Search

A billing infrastructure is an information and communications technology system that bills a set of customers for some service they access. We discuss how the minimisation of the infrastructure cost may introduce components that are points of catastrophic failure in a security perspective because successful attacks against these components result in a full control of the infrastructure. We describe a classification of both attacks and threats and a mathematical model of attack impacts to prove that the introduction of points of catastrophic failure result in a heavy-tailed probability distribution of impacts. A heavy-tailed distribution has several implications on risk management because the probability of very large impacts may not be neglected and countermeasures cannot be selected according to their cost effectiveness because even the most expensive ones are convenient. For these reasons, risk management should introduce redundant components with a decentralised control to increase resilience and minimise attack impacts.

Conditional security assesses the security of an information and communication system in a specific context. A fundamental step of the assessment determines the threats of a system and the attack they can implement. Constrained attack automata are finite state automata to formally describe this step by decomposing complex attacks into sequences of elementary attacks. Each state of the automata corresponds to a set of components of the system controlled by the attacker while a final state models the success of a sequence of attacks that has enabled a threat to reach one of its goals. Each transition of the automata can occur provided that some constrains on the amount of computational resources, the skills and the knowledge required to implement the corresponding elementary attack are satisfied. To exploit these automata, each threat is modeled in terms of the amount of computational resources, skills and knowledge it can access. In turn, this amount is modeled as a tuple of elements where each element belongs to a partially ordered set. By comparing the amount of resources a threat can access against that an attack requires, we determine whether the threat can implement the attack. The attacks that can occur are an input of a risk mitigation step that defines static and dynamic countermeasures to be applied. A static countermeasure prevents the successful execution of an attack by removing a vulnerability and it is modeled by pruning some automata transitions. Instead, dynamic countermeasures are modeled as actions executed as the attack goes on to stop it. Lastly, we discuss redundancy to take into account error or fault in countermeasure implementation.