Xem mẫu
An Introductory Study on Business Intelligence Security
decision engine or rule tuner will run automati-cally according to a machine-learning algorithm and tune or adjust the parameters or thresholds to block the attack from the source.
Intrusion Prevention Techniques
As intrusion prevention techniques mainly con-centrate on authentication, there are four major approaches for code security that have emerged as mentioned in Drinic and Kirovski (2004): code VLJQLQJVDQGER[HV¿UHZDOODQGSURRIFDUU\LQJ code.
of overlapping of program execution and MAC PHVVDJHDXWKHQWLFDWLRQFRGHYHUL¿FDWLRQ7KLV platform partitions a program binary into blocks of instructions. Each block is signed using a keyed MAC that is attached to the footer of the block. :KHQWKHFRQWUROÀRZUHDFKHVDSDUWLFXODUEORFN its instructions are speculatively executed, while GHGLFDWHGKDUGZDUHYHUL¿HVWKHDWWDFKHG0$& at run-time. In the case that the integrity check fails, the current process will be aborted by the processor. Together with a software optimization technique that aims at reducing the performance RYHUKHDGLQFXUUHGGXHWRUXQWLPH0$&YHUL¿FD-tion, this platform had shown an overhead reduc-
• Code signing: Signing a program binary for authentication purposes is conceptually the simplest code security technique. In this case, authentication is done according to standardized authentication protocols.
• Sandbox: Sandbox is designed at the secu-rity layer to protect the application against malicious users and the host from malicious applications.
• Firewall:Firewalling technique is used for code security to conduct comprehensive examination of the provided program at the very point where it enters the respective domain.
• Proof carrying code: This is a mechanism by which the host system can determine with certainty that it is safe to execute a program provided by a distrusted source. This is ac-complished by requesting that the source provides a security proof that attests to the FRGH¶VDGKHUHQFHWRDKRVWGH¿QHGVHFXULW\ policy.
Performance results based on these approaches
tion of up to 90% from experimental results. As mentioned in Reynolds et al. (Reynolds,
Just, Clough, & Maglich, 2003), security related IDXOWVVXFKDVLQGHVLJQSURJUDPVDQGFRQ¿JXUD-tion could propagate from machine to machine and are likely to be repeatable in time; thus, demanding more innovative and improved fault diagnosis, machine learning, and system adapta-tion techniques for intrusion prevention. The ap-proach used in Reynolds et al. (2003), therefore, is to augment the standard fault-tolerant techniques such as failure detection, failfast semantics, re-dundancy, and failover with active defenses and design diversity. Using this approach, repeatable errors are prevented by an out-of-band control V\VWHPWKDWPRGL¿HVWKHV\VWHPVHFXULW\SRVWXUH in response to detected errors.
In short, the approach is built with hardware and software setups that compliment each other. 7KHKDUGZDUHLVFRQ¿JXUHGLQVXFKDZD\WKDW there is no direct communication possible be-tween the primary and backup. The potential for propagation from the primary to the out-of-band (OOB) machine is limited by constraining and
are not satisfactory for overcoming buffer over-ÀRZH[SORLWWKHUHIRUHUHVHDUFKHUVLQ`ULQLFDQG Kirovski (2004) provided a hardware-assisted intrusion prevention platform that makes use
monitoring the services and protocols by which OOB communicates with the primary. Failover is controlled by the mediator/adapter/control-ler (MAC) on the OOB machine. When failure
284
An Introductory Study on Business Intelligence Security
occurs, possibly caused by intrusion, continued service to the end user is provided by promoting the backup to be the new primary.
Other techniques that are discussed in Reyn-olds et al. (2003) also involve:
As for the software architecture, it consists of the following components:
• Diversity:This has two different Web serv-ers operating on the primary and backup based on the assumption that an exploit
• Web server protective wrapper: This wrapper monitors calls to dynamic link OLEUDULHV `//V IRU ¿OH DFFHVV SURFHVV execution, memory protection changes, and other potentially malicious functions. When LWGHWHFWVDYLRODWLRQRIVSHFL¿HGEHKDYLRU it will alert, disallow, or modify the call, depending on set policies.
• Application monitor: This application PRQLWRU LPSOHPHQWV VSHFL¿FDWLRQEDVHG behavior, monitoring critical applications accordingly.
