses Risk losses + costs

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 20 Phase 1 “Security Reduced” topology One solution is Topology overlay to spot most critical devices, based on vulnerabilities research  So the reduced topology become the top critical devices or functions  Heavy process as a decision support not operation Regulations explicitly describe point of measurement  Traceability from requirements  Assurance required on the identified security enforcing component

All rights reserved © 2005, Alcatel Toronto, May 19th, 2005 Page 21 Phase 2:  Challenges: Define Metrics Heavy process results can be used  to validate metrics and calibrate measurement  To limit false positive / retroaction Visualization with simple indicators Association of security Assurance level  Increase/decrease the requested level of assurance – Change metrics of indicators – Increase/decrease the numbers of indicators