1. 12/5/2003Sergio Caltagirone University of Idaho An Active Defense Decision Model Sergio Caltagirone Major Professor: Deborah Frincke, PhD University of Idaho scaltagi@acm.org

2. 12/5/2003Sergio Caltagirone University of Idaho Purpose of Research Provide a generalizable, extendable model for any organization –Completely model the risk of the threat and AD actions –Find best active defense solution for the threat (allow for automation) –Provide legal (and ethical) due diligence Why? –Current tools are inefficient and sometimes critically ineffective –Model is technologically independent –*** Fear ***

3. 12/5/2003Sergio Caltagirone University of Idaho Stages of An Active Defense 1.*Planning  Active Defense Policy  Escalation Ladder 2.Detection From security tools 3.Evaluation Place within policy 4.Decision Which action? 5.Action Get ‘em 6.Analysis Did action work? 7.Escalation Move to next action 8.Maintenance Keep policy updated Reporting

4. 12/5/2003Sergio Caltagirone University of Idaho The Model AD Policy Escalation Ladder Asset Evaluation Action Evaluation Asset Identification Threat Identification Risk Identification Goal Identification Action Identification Action Classification Risk Identification Utility Modifier Success Ordering Graph Shortest Path Contingency Plan

5. 12/5/2003Sergio Caltagirone University of Idaho Example Scoring Chart Financial 10Loss of $1 billion 9Loss of $500 million 8Loss of $100 million … 0No Loss Gain of $10,000 … -10Gain of $1 billion

6. 12/5/2003Sergio Caltagirone University of Idaho Example Asset Evaluation Asset (A1): Student Records Database Confidentiality Threats Threat (TC-1): Outsider gains access and copies sensitive data FINAL SCORE: Legal RisksScoreProbabilityScore * Prob L1: National Security Risks NS1: Students’ social security number are released Financial Risks F1: Loss of tuition5.84 F2: Loss of financial donations7.42.8 Ethical Consequences EC1:

7. 12/5/2003Sergio Caltagirone University of Idaho Threat: TA-1Goal: Stop the ongoing DoS attack while preserving access to the database behind the campus firewall Stage 1 Actions Act1:Risk Score: Success Order: LegalScoreProbS * P National Security Financial E. Consequences E. Actions Stage 2 Actions Example Action Evaluation

8. 12/5/2003Sergio Caltagirone University of Idaho Example Escalation Ladder Graph U/0 Act1/7 Act2/-1 Act3/2 Act4/2 Act5/3 Act6/1 V/0 Stage 0Stage 1Stage 2Stage n…. Vertex Cost = Risk(Action) – Risk(Threat) – Success(Action)

9. 12/5/2003Sergio Caltagirone University of Idaho Final Thoughts Current Work: –Complete this paper (currently in draft form) Where does the algorithm stop other than at threat mitigation? (total risk) Examples need work Final Analysis Future Work: –Implement in an IDS or automated fashion –Usability studies on potential model interfaces Questions?