Authors:
Stere Preda
1
;
Nora Cuppens-Boulahia
1
;
Frédéric Cuppens
1
;
Joaquin G. Alfaro
2
and
Laurent Toutain
1
Affiliations:
1
GET/ENST Bretagne, France
;
2
GET/ENST Bretagne; Universitat Oberta de Catalunya, Spain
Keyword(s):
Network Security, Security Devices, Security Rules, Deployment of Policies, Policy Anomalies.
Related
Ontology
Subjects/Areas/Topics:
Access Control
;
Data Engineering
;
Databases and Data Security
;
Information and Systems Security
;
Internet Technology
;
Web Information Systems and Technologies
Abstract:
We focus in this paper on the problem of configuring and managing network security devices, such as Firewalls, Virtual Private Network (VPN) tunnels, and Intrusion Detection Systems (IDSs). Our proposal is the following. First, we formally specify the security requirements of a given system by using an expressive access control model. As a result, we obtain an abstract security policy, which is free of ambiguities, redundancies or unnecessary details. Second, we deploy such an abstract policy through a set of automatic compilations into the security devices of the system. This proposed deployment process not only simplifies the security administrator’s job, but also guarantees a resulting configuration free of anomalies and/or inconsistencies.