• Host monitor: This host monitor commu-nicates with MAC and sends alerts. It has the capability to restore a failed primary to a healthy backup and is responsible for continual repair.
• Forensic agent:7KLVDJHQWDQDO\]HVD³ORJ´ that contains recent requests to determine
against one product of a type of software will seldom work against another product of the same type; thus, although the exploit succeeded on one, it should not propagate to the other.
• Random rejuvenation: This is a counter-measure for an intrusion that may become part of a legitimate process over time (e.g., PDOLJQWKUHDGVWKDW³OLYH´ZLWKLQDSURFHVV ³VOHHS´IRUDQLQGH¿QLWHOHQJWKRIWLPHWKHQ ³ZDNHXS´WRGRGDPDJHE\UDQGRPO\LQL-tiating a failover with the average internal between random failovers.
• Continual repairs: This is to detect un-DXWKRUL]HG ¿OH DFFHVVHV GXH WR ZUDSSHG failure or other unknown vulnerabilities to accelerate recovery; detect, and correct continuously.
which request(s) may have caused the fail-ure.
• Sandbox:This sandbox consists of an exact duplicate of the machine and application that failed. If a suspicious request received from Forensic Agent causes the same conditions in the Sandbox that resulted in failover of WKHSULPDU\RUEDFNXSWKHQLWLVLGHQWL¿HG DVD³%DG5HTXHVW´
&RQWHQW¿OWHU7KLV¿OWHUFRQVLVWVRIDOLVWRI ³%DG5HTXHVWV´,WJHQHUDOL]HVEDGUHTXHVWV LGHQWL¿HGE\)RUHQVLF$JHQWVRWKDWVLPSOH variants are also blocked; hence, previously unknown attacks are automatically and immediately prevented from repeatedly causing failover.
Weaknesses of ID and IP Techniques/Models
Although it is feasible to integrate ID and IP techniques into a BI system security framework, the weak points of these techniques must not be ignored as well. Bearing in mind the downsides of the techniques could enable future research to improve further on them for best performances. This section shall thus review the weaknesses of the models that employ ID, IP, or some other security techniques.
As mentioned earlier, a signature-based in-trusion detection technique is ideal for detecting known attacks but not able to detect new attacks. Anomaly-based technique, on the other hand, is able to detect new attacks but at the same time
285
An Introductory Study on Business Intelligence Security
causes a high false positive rate. Intrusion-pre-vention techniques using authentication and code security are not ideal also. Authentication using user id and encrypted password or encrypted da-tabase requires a good and secure cryptographic algorithm! As mentioned in Drinic and Kirovski VHFXULW\FRGHDSSURDFKHVXVLQJD¿UHZDOO code signing, or sandbox do not provide satisfac-tory performance results for overcoming buffer RYHUÀRZH[SORLWV
A study in Botha et al. (Botha, Solms, Perry, Loubser, & Yamoyany, 2002) proposed to improve the intrusion-monitoring functionality in an intru-sion detection system based on the assumption that the intruders’ behaviours could be grouped into common generic phases, and that all users’ actions on the system could be monitored in terms of these phases. However, when the underlying as-sumption changes, which is most likely overtime, as intruders’ behaviours change, so the intrusion phases have to change as well. This shall render the model lacking in consistency.
In a study on security modelling in Brennan et al. (Brennan, Rudell, Faatz, & Zimmerman, WKHUHVHDUFKHUVSURYLGHGDVSHFL¿FDWLRQ for modelling security designs in graphical rep-resentation. And, to model system and security administration, it shall require building separate administration diagrams as the security require-ments and controls are different. As a result, the PRGHOODFNVWKHFRQVLVWHQF\HI¿FLHQF\DQGQRW being optimized to model security designs across different platforms.
In another security modeling study in Col-lins et al. (Collins, Ford, & Thuraisingham, 1991), security-constraint processing is used to secure database query and update based on the assumption that security administration would generate an initial set of security constraints. As LWLVGLI¿FXOWWRJHQHUDWHDFRQVLVWHQWLQLWLDOVHW RIVHFXULW\FRQVWUDLQWVLWLVHYHQPRUHGLI¿FXOW to verify the completeness of this initial list of security constraints. Consequently, the model lacks consistency and completeness.
