TY - GEN
T1 - Distributed security policy conformance
AU - Montanari, Mirko
AU - Chan, Ellick
AU - Larson, Kevin
AU - Yoo, Wucherl
AU - Campbell, Roy H.
PY - 2011
Y1 - 2011
N2 - Security policy conformance is a crucial issue in large-scale critical cyber-infrastructure. The complexity of these systems, insider attacks, and the possible speed of an attack on a system necessitate an automated approach to assure a basic level of protection. This paper presents Odessa, a resilient system for monitoring and validating compliance of networked systems to complex policies. To manage the scale of infrastructure systems and to avoid single points of failure or attack, Odessa distributes policy validation across many network nodes. Partial delegation enables the validation of component policies and of liveness at the edge nodes of the network using redundancy to increase security. Redundant distributed servers aggregate data to validate more complex policies. Our practical implementation of Odessa resists Byzantine failure of monitoring using an architecture that significantly increases scalability and attack resistance.
AB - Security policy conformance is a crucial issue in large-scale critical cyber-infrastructure. The complexity of these systems, insider attacks, and the possible speed of an attack on a system necessitate an automated approach to assure a basic level of protection. This paper presents Odessa, a resilient system for monitoring and validating compliance of networked systems to complex policies. To manage the scale of infrastructure systems and to avoid single points of failure or attack, Odessa distributes policy validation across many network nodes. Partial delegation enables the validation of component policies and of liveness at the edge nodes of the network using redundancy to increase security. Redundant distributed servers aggregate data to validate more complex policies. Our practical implementation of Odessa resists Byzantine failure of monitoring using an architecture that significantly increases scalability and attack resistance.
UR - http://www.scopus.com/inward/record.url?scp=79960875884&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=79960875884&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-21424-0_17
DO - 10.1007/978-3-642-21424-0_17
M3 - Conference contribution
AN - SCOPUS:79960875884
SN - 9783642214233
T3 - IFIP Advances in Information and Communication Technology
SP - 210
EP - 222
BT - Future Challenges in Security and Privacy for Academia and Industry - 26th IFIP TC 11 International Information Security Conference, SEC 2011, Proceedings
T2 - 26th IFIP TC-11 International Information Security Conference on "Future Challenges in Security and Privacy for Academia and Industry", SEC 2011
Y2 - 7 June 2011 through 9 June 2011
ER -