petri net modelling of physical vulnerability

Download Petri Net Modelling of Physical Vulnerability

Post on 21-Jun-2015

239 views

Category:

Technology

4 download

Embed Size (px)

DESCRIPTION

The sildes are relative to the presentation of an omonymous paper at the 6th international conference on critical information infrastructure security (CRITIS 2011).The paper is about the evaluation of the vulnerability of a physical protection system by the use of an extensible and customizable Petri Net model.

TRANSCRIPT

  • 1. Petri Net Modellingof Physical Vulnerability F. Flammini, S. Marrone, N. Mazzocca, V. Vittorini Stefano Marrone Dept.of Mathematics Second University of Naples CRITIS 2011 September 8-9, 2011 Luzern, Switzerland

2. Outline

  • Evaluation of physical protection
  • Challenges in vulnerability modelling
  • Petri Net vulnerability models
  • Evaluation on case studies
  • Conclusions

S. Marrone - Petri Net Modelling of PhysicalVulnerability 3. Evaluation of physical protection

  • Physical security needs quantitative risk assessement
    • Certification
    • design protections and countermeasures
    • cost/benefits tradeoffs
  • Mathematical and formal models must be used
    • risk assessement methodology
    • widespread in both academia and industry
    • simpler than analyzing the system!!

S. Marrone - Petri Net Modelling of PhysicalVulnerability 4. Evaluation of physical protection

  • Risk model:
  • R = PVD
  • Pros:
    • simple
    • effective
  • Cons
    • does not take into account mutual influences
    • not associated with a methodology

S. Marrone - Petri Net Modelling of PhysicalVulnerability Frequency of theThreat Likelihoodthat attack is successful Damagean attack provokes 5. Challenges in vulnerability modelling

  • Vulnerability
    • (information security):weakness of a system which allows attackers to reduce security
    • (physical security):probability for an attacker to have success against system protections
  • Hennesseys model

S. Marrone - Petri Net Modelling of PhysicalVulnerability effectiveness detection interruption neutralization sensing assessement 6. Challenges in vulnerability modelling

  • At language level
    • strong mathematical foundation
    • intuitive and user-friendly
  • At model level
    • usable
    • customizable
    • trustable

S. Marrone - Petri Net Modelling of PhysicalVulnerability Petri Nets Compositional extensible approach 7. Petri Net vulnerability Models

  • The models relate time intervals ( latencies ) withprobabilitiesof the Hennessey model
    • no deterrent effects (independence of PVD factors)
    • simple instantiation of system parameters
    • simple calculation of results (multiplication)
    • Probability of interruption (P I )

S. Marrone - Petri Net Modelling of PhysicalVulnerability 8. Petri Net vulnerability Models

  • Basic vulnerability model

S. Marrone - Petri Net Modelling of PhysicalVulnerability reaction delay (sensing, assessement, response) delay to accomplish attack 9. Petri Net vulnerability Models

  • Detecting failure
  • Complex Defense Path

S. Marrone - Petri Net Modelling of PhysicalVulnerability 10. Petri Net vulnerability Models

  • Two phased attack

S. Marrone - Petri Net Modelling of PhysicalVulnerability 11. Evaluation on case studies

  • Anti-theft ( e.g. critical server in a technical room)
  • P Iis evaluated by Petri Net analysis
  • P I= 34% V = 0.7

S. Marrone - Petri Net Modelling of PhysicalVulnerability Probability Latency Sensing (magnetic switches) P S= 98% L S= 5 sec Assessment (control room) P A= 95% L A= 45 sec Response (remote guards) P N= 95% L R= 180 sec Attack accomplishment (disconnect server and get out of room) L T=120 sec 12. Evaluation on case studies

  • CBRNe ( e.g. metro railway application)
  • P I= 29% V = 0.75

S. Marrone - Petri Net Modelling of PhysicalVulnerability Probability Latency Sensing (CBRNe detectors) P S= 95% L S= 15 sec Assessment (detection of source in crowded area) P A= 95% L A= 30 sec Response (local guards) P N= 95% L R= 30 sec Attack accomplishment (deflagrate, etc...) L T= 30 sec 13. Evaluation on case studies

  • CBRNe ( e.g. metro railway application)
  • What if:
    • Computer based assessementL A= 2 sec
    • Automatic blocking of turnstile doorsL R= 3 sec
  • P I= 60% V = 0.44

S. Marrone - Petri Net Modelling of PhysicalVulnerability 14. Conclusions

  • Physical vulnerability modelling can be a hard task because:
    • complexity and heterogeneity of systems
    • evaluation results must be trustable...
    • usability/completeness tradeoff
  • George E. P. Box (statistician)

S. Marrone - Petri Net Modelling of PhysicalVulnerability Essentially,all models are wrong, but some are useful 15. Safecomp 2011

  • International Conference on
  • Computer Safety, Reliability and Security
  • Naples, Italy
  • 19 / 21 September 2011 - Main Conference
  • 22 September 2011 - Tutorials and Workshops Day
  • Key theme
  • Safety and security of computer-based systems and infrastructures: from risk assessment to threat mitigation

S. Marrone - Petri Net Modelling of PhysicalVulnerability

Recommended

View more >