Conception et réalisation d'un système standardisé de gestion de politiques de sécurité
Loading...
Date
2015-06-20
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
La gestion des politiques de sécurité est devenue de nos jours, un enjeu de taille pour les directions de systèmes d’informations. Avec l'évolution exponentielle des attaques, toute négligence risque de causer de grands dégâts, que ce soit sur le plan économique, politique ou même humain. Ainsi, pour garantir un maximum de sécurité, les grands leaders informatiques ne cessent de proposer et d'améliorer des nouveaux systèmes de sécurité.
Dans le cadre de notre projet, nous avons réalisé un système dédié à la gestion de politiques de sécurité au niveau d’un système d’exploitation Linux doté du module de contrôle d’accès obligatoire (MAC) SELinux en se basant sur le standard CIM/WBEM. Notre système permet de modéliser d’une manière abstraite des politiques traduites en règles SELinux simples (allow, auditallow, etc.), en modules et booléens SELinux ainsi qu’en règles de contrôle d'accès aux ports réseaux. Notre système repose sur une architecture adaptant les composants WBEM élémentaires à l’architecture standard d’un système de gestion de politiques (comme COPS). La traduction CIM/SELinux est réalisée par le Provider CIM-SELinux que nous avons développé et qui représente le noyau de notre travail car il assure d'un coté la traduction CIM de/vers SELinux et d'un autre coté le renforcement des politiques modélisées. Nous avons développé également un client CIM/WBEM permettant de faciliter la gestion des politiques à travers une interface graphique simple et conviviale.
Notre contribution représente une brique essentielle dans un écosystème de composants logicielles permettant d'assurer une gestion de politiques de sécurité abstraites et indépendantes des plate-formes en se basant sur un standard de gestion largement adopté et déployé (CIM/WBEM) L'efficacité d'un tel écosystème est tributaire de l’adaptation du même standard pour d’autres systèmes de sécurité (comme AppArmor, GrSecure, XACML, etc.) et ce défi représente la perspective de notre travail.
Security policy management has become today a major challenge for the supervision of information systems. With the exponential growth of the attacks, any negligence can cause great damages, whether economical, political or even human. Thus, to ensure maximum safety, large IT leaders constantly suggest and improve new security systems. As part of our project, we realized a system dedicated to managing security policies on operating system level with the Mandatary Access Control module SELinux based on CIM/WBEM standard. Our system allows abstractly modeling policies translated in various SELinux policies as simple rules (allow, auditallow, etc.) SELinux modules and booleans and control access rules over network ports. Our system is based on an architecture mapping WBEM elementary components to a standard policy management architecture (like COPS) The CIM-SELinux Provider we have been developed represents the core of our work since it ensures in one hand, CIM/SELinux translation and in the other hand policy enforcement. We have also developed a CIM/WBEM client to facilitate policy management through a simple and user-friendly graphical interface. Our contribution is an essential building block in an ecosystem of software components ensuring the management of abstract and platform independent policies based on a widely adopted and deployed management standard (CIM/WBEM). The efficiency of such an ecosystem is dependent on the adaptation of the same standard for other security systems (like AppArmor, GrSecure, XACML, etc.) and this challenge represents a future work.
Security policy management has become today a major challenge for the supervision of information systems. With the exponential growth of the attacks, any negligence can cause great damages, whether economical, political or even human. Thus, to ensure maximum safety, large IT leaders constantly suggest and improve new security systems. As part of our project, we realized a system dedicated to managing security policies on operating system level with the Mandatary Access Control module SELinux based on CIM/WBEM standard. Our system allows abstractly modeling policies translated in various SELinux policies as simple rules (allow, auditallow, etc.) SELinux modules and booleans and control access rules over network ports. Our system is based on an architecture mapping WBEM elementary components to a standard policy management architecture (like COPS) The CIM-SELinux Provider we have been developed represents the core of our work since it ensures in one hand, CIM/SELinux translation and in the other hand policy enforcement. We have also developed a CIM/WBEM client to facilitate policy management through a simple and user-friendly graphical interface. Our contribution is an essential building block in an ecosystem of software components ensuring the management of abstract and platform independent policies based on a widely adopted and deployed management standard (CIM/WBEM). The efficiency of such an ecosystem is dependent on the adaptation of the same standard for other security systems (like AppArmor, GrSecure, XACML, etc.) and this challenge represents a future work.
Description
Keywords
Policy Based Security Management, CIM/WBEM, SELinux, Systems and Network Management, CIM Policy Profile, CIM Simplified Policy Language (CIM-SPL), CIM Security profile, Systems and Networks Security