Metrics Suite for Network Attack Graphs

65th Meeting of IFIP Working Group 10.4 On Dependable Computing and Fault Tolerance

Sorrento, Italy, January 23-27, 2014

Steven Noel

Center for Secure Information Systems

George Mason University

csis.gmu.edu

Metrics Suite for Network Attack Graphs

Motivation • Impact of combined topology, policy, and

vulnerabilities on security posture

– Attack graphs show multi-step vulnerability paths through networks

– But they lack quantitative scores that capture overall security state at a point in time

• Show metric trends over time

• Compare security across organizations

• Complementary dimensions of network security

• Funded by DHS BAA 11-02 (12 months)

1 1/23/2014 65th IFIP Working Group 10.4 Meeting

Motivating Example

1/23/2014 65th IFIP Working Group 10.4 Meeting 2

Attack Graph Before Remediation

Top CVSS Vulnerabilities


CVSS > 7

Remediated Attack Graph

Top Exposed Vulnerabilities


Top 3 Exposed

Remediated Attack Graph

Attack Graph Metrics

5

Network Topology

Firewall Rules

Host Vulnerabilities

Attack Graph Analysis

Metrics Engine

Metrics Dashboard

1/23/2014 65th IFIP Working Group 10.4 Meeting

Nessus Retina nCircle

Core Impact Foundscan

Qualys SAINT nmap

Cisco ASA Cisco IOS

Juniper JUNOS Juniper ScreenOS

Fortinet McAfee FE

XML CSV

Graphical


Cauldron Attack Graph

7

CVSS Base Metric

Exploitability

Access

Vector

Access

Complexity Authentication

Impact

Confidentiality Integrity Availability

Common Vulnerability Scoring System (CVSS)


• Victimization: Individual vulnerabilities and exposed services each have elements of risk. We score the entire network across individual vulnerability victimization dimensions.

• Size: The size of attack graph (vectors and exposed machines) is a prime indication of risk. The larger the graph, the more ways you can be compromised.

• Containment: Networks are generally administered in pieces (subnets, domains, etc.). Risk mitigation should aim to reduce attacks across such boundaries, to contain attacks.

• Topology: The connectivity, cycles, and depth of the attack graph indicate how graph relationships enable network penetration.

8

Attack Graph Metrics Families


Metrics Hierarchy

9

Overall

Victimization

Existence

Exploitability

Impact

Size

Vectors

Machines

Containment

Vectors

Machines

Vuln Types

Topology

Connectivity

Cycles

Depth

Network Score

Metrics Family

Individual Metrics


0

min

1 xxxf

minmax

min2

xx

xxxf

minmax

min3 10xx

xxxf

maxmin , xxx

Best Worst

10


Metrics Scaling

xf 3

0

min

1 xxxf

minmax

min2

xx

xxxf

maxmin , xxx

Worst Best

10

minmax

min3 1xx

xxxf

minmax

min4 1xx

xxxf

minmax

min5 110xx

xxxf


Metrics Scaling (Reversal)

xf 5

Combining Metrics

12

10

10 0 11sw

101 w

102 w 22

2

1 1010 ww

Largest Possible


22sw

10,01010

102

2

2

1

2

22

2

11

ww

swsw

Combining Metrics


.ht with weig score individualFor

10,010

10

is score combined thescores, for general,In

2

2

ii

n

i i

n

i ii

ws

w

swS

Sn

Metrics Hierarchy

14

Overall

Victimization

Existence

Exploitability

Impact

Size

Vectors

Machines

Containment

Vectors

Machines

Vuln Types

Topology

Connectivity

Cycles

Depth


Metrics Family: Victimization


• Existence – relative number of ports that are vulnerable:

• Exploitability – average CVSS Exploitability:

• Impact – average CVSS Impact:

UueU

i ilityExploitabi

,Impact UumU

i i

nv

v

ss

s

10Existence

Metrics Hierarchy

16

Overall

Victimization

Existence

Exploitability

Impact

Size

Vectors

Machines

Containment

Vectors

Machines

Vuln Types

Topology

Connectivity

Cycles

Depth


Size Family

Vectors Metric


Within domain (implicit vectors)

Across domains: explicit vectors

jiv ,

im

j ji vm 1

d

ji ji

d

i

m

j jia vvmvi

, ,1 torsAttack vec

m

i ip smv 1 torsattack vec possible Total

p

a

v

v10Size Vectors

Size Family

Machines Metric


Vulnerable machines

d

i irr

Non-vulnerable machines

d

j jmm

mr

r

10Size Machines

Metrics Hierarchy

19

Overall

Victimization

Existence

Exploitability

Impact

Size

Vectors

Machines

Containment

Vectors

Machines

Vuln Types

Topology

Connectivity

Cycles

Depth


Containment Family

Vectors Metric


Within domain (implicit vectors)

Across domains: explicit vectors

jiv ,

im

j ji vm 1

d

ji ji

d

i

m

j jia vvmvi

, ,1 torsAttack vec

d

ji jic vv, ,domainsacrossvectorsAttack

a

c

v

v10tContainmen Vectors

Containment Family

Machines Metric


Victims across domains

Victims within domain only

d

i iiw Vmmmm ,

d

i iia Vmmmm ,

wa

a

mm

m

10tContainmen Machines

Containment Family

Vulnerability Types Metric


Vulnerability types across domains

Vulnerability types within domain only

d

i iiiiw Vmtmmtt ,

d

i iiiia Vmtmmtt ,

wa

a

tt

t

10tContainmen Types Vuln

Metrics Hierarchy

23

Overall

Victimization

Existence

Exploitability

Impact

Size

Vectors

Machines

Containment

Vectors

Machines

Vuln Types

Topology

Connectivity

Cycles

Depth


Attack Graph Connectivity


One Component

Two Components

Three Components

Motivation: Better to have attack graph as disconnected parts versus connected whole

Less Secure

More Secure

Topology Family

Connectivity Metric


1 component 4 components 5 components

10111

11110Metric

7

111

14110Metric

6

111

15110Metric

Attack Graph Cycles


Motivation: For a connected attack graph, better to avoid cycles among subgraphs

Less Secure

More Secure


4 components 5 components 10 components

7111

14110Metric

6

111

15110Metric

1

111

110110Metric

Topology Family

Cycles Metric

Attack Graph Depth


One Step Deep

2 Steps Deep

3 Steps Deep

Less Secure

More Secure

Motivation: Better to have attack graph deeper versus shallower


Shortest path 3/8 Shortest path 4/8 Shortests paths 2/3 and 1/5

7.518

3110Metric

3.4

18

4110Metric

3.2

15

115

13

213

82

10Metric

Topology Family

Depth Metric

Metrics Dashboard


Family-Level Metrics


Temporal Zoom


Trend Summary


Example Network Topology


Attack Graph – No Hardening



Block Partners to Inside


Block Partner 4 to DMZ


Block DMZ to Inside 3


Patch Host Vulnerabilities






Contact

45

The MITRE Corporation McLean, Virginia

Steven Noel http://csis.gmu.edu/noel/


[email protected]

http://csis.gmu.edu/noel/

Metrics Suite for Network Attack Graphs

Documents