Subcomponents. The SecaaS component is composed of some subcomponents, which belong to the aforementioned technology. In this sense, this solution is based on the ETSI GS NFV-SEC 013 specification [3], where different subcomponents are added to the initial architecture proposed for the NFV technology. The subcomponent architecture – and their interaction with other PALANTIR components – is presented in Figure 8 in more detail using the work performed during the first implementation and integration phase.
Subcomponents. The TAR achieves its role in the PALANTIR architecture through three subcomponents, each implementing specific functions: • The Attestation Engine (AE) monitors SCHI by leveraging the Trusted Computing paradigm and extending it with runtime verification. Trusted Computing is the security paradigm, promoted by the Trusted Computing Group (TCG) [4] that builds on Roots of Trust (RoT) to protect critical data (e.g., cryptographic keys, secrets) and to detect subversion of the hardware, firmware, software, or configurations. In Trusted Computing, any firmware or software component is responsible for measuring any code or data that is security critical and to record the measurement in a RoT. This recursive architecture stops at the initial boot vector of a platform and the RoT, which together are called the Trusted Computing Base: the minimal set for component that are inherently trusted because their misbehaviour cannot be detected (i.e., they are not measured before being used). When the TAR wants to verify the integrity of a platform, the RoT is queried to securely retrieve the list of measurements recorded since boot through the Attestation Agent hosted in SCHI. Then the TAR compares this list of measurements with the expected software and configuration of the platform: an incorrect, missing, or additional measurement evidences an unexpected security posture of the platform: this protocol is called remote attestation. The expected baseline set of measurements are generated by a Reference Measurement plugin that is deployed in the SCO. This trust and attestation solution can be implemented using a Trusted Platform Module (TPM) [5] as the RoT, leveraging the Measured Boot feature of UEFI [6] and the Grub2 bootloader [7], and the Linux Integrity Measurement Architecture [8] on the platforms of the SCHI. While Trusted Computing mainly focuses on boot- and load-time measurement, coupled with periodic remote attestation, PALANTIR also supports runtime verification. The TAR leverages the memory inspection capability of the platform, when present, to detect any unexpected change of code or data already loaded in memory. Finally, the TAR verifies the hardware of the platforms by ensuring that their components have not been changed since manufacture – unless an authorised hardware modification happened. While such verification can be done through manual inspection of the platforms, the TAR automates such verification by leveraging emerging technologies in that field,...
Subcomponents. The PALANTIR Portal implements the aforementioned functionalities through some subcomponents, with the most important functionality being the real-time information stream, which depicts the current status of the infrastructure as well as any identified problems and alerts in real-time. Integration in this case is of utmost importance, as most components have some interaction with the Portal and its related subcomponents, which are listed below: • Central Portal and Security Dashboard User Interface (UI): The central Portal is the entry point for theplatform’s UI Through it, and depending on the user, views from the various implemented tools and mechanisms become accessible. These views include risks identification, analysis and management aspects, policy definition aspects, infrastructure management and orchestration aspects and billing, account, and performance visualisation aspects. These views are combined in the Security Dashboard UI. Key views in the dashboard UI are accounting views for tracking of profits, costs and purchases, and the visualisations of security analytics. • User management component: In order to achieve access control as well as the differentiation of views per stakeholder, a user management component is in place. Users, access control lists, and roles are kept in this subcomponent. • Indicators of Compromise (IoC) Database: This subcomponent exposes an IoC database, which allows for storage and communication of technical and non-technical information about malware samples, incidents, attack patterns, defence intelligence and attacker profiles. The IoC database can store all such information in standardised formats, such as Structured Threat Information Expression (STIX) [21] or Trusted Automated Exchange of Intelligence Information (TAXII) [22]. • Correlation mechanism: Automatic correlation mechanism that, by discovering relationships between attributes, can help when similar situations occur in different organizations. The attributes that, through correlation, provide recommended solutions, are indicators of malware, incidents, attacker profiles, and security intelligence. This mechanism makes heavy use of the IoC database for both storage and retrieval. This component facilitates knowledge sharing with Computer Emergency Response Teams (CERT) and Computer Incident Response Teams (CSIRT).
Subcomponents. The Attestation Engine is a distributed system that has subcomponents distributed throughout the PALANTIR infrastructure in order to maintain trustworthiness of the system.
Subcomponents. The FBM (Figure 6) is a fully virtualized system that consists of the Incidence Response (IR) and Recovery Service (RS) subcomponents. Both subcomponents are designed to carry out personalized intervention defined as a Finite State Machine (FSM). In more detail, the purpose of the FBM component is as follows: • A Finite State Machine (FSM) is a computing model that may be used to mimic sequential logic or to describe and regulate an execution flow. A state machine is a behaviour model with a finite number of states. Based on the current state and a provided input, the machine performs state transitions and creates outputs. A state is a description of a system's current state as it awaits the execution of a transition. • IR engine: a PALANTIR-protected infrastructure hosts one IR instance that is responsible for triggering mitigation policies when a threat/attack related to data breach is detected by the TI. • RS Engine: a PALANTIR-protected infrastructure hosts one RS instance that is responsible for triggering recovery policies when attestation faults are detected. In addition to automation and mitigation services offered by the SCO, the FSMs also include alerts/messages and interventions that require human intervention. In such cases, notifications or requests can be sent to the Dashboard based on the FSM result. The notification or request can then be handled by the PALANTIR operator.
Subcomponents
