{"title":"On a /spl mu/-kernel based system architecture enabling recovery from rootkits","authors":"J. Grizzard, H. Oen","doi":"10.1109/IWCIP.2005.16","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.16","url":null,"abstract":"We present a system architecture called spine that supports detection and recovery from many kernel-level and user-level rootkits. The architecture forms a reliable basis for an intrusion recovery system (IRS). The spine architecture is a multi-tiered approach, relying on the integrity of a small /spl mu/-kernel based hypervisor for correctness at the base level. Spine vertebrae are positioned at each level in the system in order to overcome the semantic gap in the understanding of system state. We discuss the design of the system, highlighting the main advantages and disadvantages from other approaches. A series of attacks are conducted against the prototype system in order to test for correctness and time to recover. Finally, some system performance benchmarks are presented that show that a small performance penalty is incurred from the increased reliability.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126197501","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Critical telecommunications infrastructure protection in Brazil","authors":"E.K. Bezerra, E. Nakamura, S. Ribeiro","doi":"10.1109/IWCIP.2005.7","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.7","url":null,"abstract":"Critical infrastructure protection is a concern that directly affects not only companies or governments, but also whole countries. This project focuses specifically on the telecommunications infrastructure, upon which many other critical infrastructures are dependent. This paper presents a model for critical infrastructure protection and a set of four methodologies that support the model, the first of which is MCI (methodology for critical infrastructure identification). MCI considers social, political and economic aspect to define the actual context of a country and, based on this context, it is possible to identify exactly which portions of the infrastructure can be considered critical. Application of MCI to the Brazilian telecommunications sector is demonstrated.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"101 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115530709","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Critical infrastructure awareness required by civil emergency planning","authors":"E. Luiijf, M. Klaver","doi":"10.1109/IWCIP.2005.6","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.6","url":null,"abstract":"Modern societies are increasingly dependent on a set of critical products and services, which comprise the critical infrastructure (CI). This makes critical infrastructures increasingly important as a planning factor in case of emergencies. For that reason, we studied a number of emergencies and a small set of local emergency plans from the perspective of how first responder currently take critical infrastructures into account. Our initial analysis indicates that civil emergency plans lack consideration for critical infrastructures. First responders, such as police and fire brigades, are often unaware of that their operations and non-evacuated citizens depend on critical infrastructure. Therefore, we recommend that emergency preparedness plans, training, situational awareness, and the decision-cycle of first responders and emergency management need to pay more attention to critical infrastructures. This decreases the risk that emergencies are worsened due to second-order effects of failing infrastructure, those emergency operations themselves are hampered, and that more casualties occur.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129097344","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The need to improve local self-awareness in CIP/CIIP","authors":"S. Bologna, R. Setola","doi":"10.1109/IWCIP.2005.19","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.19","url":null,"abstract":"Interdependences represent one of the most relevant elements in the actual techno-social scenario. Indeed, especially due to the wide spread of ICT, we observe an exponential increase in the points of contact among the different infrastructures. This phenomenon is largely due to (or induced by) the increased need to exchange information among large communities of users and stakeholders in order to improve efficiency, to reduce costs and to supply innovative services. Unfortunately, these interdependencies have dramatically increased the level of complexity and introduced, as emphasised by some recent episodes, new and very dangerous vulnerabilities. The need to improve robustness and resilience of the system of systems composed by the different interdependent infrastructures represents a very hard challenge for the next years. In the paper we emphasize that, from the technological point of view, strategies to reach this goal should be based on a better use of information. Indeed in the presence of global threats, we need to improve the local capability to autonomously react to anomaly situations. This capability is largely related, further to an amount of distributed intelligence, to our ability to improve information gathering (from environment) and sharing (among infrastructures). However, as stressed in the paper, technology is just one dimension along which we have to work; indeed, we should consider also social, economical and political activity: critical infrastructure protection is a global task, it calls for global solution.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132381375","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A case for protocol dependency","authors":"Juhani Eronen, M. Laakso","doi":"10.1109/IWCIP.2005.1","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.1","url":null,"abstract":"Vulnerabilities infest information technology. There is a lack of tools in risk assessment for understanding the impact that the disclosed vulnerabilities have on the critical information infrastructures. To address this need, this work derives a new dimension of dependency from practical vulnerability work, namely that of protocol dependency. Classic technology dependency views were reviewed, a chain of systematic vulnerability disclosures was followed as a case study and analysis revealed evidence of protocol dependency. Extrapolating from the experiences of a complex case, this new dependency dimension can be modelled. The model will benefit from going beyond a narrow technical view.