Featured Research

from universities, journals, and other organizations

How Secure Is Your Network? New Program Points Out Vulnerabilities, Calculates Risk Of Attack

Date:
July 29, 2008
Source:
National Institute of Standards and Technology
Summary:
To help IT managers safeguard valuable information most efficiently, computer scientists are applying security metrics to computer network pathways to assign a probable risk of attack, calculating the most vulnerable points of attack.

The example illustrates three paths that an attacker can take to penetrate the network using FTP server, SSH server or database server.
Credit: NIST

Data breaches are a recurring nightmare for IT managers responsible for securing not only their company's confidential data, but possibly also sensitive information belonging to their clients, such as social security numbers or health or financial records.

Related Articles


To help managers safeguard valuable information most efficiently, computer scientists at the National Institute of Standards and Technology (NIST) are applying security metrics to computer network pathways to assign a probable risk of attack to guide IT managers in securing their networks.

"We analyze all of the paths that system attackers could penetrate through a network," says computer scientist Anoop Singhal, "and assign a risk to each component of the system. Decision makers can use our assigned probabilities to make wise decisions and investments to safeguard their network."

Computer networks are made up of components varying from individual computers, to servers and routers. Once inside a network's firewall, for a seemingly mild-mannered purpose as posting an image to a file transfer protocol (FTP) site, a hacker can travel through the network through a variety of routes to hit the jackpot of valuable data. In addition to hardware, the hacker can break in through software on the computers, especially file-sharing applications that have been blamed for some major data breaches recently.

NIST researchers evaluate each route and assign it a risk based on how challenging it is to the hacker. The paths are determined using a technique called "attack graphs." A new analysis technique based on attack graphs was jointly developed by Singhal and research colleagues at George Mason University. A patent is pending on the technique.

Singhal and his team determine risk by using these attack graphs and NIST's National Vulnerability Database (NVD). This government repository includes a collection of security-related software weaknesses that hackers can exploit. NVD data was collected from software vendors and scores are assigned from most to least insecure by experts.

For example in a simple system there is an attacker on a computer, a firewall, router, an FTP server and a database server. The goal for the attacker is to find the simplest path into the jackpot--the database server. Attack Graph Analysis determines three potential attack paths. For each path in the graph, the NIST researchers assign an attack probability based on the score in the NVD database.

Because it takes multiple steps to reach the goal, the probabilities of each component are multiplied to determine the overall risk. One path takes only three steps. The first step has an 80 percent chance of being hacked, the second, a 90 percent chance. The final step requires great expertise, so there is only a 10 percent probability it can be breached. By multiplying the three probabilities together, that path is pretty secure with a less than 10 percent chance of being hacked.

The next step is for the researchers to expand their research to handle large-scale enterprise networks.


Story Source:

The above story is based on materials provided by National Institute of Standards and Technology. Note: Materials may be edited for content and length.


Journal Reference:

  1. Wang et al. An Attack Graph-Based Probabilistic Security Metric. Data and Applications Security XXII, 2008; 5094283 DOI: 10.1007/978-3-540-70567-3_22

Cite This Page:

National Institute of Standards and Technology. "How Secure Is Your Network? New Program Points Out Vulnerabilities, Calculates Risk Of Attack." ScienceDaily. ScienceDaily, 29 July 2008. <www.sciencedaily.com/releases/2008/07/080723144710.htm>.
National Institute of Standards and Technology. (2008, July 29). How Secure Is Your Network? New Program Points Out Vulnerabilities, Calculates Risk Of Attack. ScienceDaily. Retrieved October 31, 2014 from www.sciencedaily.com/releases/2008/07/080723144710.htm
National Institute of Standards and Technology. "How Secure Is Your Network? New Program Points Out Vulnerabilities, Calculates Risk Of Attack." ScienceDaily. www.sciencedaily.com/releases/2008/07/080723144710.htm (accessed October 31, 2014).

Share This



More Computers & Math News

Friday, October 31, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Samsung's Incredible Shrinking Smartphone Profits

Samsung's Incredible Shrinking Smartphone Profits

Reuters - Business Video Online (Oct. 30, 2014) The world's top mobile maker is under severe pressure, delivering a 60 percent drop in Q3 profit as its handset business struggles. Turning it around may not prove easy, says Reuters' Jon Gordon. Video provided by Reuters
Powered by NewsLook.com
Ban On Wearable Cameras In Movie Theaters Surprises No One

Ban On Wearable Cameras In Movie Theaters Surprises No One

Newsy (Oct. 30, 2014) The Motion Picture Association of America and the National Association of Theatre Owners now prohibit wearable cameras such as Google Glass. Video provided by Newsy
Powered by NewsLook.com
Microsoft Launches Fitness Band After Accidental Reveal

Microsoft Launches Fitness Band After Accidental Reveal

Newsy (Oct. 30, 2014) Microsoft accidentally revealed its upcoming fitness band on Wednesday, so the company went ahead and announced it. Video provided by Newsy
Powered by NewsLook.com
Mind-Controlled Prosthetic Arm Restores Amputee Dexterity

Mind-Controlled Prosthetic Arm Restores Amputee Dexterity

Reuters - Innovations Video Online (Oct. 29, 2014) A Swedish amputee who became the first person to ever receive a brain controlled prosthetic arm is able to manipulate and handle delicate objects with an unprecedented level of dexterity. The device is connected directly to his bone, nerves and muscles, giving him the ability to control it with his thoughts. Matthew Stock reports. Video provided by Reuters
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:

Strange & Offbeat Stories


Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins