Proactive Intrusion Prevention and Response via Attack Graphs

Network defense today is largely reactive rather than proactive, and lacks sufficient context for optimal countermeasures. Administrators and security analysts are overwhelmed by constant outside threats, complexity of security measures, and network growth. Today’s status quo for network defense is often reduced to mere triage and after-the-fact remediation. This chapter examines proactive methods of attack risk reduction and response through attack graphs. Our attack graphs map potential paths of vulnerability through a network, showing exactly how attackers may penetrate a network. Attack graph analysis identifies critical vulnerabilities and provides strategies for protection of critical network assets. But because of operational realities, vulnerability paths often remain. In such cases attack graphs provide an ideal methodology for planning appropriate attack responses. This includes optimal placement of intrusion detection sensors, correlating intrusion alarms, accounting for missed detections, prioritizing alarms, and predicting next possible attack steps