1 Structuring Knowledge for a Security Trade-offs Knowledge Base Golnaz Elahi Department of Computer Science Eric Yu Faculty of Information Study University of Toronto IdentityPrivacy and Security Initiative Research Symposium Identity, Privacy and Security Initiative Research Symposium May 2 nd 2008

2 Strategic Dependencies among Actors

3 Modelling Strategic Actor Relationships and Rationales - the i* modelling framework Strategic Actors:  have goals, beliefs, abilities, commitments  are semi-autonomous freedom of action, constrained by relationships with others not fully knowable or controllable has knowledge to guide action, but only partially explicit  depend on each other for goals to be achieved, tasks to be performed, resources to be furnished

4 Strategic Rationales about alternative configurations of relationships with other actors – Why? How? How else?

5 i* Evaluation Procedure  Semi-automatable propagation of qualitative evaluation labels uses evaluation guidelines and human judgment.

6 Security Trade-offs Modeling and Analysis using i*

7 Structuring Knowledge for a Security Trade-offs Knowledge Base A Goal-Oriented Approach

8 Problems

9 Security Knowledge Sources  Textbooks  Guidelines  Standards  Checklists  Documentation from past projects  Security Design Patterns  Structured Catalogues & Knowledge Bases

Excerpt from the NIST guidelines 10 Structuring Knowledge * *

11 Motivations and Questions  What would be a good way to organize and structure knowledge to assist designers in making security trade- offs?  We suggest a Goal-Oriented approach for structuring security trade-offs knowledge.

12 Analyzing the Structure of the Knowledge in the NIST Guidelines Quality Goals Goals Security Mechanis m Actor Attacker Attack Impact s Vulnerabilit y

13 The KB Schema  Actors and their goals  Mechanisms and contributions of mechanisms on goals and other mechanisms  Attackers and attacks  Impact of attacks on goals and impact of security mechanisms on attacks

14 Example of Structured Knowledge

15 Reusable Unit of Knowledge  What are the consequences of applying a particular security mechanism on malicious and non-malicious goals and mechanisms?  Which actor or system’s component should employ a particular security mechanism?

16 Reusable Unit of Knowledge What is the impact of a particular attack on other goals and mechanisms? What vulnerabilities exist in a particular asset or mechanism? What attacks threaten a particular mechanism, asset, or goal? Who may threaten the system?

17 Reusable Unit of Knowledge  What security mechanisms prevent or detect a particular attack or recover the system after the occurrence of the attack?

18 Reusable Unit of Knowledge: Example

19 Conclusion  Trade-offs between competing goals and the alternative solutions are expressed by relating consequences of applying each alternative to the goals.  The knowledge models enable goal model evaluation techniques to evaluate the goals satisfaction.  During the process modeling, missing points and relationships are discovered.

20 Limitations and Ongoing work  The visual goal-oriented knowledge models are not well scalable  This makes the browsing, understating, and analyzing knowledge expressed in the visual goal models difficult.  Therefore, to solve the scalability problem 1. It is needed to store the goal-oriented knowledge structure in goal-oriented text formats. 2. It is required to have query languages to extract a fragment of the large chunk of knowledge. 3. The unit of knowledge to extract from the KB needs to be defined.

21 References : [Mead 05] Mead, N. R., McGraw, G., A portal for software security, IEEE Security & Privacy, 2(4), (2005) [Barnum 05] Barnum, S., McGraw, G., Knowledge for software security, IEEE Security & Privacy 3(2), (2005) [NIST ] Grance, T., Stevens, M., Myers, M., Guide to Selecting Information Technology Security Products, Recommendations of the National Institute of Standards and Technology, NIST Special Publication (2003) [ER07] G. Elahi, E. Yu, A goal oriented approach for modeling and analyzing security trade-offs, In Proceeding of 26th International Conference of Conceptual Modeling, 2007, [RE03] L. Liu, E. Yu, J. Mylopoulos, Security and Privacy Requirements Analysis within a Social Setting. In IEEE Joint Int. Conf. on Requirements Engineering, 2003, Eric Yu: Golnaz Elahi: