V3SPA: A visual analysis, exploration, and diffing tool for SELinux and SEAndroid security policies

Mapping Intimacies ◽

10.31219/osf.io/64ubj ◽

2021 ◽

Author(s):

Robert Gove

Keyword(s):

Policy Analysis ◽

System Design ◽

Security Policy ◽

Visual Analysis ◽

Scale Up ◽

Security Requirements ◽

Security Policies ◽

Design Considerations ◽

Large Complex ◽

Big Picture

SELinux policies have enormous potential to enforce granular security requirements, but the size and complexity of SELinux security policies make them challenging for security policy administrators to determine whether the implemented policy meets an organization's security requirements. To address the challenges in developing and maintaining SELinux security policies, this paper presents V3SPA (Verification, Validation and Visualization of Security Policy Abstractions). V3SPA is a tool that can import SELinux and Security Enhancements (SE) for Android source or binary policies and visualize them using two views: A policy explorer, and a policy differ. The policy explorer supports users in exploring a policy and understanding the relationships defined by the policy. The diffing view is designed to support differential policy analysis, showing the changes between two versions of a policy.The main contributions of this paper are 1) the design of the policy explorer, and the design and novel usecase for the policy differ, 2) a report on system design considerations to enable the graph visualizations to scale up to visualizing policies with tens of thou- sands of nodes and edges, and 3) a survey of five SELinux and SE for Android policy developers and analysts. The results of the survey indicate a need for tools such as V3SPA to help policy workers understand the big picture of large, complex security policies.

Download Full-text

Industrial control systems: The biggest cyber threat

Annals of Civil and Environmental Engineering ◽

10.29328/journal.acee.1001026 ◽

2020 ◽

Vol 4 (1) ◽

pp. 044-046

Author(s):

Beretas Christos P

Keyword(s):

Control Systems ◽

Cyber Security ◽

Security Policy ◽

Security Requirements ◽

Security Policies ◽

Western World ◽

Control Analysis ◽

Industrial Control ◽

Industrial Control Systems ◽

Cyber Threats

Industrial control systems (ICS) are critical, as in these systems, cyber threats have the potential to affect, disorganize, change their mode of operation, act as an information extraction vehicle, and ultimately turn against itself. Creating risks to the system itself, infrastructure, downtime, leakage of sensitive data, and even loss of human life. Industrial control systems (ICS) are vital to the operation of all the modern automated infrastructure in the western world, such as power plant and power stations. Industrial control systems (ICS) differ from the traditional information systems and infrastructures of organizations and companies, a standard cyber security strategy cannot be implemented but part of it adapting to the real facts and needs of each country, legislation and infrastructure. These systems require continuous operation, reliability and rapid recovery when attacked electronically with automated control, isolation and attack management processes. Incorrect settings and lack of strategic planning can lead to unprotected operation of critical installations, as they do not meet the cyber security requirements. Industrial control systems (ICS) require special protection in their networks, as they should be considered vulnerable in all their areas, they need protection from cyber attacks against ICS, SCADA servers, workstations, PLC automations, etc. Security policies to be implemented should provide protection against cyber threats, and systems recovery without affecting the operation and reliability of operating processes. Security policies such as security assessment, smart reporting, vulnerability and threat simulation, integrity control analysis, apply security policy to shared systems, intrusion detection and prevention, and finally firewall with integrated antivirus and sandbox services should be considered essential entities.

Download Full-text

Security Policies in Web Services

Web Services Security Development and Architecture ◽

10.4018/978-1-60566-950-2.ch007 ◽

2010 ◽

pp. 134-151

Author(s):

Deepti Parachuri ◽

Sudeep Mallick

Keyword(s):

Web Services ◽

Security Policy ◽

Security Requirements ◽

Security Policies ◽

Future Trends ◽

Security Measures ◽

Computing Systems ◽

Policy Specification ◽

Basic Concepts

Security is of fundamental concern in computing systems. This chapter covers the role of security policies in Web services. First, it examines the importance of policies in web services and explains the WS-Policy standard. It also highlights the relation of WS-Policy with other WS-* specifications. Next, it covers different facets of security requirements in SOA implementations. Later, it examines the importance of security policies in web services. It also presents the basic concepts of WS-Security policy language. WS-Security policy specification specifies a standard way to define and publish security requirements in an extensible and interoperable way. A service provider makes use of security policy to publish the security measures implemented to protect the service. Security policies can also be made customizable to meet the security preferences of different consumers. Towards the end, it discusses about the governance of security polices and also future trends in security policies for web services.

Download Full-text