Risk Propagation Assessment for Network Security

Mohamed Slim Ben Mahmoud is a research engineer for the research group ResCo at the TELECOM laboratory of ENAC, the French national institution for civil aviation.Nicolas Larrieu is a teacher and researcher at the research group ResCo at the TELECOM laboratory of ENAC.Alain Pirovano is a teacher and researcher and head of the research group ResCo at the TELECOM laboratory of ENAC.

• LIST OF FIGURES ixLIST OF TABLES xiiiINTRODUCTION xvPART 1. NETWORK SECURITY RISK ASSESSMENT 1CHAPTER 1. INTRODUCTION TO INFORMATION SYSTEM SECURITY RISK MANAGEMENT PROCESS 31.1. On the importance of network security for network designers 51.2. On the impact of risk assessment in the decision-making process for network security designers 61.3. Quantitative versus qualitative risk assessment approaches 71.4. Network security risk propagation concept 101.4.1. Impact of node correlation 101.4.2. Network security risk transitivity 111.4.3. Network security risk propagation illustrative case 12CHAPTER 2. SECURITY RISK MANAGEMENT BACKGROUND 172.1. Qualitative security risk management methods 182.1.1. CRAMM 182.1.2. OCTAVE 182.1.3. EBIOS 192.1.4. MEHARI 192.1.5. CORAS 202.1.6. Discussion 202.2. Quantitative security risk assessment approaches 202.3. Toward a quantitative propagation-based risk assessment methodology 25CHAPTER 3. A QUANTITATIVE NETWORK RISK ASSESSMENT METHODOLOGY BASED ON RISK PROPAGATION 273.1. Quantifying methodology parameters 273.1.1. Network risk decomposition 283.1.2. Node value 293.1.3. Enhanced node value 303.1.4. Impact of threats 303.1.5. Likelihood of threats 323.2. Network security risk assessment process 363.3. Conclusion 39PART 2. APPLICATION TO AIRPORT COMMUNICATION NETWORK DESIGN 41CHAPTER 4. THE AEROMACS COMMUNICATION SYSTEM IN THE SESAR PROJECT 434.1. Overview of the European SESAR project 434.2. Overview of aeronautical communications operating concept and requirements 444.3. Introduction to the AeroMACS communication system 474.3.1. AeroMACS protocol stack 484.3.2. AeroMACS reference network architecture 504.3.3. AeroMACS security considerations 524.3.3.1. Analysis of AeroMACS security weaknesses 534.3.4. AeroMACS reference network topology 554.3.4.1. Isolated AeroMACS network architecture 554.3.4.2. End-to-end AeroMACS network architecture 56CHAPTER 5. AERONAUTICAL NETWORK CASE STUDY 595.1. Experimental parameters 595.1.1. Testbed infrastructure 595.1.2. Aeronautical node values instantiation 615.1.3. Aeronautical services instantiation 625.1.4. Isolated vs. end-to-end emulation scenarios 635.2. AeroMACS case study: experimental results 635.2.1. Main inputs for emulation scenarios 635.2.2. Isolated AeroMACS scenario: preliminary results 635.2.2.1. Individual risks 635.2.2.2. Propagated risks 685.2.2.3. Node and network risks 705.2.3. Isolated AeroMACS scenario: EAP vs. RSA sub-scenario 725.2.4. Preliminary AeroMACS security enhancement guidance 765.2.5. AeroMACS implementation improvements: isolated scenario without operational server vulnerabilities 775.2.5.1. Experimental inputs 785.2.5.2. Network topology 785.2.5.3. Vulnerability statistics 795.2.5.4. Individual risk results 815.2.5.5. Propagated risk results 815.2.5.6. Network risk results 835.2.6. AeroMACS topological improvements: isolated scenario with two ASN gateways 845.2.6.1. Experimental inputs 845.2.6.2. Network topology 855.2.6.3. Vulnerability statistics 855.2.6.4. Individual risk results 855.2.6.5. Propagation risk results 875.2.6.6. Network risk results 895.2.7. Scenario with end-to-end AeroMACS topology 915.2.7.1. Experimental inputs 915.2.7.2. Network topology 925.2.7.3. Vulnerability statistics 935.2.7.4. Individual risk results 955.2.7.5. Propagated risk results 975.2.7.6. Network risk results 975.3. Improving AeroMACS network security 995.3.1. DHCP security 1015.3.2. Mobile IP security 103CONCLUSION 109BIBLIOGRAPHY 111INDEX 117