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115576348","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Intelligent distributed autonomous power systems (IDAPS) and their impact on critical electrical loads","authors":"M. Pipattanasomporn, S. Rahman","doi":"10.1109/IWCIP.2005.14","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.14","url":null,"abstract":"The transition toward deregulation and profit-driven operation of power systems has led to a decrease of reserves and reliability levels in various parts of the electric power network which is the backbone of the nationwide critical infrastructure. In order to improve the adequacy and security of power systems, we propose the concept of intelligent distributed autonomous power systems (IDAPS). IDAPS is a network of several interconnected sub-networks that are cellular in structure and can operate autonomously in the event of a system fault. Each sub-network (cell) is given enough generating capacity to secure critical loads, as well as the ability to communicate internally among generation, loads and electronic control devices. The IDAPS concept, therefore, ensures an uninterrupted supply of electricity to the high priority loads, thus maintaining the integrity of the critical infrastructure. This paper defines the concept, components and architecture of IDAPS, and demonstrates how the electronic control concept can be applied.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132791332","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Humans as a critical infrastructure: public-private partnerships essential to resiliency and response","authors":"J. Barnes, K. Newbold","doi":"10.1109/IWCIP.2005.13","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.13","url":null,"abstract":"Considerable expense and resources have been dedicated to the analysis, maintenance, and security of the critical infrastructures. However, additional effort should be expended in the consideration of humans as a critical infrastructure. Human interpersonal networks, intelligence, capacity for innovation, and characteristics as a resilient complex system are only a few examples of how humans are not only an integral component of the traditional infrastructures, but also are infrastructures in and of themselves. One of the implications of viewing humans as a critical infrastructure is a need to ensure their security. Public-private partnerships and community level efforts to foster individual and community resiliency offer tangible measures of ensuring the security of this overlooked critical infrastructure.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"80 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130184831","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"GIS-based command and control infrastructure for critical infrastructure protection","authors":"S. Wolthusen","doi":"10.1109/IWCIP.2005.12","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.12","url":null,"abstract":"Critical infrastructure components are often dispersed over large areas; at the same time even an infrastructure individual component relies on a significant number of parameters that must be controlled and monitored in addition to interdependencies with other infrastructure components. Modeling and simulation of infrastructure elements and particularly of interdependencies and risks to those elements can be performed on the basis of a geographical information system providing a common semantic basis for presentation and analysis as well as a mechanism for sharing only selected and where necessary downgraded information with other infrastructure operators.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134495480","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Risk management for critical infrastructure protection (CIP) challenges, best practices & tools","authors":"E. Adar, A. Wuchner","doi":"10.1109/IWCIP.2005.18","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.18","url":null,"abstract":"Risk management (RM) has become increasingly important in dealing with information and IT security over the past several years. This article aims at discussing the major challenges facing critical infrastructure protection (CIP) RM, and outlines several methods and best practice guidelines that can be used to cope with it, including: creating a RM framework and RM measurement criteria; usage of advanced risk analysis (RA) methods, and adoption of CIP models that can be used for RA; and development and implementation of RM tools. Use of RM tools can play a major role in this process, as it can raise the efficiency of RM activities, and decrease reliance on any individual RA specialist's knowledge. The contribution of such tools is even greater, when dealing with critical infrastructures; as it is very difficult for a single specialist to cope with the diversity and complexity of CIP risk assessment.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"116 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116263085","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A framework for real-time worm attack detection and backbone monitoring","authors":"T. Dubendorfer, A. Wagner, B. Plattner","doi":"10.1109/IWCIP.2005.2","DOIUrl":"https://doi.org/10.1109/IWCIP.2005.2","url":null,"abstract":"We developed an open source Internet backbone monitoring and traffic analysis framework named UPFrame. It captures UDP NetFlow packets, buffers it in shared memory and feeds it to customised plug-ins. UPFrame is highly tolerant to misbehaving plug-ins and provides a watchdog mechanism for restarting crashed plug-ins. This makes UP-Frame an ideal platform for experiments. It also features a traffic shaper for smoothing incoming traffic bursts. Using this framework, we have investigated IDS-like anomaly detection possibilities for high-speed Internet backbone networks. We have implemented several plug-ins for host behaviour classification, traffic activity pattern recognition, and traffic monitoring. We successfully detected the recent Blaster, Nachi and Witty worm outbreaks in a medium-sized Swiss Internet backbone (AS559) using border router NetFlow data captured in the DDoSVax project. The framework is efficient and robust and can complement traditional intrusion detection systems.","PeriodicalId":393991,"journal":{"name":"First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05)","volume":"66 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123537594","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}