Download
1 / 8
80 likes | 163 Views
Networking Aspects in the DPASA Survivability Architecture: An Experience Report. Michael Atighetchi matighet@bbn.com BBN Technologies. Presentation Overview. Overview of DPASA The undefended JBI Application Network Oriented Defenses The defended JBI Application Red Team Results.
E N D
Networking Aspects in the DPASASurvivability Architecture:An Experience Report Michael Atighetchi matighet@bbn.com BBN Technologies
Presentation Overview Overview of DPASA The undefended JBI Application Network Oriented Defenses The defended JBI Application Red Team Results
Overview of DPASA* * DPASA stands for Designing Protection and Adaptation into a Survivability Architecture DPASA is a 2 year DARPA project led by BBN Technologies, to design and implement an architecture for building next generation survivable systems that can Survive 12 hours of sustained attacks from a class A Red Team Achieve 1000-fold alarm reduction and 1% false alarm rate DPASA strategically combines protection, detection, and adaptive reaction following the principles of Multiple Layers of Protection Redundancy and Static Diversity Use of Physical Constraints to Impose Containment Design based on Weak Assumptions Detection and Correlation Adaptive Response Base of Intrusion Tolerant DARPA Technologies: OASIS (1999-2003, 20+ projects) FTN (1999-2002, 20+ projects)
The Undefended JBI – Schematic View PSQ Server DB Server Core LAN Emulated WAN Hub Client1 Client1 Client LAN X Client1 Client LAN 1
Network Oriented Defenses VPN Firewalls - use of Cisco PIX VPNs as a first line of defense on the WAN Network Hardening - TCP/IP settings, no ARP, OS patches Autonomic Distributed Firewall Cards (ADF) - only allow necessary communication encrypted over VPGs Network Detection - Signature based monitoring via Emerald NIDS appliances - Heartbeats to monitor liveliness Automatic adaptive network reconfiguration - isolate machines via ADFs - rate limiting and Access Proxy selection Core: Quadrant Isolation Switches - isolate power to corrupted core quads Core: Crumble Zone with Access Proxies - first line of host defense (like a DMZ) Core: Managed Switches - restrict communication via source port filtering
The Defended JBI QUAD 1 QUAD 2 QUAD 3 QUAD 4 Executive Zone Q1SM Q2SM Q3SM Q4SM Q1PS Q2PS Q3PS Q4PS Operations Zone Q1CORR Q2CORR Q3CORR Q4CORR Q1PSQ Q2PSQ Q3PSQ Q4PSQ Q1DC Q2DC Q3DC Q4DC Q1NIDS Q2NIDS Q3NIDS Q4NIDS Q1AP Q2AP Q3AP Q4AP Crumple Zone VPN Router VPN Router VPN Router VPN Router Layer 3 Switch SELinux Solaris VPN Router Windows NIDS ADF NIC Bump in the wire Client 1 Managed Switch Client N SPAN Port Client LAN 1..4
Results from the Red Team Exercise (3/05) Main objective: Determine whether the defense-enabled JBI could survive 12 hours of sustained attacks and complete its mission. Red Teams had high privilege access to the WAN switch and full access to the DPASA code. Red Team A - Flood of replayed ISAKMP causes DoS at the VPN router - However, the red team had no insight into the effectiveness of the attack and continues with unsuccessful attacks. Red Team B - Zero day attack involving the high-privileged trunk access on the WAN switch to cause DoS at the VPN router. Besides the availability of the VPN routers, neither confidentiality nor integrity were breached.
