Technology-supported Risk Estimation by Predictive Assessment of Socio-technical Security

ion In general, but also especially in the context of TRESPASS, abstraction is important in relation to the goal of mitigating what can be an overriding complexity in some scenarios, that may confront the user of TRESPASS tools. It is also worth stating that risk assessment itself is a form of abstraction that enables a security practitioner to order contextual data and spotlight particular facets of the context before analysing it. The ways in which abstraction can be used are: • Initially in relation to formal modelling, for example, abstraction is needed to organise a view of the relevant infrastructure items, as well as to present a view of all of the actors and their behaviours. Simplifying these for the purposes of visualisation also tackles the more subtle features of these behaviours during iterative stages of modelling; secondly, • In the visualisations abstraction can be used to mitigate complexity and information densities in a constrained visual space. 3.2 Using standard interaction techniques to respond to complexity within the ANM The abstraction techniques are manifested in standard interaction techniques and these techniques have been deployed in the ANM in order to reduce the visual complexity of a particular aspect of a complex risk scenario. Possible approaches to tackle the visualisation of complex systems include: Filtering/highlighting/sorting filtering and/or highlighting and focusing can be used to select a subset of elements to reduce visual clutter; similarly, sorting of elements enables the focus to be confined to a subset, utilising a metric for the purposes of ranking Exploiting visual form and representative functions utilise visual form and well-known representative functions to allow quick and high-level recognition, e.g., the hover function to foreground virtual machines involved in a specific flow of information (see Figure 4.4) Using abstractions use abstractions in the set of elements to allow grouping ‘similar’ elements and combine into fewer elements in order to visualise effectively 2016-10-31 ICT-318003 11 3.2 Interaction techniques within the ANM D4.3.2 v1.0 Overview and drill-down give an overview of the total system, possibly starting with higher-level abstractions of subsystems, while allowing drill-down into individual subsystems to show more detail. This approach is explored for example with the “alluvial” view of relations between physical and virtual servers in TiCoVis (see Figure 4.3) Multiple views show multiple views of the system from different viewpoints or ‘gazes’ to highlight different aspects of the system at the same time in a coordinated-visualisation (North & Shneiderman, 2000) Some of these approaches can be combined for additional benefits, e.g., multiple views of the system are especially helpful when selections in one view are coordinated with all other visible views to see the selected entities in the different contexts and perspectives. In the remainder of this deliverable we report on two prototypes that deploy these techniques to visualise two particular aspects of advanced information security risk assessment in the cyber realm. 2016-10-31 ICT-318003 12 4 Visualising complexity in the Cloud scenario D4.3.2 v1.0 4 Visualising complexity in the Cloud scenario The Cloud use case in TRESPASS task T7.2 enables us to use our general approach to visualising complexity and to specifically develop some new tools. The cloud represents the three spheres that we use within TRESPASS visualisations, namely social, technological and physical: • a physical setting with rooms, doors and windows where, e.g., physical infrastructure pieces of a cloud environment are situated and where the different actors have access and can move, • software-defined virtual parts, like virtual machines, virtual network and storage, situated in an abstract and completely separate space, and • the social space where a distance between actors defines weak or strong relationships. At the same time, the physical elements (e.g., servers, network) can range in the tens of thousands, the virtual, software-defined components (e.g., virtual machines) can range in hundreds of thousands. In addition, there is typically a very large number of users of the cloud infrastructure and rather few, but very powerful, administrators. All these elements will interact (cooperating or interacting maliciously) leading to a complex behaviour over time, which leads in effect to a Complex Adaptive System—compare the discussion in The TRESPASS Project, D4.2.1 (2014). In the following, we show our work to represent a cloud environment as an example for a complex environment in a visually understandable way. Section 4.1 makes the start by showing work earlier during the project depicting a live cloud environment in real-time as a general graph. During this work we found that there is still a lack of visualisation making changes over time understandable in the