Approved by

Security intrusions and successful attacks on computer systems will occur regardless of the quality of the control and protection systems in use. It is therefore necessary to build computer systems that offer essential services even in the presence of a successful attack. Such systems are called intrusion tolerant. Intrusion tolerant systems differ from fault tolerant systems by their threat models. Fault tolerant systems are designed to survive spontaneous errors (due to natural physical processes), whereas intrusion tolerant systems should withstand attacks from skilled, well informed and resourceful adversaries who would launch multi-stage attacks on the system, where also the detection and recovery mechanisms are targeted. Spontaneous errors may be statistically modeled, whereas a targeted attack cannot. The research on intrusion tolerant systems draws on knowledge and experience from several other research fields, i.a. computing security, distributed systems and fault tolerant systems. These fields bring with them slightly different perspectives into the research, which will be presented in the report. The construction of intrusion tolerant systems builds on top of a range of well know