A Model For risk-Based adaptive security controls. Issue 115 (April 2022)

• Record Type: Journal Article
• Authors: Calvo, Miguel; Beltrán, Marta
• Is Part Of: Computers & security. Issue 115(2022)
• Publication Date: 2022-04
• Subjects: Adaptive security -- Context-aware decision making -- Dynamic security controls -- MAPE Loop -- Risk-based security; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102612
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: A new model capable of adapting security controls to different risk scenarios is presented, RiAS (Risk-based Adaptive Security). This adaptation can be performed automatically and in almost real-time using a three-layer architecture and a three-step flow. The proposed solution enables reactive or proactive parametric, architectural and behavioural adaptations with different timing strategies. A first implementation of the proposed model has been validated in a real use case involving a Web Application Filter. Abstract: Security controls and countermeasures have shifted from static desktop-based and corporate network environments to heterogeneous, distributed and dynamic environments (e.g., cloud and mobile computing or Internet of Things). Due to this paradigm shift, adaptive and risk-based approaches have gained significant importance. These approaches allow security managers to perform context-aware decision making, adapting controls' deployment, configuration or use to every specific situation, depending on the current value of risk indicators or scores and on the level of risk tolerated by the organisation at any given time. This paper proposes a model to automatically adapt security controls to different risk scenarios in almost real-time (if required). This model is based on a three-layer architecture and a three-step flow (measurement-decision-adaptation), relying on a scalable policies&rules framework capable of integrating with different kinds of controls. Furthermore, the proposed model is validated and evaluated with an actual use case.