current state of the art. Current software for managing cloud environments, like VMware vCenter or the Horizon dashboard of OpenStack, focus on the current state of the infrastructure and the ways to configure and manage the system. Corresponding monitoring tools, although showing the time aspect, are focused on technical details like memory or CPU utilisation, rather than changes of the structure or access control role. These changes are hardly visualised at all and mainly contained in text-based log files. Identifying changes in a complex and highly dynamic system is difficult but is a necessary aspect of cloud risk assessment. Missing relevant changes may lead to failure identifying violations of required policies, or missing steps indicating an intrusion (from the outside or 2016-10-31 ICT-318003 13 4.1 Live Visualisation of a cloud environment – SAVE D4.3.2 v1.0 by an insider). We can therefore see that failure to identify the changes that have taken place over time is a significant risk vulnerability in cloud administration. If we refer back to the visualisation challenges for TRESPASS that we stated earlier in this deliverable, we can see that our work in this deliverable responds to these challenges in a particular way: • The visualisation prototypes presented here identify the visualisation principles that enable the social (in this case cloud actors), technical, physical and organisational (particularly the administrative) changes to the cloud environment to be visualised both as an integrated whole and within their individual dimensions; • Develop visualisation techniques to respond to the challenges of change over time based on the visualisation principles identified; and • Develop general and specific techniques for visualising the inter-relationships between the social, technical, physical and organisational components and thereby enabling cloud administrators to identify potential vulnerabilities in the cloud environment resulting from system and configuration changes. As cloud systems, be it private or public, are highly attractive targets for intruders there is a high risk for attacks that might occur in smaller steps over a long period of time (e.g., in Advanced Persistent Threats (see for example (Fernandes, Soares, Gomes, Freire, & Inácio, 2014) and (Five, 2011)). Making changes of a cloud system more easily understandable by visualisation therefore is a means to handle such advanced risks. For this reason we have put our efforts into prototypes looking especially into visualisations to make changes of the system understandable. The two following prototypes, TiCoVis described in Section 4.2 and CEAV in Section 4.3, aim to give on the one hand a direct representation of change over time for a specific type of relation (in TiCoVis) and on the other hand a more complex structural representation of the cloud environment for selected time intervals, both focusing on change occuring over time. 4.1 Live Visualisation of a cloud environment – SAVE SAVE is a data extraction and policy analysis tool that was developed by IBM as part of the EU FP7 TClouds project (TClouds, 2013). The policy analysis required a simple network topology that the SAVE data collection engine built from information extracted from a number of cloud operating systems. During the TRESPASS project the data collection engine was extended to capture a richer set of information better suited to the requirements of the TRESPASS modelling language developed in WP1 (see The TRESPASS Project, D2.2.2 (2015)). The extended data extraction capabilities, in particular the ability to capture a consistent snapshot of a virtualised infrastructure were later transferred to an IBM product. As part of these extensions, work in the TRESPASS project on the visualisation of the status of the cloud environment focused on visualising the detailed system state in a live graph presentation (see Figure 4.1) for exploration and real-time highlighting of policy 2016-10-31 ICT-318003 14 4.1 Live Visualisation of a cloud environment – SAVE D4.3.2 v1.0 violations (see Figure 4.2). Detailed description of the work on security analysis and policy checking can be found in Bleikertz, Vogel, and Groß (2014) and Bleikertz, Vogel, Groß, and Mödersheim (2015). Figure 4.1: Graph visualisation of the live cloud environment state (using Gephi1). Different colors indicate different component types like physical servers, virtual machines, storage, network. The interface allows zooming and selecting components for a more detailed exploration. Following on from this work, we investigated how the changes in a complex cloud environment could be visually represented, to allow understanding in a visual way of the history of the system and some of the associated risks in that history. This lead to the prototypes described in the next two sections. Gephi The Open Graph Viz Platform at https://gephi.org 2016-10-31 ICT-318003 15 4.1 Live Visualisation of a cloud environment – SAVE D4.3.2 v1.0 Figure 4.2: SAVE Visualisation