Application of Bayesian network in risk assessment for website deployment scenarios
DOI:
https://doi.org/10.54654/isj.v14i2.209Keywords:
deployment scenario, risk assessment, CVE, Bayesian network, scenario-based risk assessmentTóm tắt
Abstract—The rapid development of web-based systems in the digital transformation era has led to a dramatic increase in the number and the severity of cyber-attacks. Current attack prevention solutions such as system monitoring, security testing and assessment are installed after the system has been deployed, thus requiring more cost and manpower. In that context, the need to assess cyber security risks before the deployment of web-based systems becomes increasingly urgent. This paper introduces a cyber security risk assessment mechanism for web-based systems before deployment. We use the Bayesian network to analyze and quantify the cyber security risks posed by threats to the deployment components of a website. First, the deployment components of potential website deployment scenarios are considered assets, so that their properties are mapped to specific vulnerabilities or threats. Next, the vulnerabilities or threats of each deployment component will be assessed according to the considered risk criteria in specific steps of a deployment process. The risk assessment results for deployment components are aggregated into the risk assessment results for their composed deployment scenario. Based on these results, administrators can compare and choose the least risky deployment scenario.
Tóm tắt—Sự phát triển mạnh mẽ của các hệ thống trên nền tảng web trong công cuộc chuyển đổi số kéo theo sự gia tăng nhanh chóng về số lượng và mức độ nguy hiểm của các cuộc tấn công mạng. Các giải pháp phòng chống tấn công hiện nay như theo dõi hoạt động hệ thống, kiểm tra và đánh giá an toàn thông tin mạng được thực hiện khi hệ thống đã được triển khai, do đó đòi hỏi chi phí và nhân lực thực hiện lớn. Trong bối cảnh đó, nhu cầu đánh giá rủi ro an toàn thông tin mạng cho các hệ thống website trước khi triển khai thực tế trở nên cấp thiết. Bài báo này giới thiệu một cơ chế đánh giá rủi ro an toàn thông tin mạng cho các hệ thống website trước khi triển khai thực tế. Chúng tôi sử dụng mạng Bayes để phân tích và định lượng rủi ro về an toàn thông tin do các nguồn đe dọa khác nhau gây ra trên các thành phần triển khai của một website. Đầu tiên, các thành phần triển khai của các kịch bản triển khai website tiềm năng được mô hình hoá dưới dạng các tài sản, sao cho các thuộc tính của chúng đều được ánh xạ với các điểm yếu hoặc nguy cơ cụ thể. Tiếp đó, các điểm yếu, nguy cơ của từng thành phần triển khai sẽ được đánh giá theo các tiêu chí rủi ro đang xét tại mỗi thời điểm cụ thể trong quy trình triển khai. Kết quả đánh giá của các thành phần triển khai được tập hợp lại thành kết quả đánh giá hệ thống trong một kịch bản cụ thể. Căn cứ vào kết quả đánh giá rủi ro, người quản trị có thể so sánh các kịch bản triển khai tiềm năng với nhau để lựa chọn kịch bản triển khai ít rủi ro nhất.
Downloads
References
Nurullah Demir, Tobias Urban, Kevin Wittek and Norbert Pohlmann, "Our (in)Secure Web: Understanding Update Behavior of websites and Its Impact on Security," PAM 2021: Passive and Active Measurement pp 76-92, 2021.
Gary Stoneburner, Alice Goguen, and Alexis Feringa, “Risk Management Guide for Information Technology Systems,” NIST Special Publication 800-30, 2002.
Ines Meriah, Latifa Ben Arfa Rabai, " A Survey of Quantitative Security Risk Analysis Models for Computer Systems," Association for Computing Machinery, ICAAI, October 2018.
Huang Jiwen, Deng Zhilong, "A Bayesian Assessment Method of Network Risk," Applied Mechanics and Materials Vols 513-517 pp 1684-1687, Trans Tech Publications, Switzerland 2014.
Sun Java™ System, "Sun Java Enterprise System Deployment Planning White Paper," Sun Microsystems, Inc., 2004.
The MITRE Corporation. CVE® List https://cve.mitre.org/.
The MITRE Corporation. Common Weakness Enumeration – https://cwe.mitre.org/.
ISO/IEC 27005:2011 Information technology - Security techniques - Information security risk management.
ISO/IEC 15408-1:2009 Information technology — Security techniques — Evaluation criteria for IT security.
Serkan Ozkan. CVE details – the ultimate security vulnerability data source. https://www.cvedetails.com/.
OWASP Foundation. OWASP Top Ten. https://owasp.org/www-project-top-ten/2017/.
Armaghan Behnia, Rafhana Abd Rashid, and Junaid Ahsenali Chaudhry, "A Survey of Information Security Risk Analysis Methods," Smart Computing Review, vol. 2, no. 1, 2012.
Forum of Incident Response and Security Teams, Inc. Common vulnerability scoring system. https://www.first.org/cvss/.
The MITRE Corporation. Common weakness scoring system. https://cwe.mitre.org/.
Yu Liu and Hong Man, "Network Vulnerability Assessment using Bayesian Networks," Proceedings of SPIE Vol. 5812, 2005.
Kaixing Huang, Chunjie Zhou, Yu-Chu Tian, Weixun Tu, Yuan Peng, "Application of Bayesian Network to Data-Driven Cyber-Security Risk Assessment in SCADA Networks," 27th International Telecommunication Networks and Applications Conference (ITNAC), 2017.
S. Zhang and S. Song. "A novel attack graph posterior inference model based on bayesian network," Journal of Information Security, 2011.
Razieh Rezaee and Abbas Ghaemi Bafghi, "A Risk Estimation Framework for Security Threats in Computer Networks," Journal of Computing and Security, Volume 7, Number 1 (pp. 19-33), 2020.
NIST. National vulnerability database. https://nvd.nist.gov/.
Bayes Fusion LLC. GeNIe Modeler. https://www.bayesfusion.com/genie/.
Mouna Jouinia, Latifa Ben Arfa Rabaia and Anis Ben Aissab, "Classification of security threats in information systems," 5th International Conference on Ambient Systems, Networks and Technologies (ANT-2014).
Ines Meriah and Latifa Ben Arfa Rabai, "A Survey of Quantitative Security Risk Analysis Models for Computer Systems," ICAAI 2018.
Irad Ben-Gal, "Bayesian Networks," Encyclopedia of Statistics in Quality and Reliability, John Wiley & Sons, Ltd. 2008.
Hermawan Setiawan, Lytio Enggar Erlangga, Ido Baskoro, "Vulnerability Analysis Using The Interactive Application Security Testing (IAST) Approach For Government X Website Applications," 3rd International Conference on Infomation and Communications Technology (ICOIACT), 2020.
Pavel B. Khorev, Maxim I. Zheltov, "Assessing Information Risks When Using Web Applications Using Fuzzy Logic," International Conference on Information Technologies in Engineering Education, 2020.
Downloads
Published
How to Cite
Issue
Section
License
Proposed Policy for Journals That Offer Open Access
Authors who publish with this journal agree to the following terms:
1. Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
2. Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
3. Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
Proposed Policy for Journals That Offer Delayed Open Access
Authors who publish with this journal agree to the following terms:
1. Authors retain copyright and grant the journal right of first publication, with the work [SPECIFY PERIOD OF TIME] after publication simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
2. Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
3. Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
