Multi-Aspect Security Configuration Assessment

Evaluating the security of a computer network system is a challenging task. Configurations of large systems are com-plex entities in continuous evolution. The installation of new software, a change in the firewall rules, or the discovery of a software vulnerability can be exploited by a malicious user to gain unauthorized control of the integrity, availability and confidentiality of the assets of an organization. This paper presents a framework for building security as-sessment tools able to perform online verification of the se-curity of a system configuration. Heterogeneous data gen-erated from multiple sources are integrated into a homoge-neous RDF representation using domain-specific ontologies and used for assessing the security of a configuration toward known attack vectors. Different vocabularies can be defined to express configurations, policies and attacks for each as-pect of the security of an organization (e.g., network security, physical security and application level security) in a modular way. By automatically extracting part of the configuration from the network system, the tool is able to detect in near real-time security threats created by configuration changes