BUSINESS INTELLIGENCE SECURITY: A WEB SERVICE CASE STUDY
As concluded in Reynolds et al. (2003), these fault-tolerant techniques can indeed provide a means for detecting and preventing online cyber-attacks. However, future works are still required for extending these techniques in more complex real-world applications. This opens up a feasible opportunity for ID and IP to be integrated into a BI system — a complex real-world applica-tion, be it a business performance management (BPM) system, customer relationship manage-ment (CRM) system, supplier chain management (SCM) system, or e-commerce!
As mentioned in Ortiz (2002), the trend in BI application is going to be Web services enabled. As Web services are platform-neutral designed to ease and deliver BI results across platforms over the intranets and Internet, be it wired or wireless, real time and ad hoc, companies can make use of these technologies to access and analyze data in multiple locations, including information stored by partners and suppliers. Due to the fact that BI applications are going to be mainly Web services enabled in the future, users accessing through the Internet in real time, whether wired or wireless, the knowledge capital and data warehouse that are stored in centralized servers, are going to in-crease in numbers. Consequently, BI applications are still susceptible to all the common security threats such as denial of service, virus attack, ³VQLIIHU´DWWDFN³HYLOWZLQV´DWWDFNGLFWLRQDU\ DWWDFNDQGEXIIHURYHUÀRZH[SORLWPHQWLRQHGLQ an earlier section. As a result, a tighter security IUDPHZRUNWKDWLQFOXGHV,`DQG,3VLVGH¿QLWHO\ required to be integrated into the BI enterprise architecture.
Subsequently, further study on BI secu-rity can be started off with a Web-service case study. In this case study, as shown in Figure 2 — Web-service case study set up, various secu-ULW\WKUHDWVVLJQL¿FDQWWRWKH%,HQYLURQPHQWWR
286
An Introductory Study on Business Intelligence Security
Figure 2. Web-service case study set-up
check unauthorized access are to be simulated DQGLGHQWL¿HG&RXQWHUPHDVXUHVXVLQJ,`DQG,3 mechanisms are then designed and constructed. This prototype design consisting of ID and IP security method is then incorporated into exist-ing security framework as an enhanced security framework for BI as mentioned in the previous section. Unauthorized user access with security threats through the intranet/Internet, be it net-ZRUNHGRUZLUHOHVVDUH¿OWHUHGXVLQJLQWUXVLRQ detection and intrusion prevention techniques. This framework shall ensure that only genuine and authorized user accesses are allowed.
CONCLUSION
However, due to the fact that weaknesses do exist in models employing ID and IP techniques, more innovative researches have to continue to be car-
ried out to improve both the signature-based and anomaly-based intrusion detection techniques.
In general, for example, better and more in-novative data-mining techniques could be em-ployed in data collection and data analysis so as to reduce the overloading of unnecessary data and subsequently reducing the false positive/negative alarm rates. Better algorithms for response/pat-tern matching of intrusions data, for machine learning and retraining of data should also be explored extensively. As for intrusion prevention, improvement on network/communication protocols for both wired and wireless should also jump onto this bandwagon for innovative research of ID and IP. In addition, using biometrics for authentica-tion should be set as a future norm in parallel with improved cryptographic algorithms. Firewall, honeypot, and code security shall continue to be used perhaps with greater ingenuity and innovation for continuous improved performance.
287
An Introductory Study on Business Intelligence Security
In particular, more innovative researches should be carried out in the area of wireless and mobile ad hoc networks, for example in Zhang et al. (Zhang, Lee, & Huang, 2003), the research-ers had examined the vulnerabilities of wireless networks and argue that intrusion detection must be included in the security architecture for mobile computing environment. They have thus devel-oped such security architecture with distributed and cooperative features catering for anomaly detection for mobile ad hoc networks. Although experimental results from this research had also shown good performance and effectiveness, but as these researchers mentioned, new techniques must continue to be developed to make intrusion detection and prevention work better for the ever-evolving wireless networks.
All in all, it can be concluded, as shown in the Web-service case study, that intrusion detection and prevention is feasible and must be included in BI’s security architecture. This shall ensure a tighter security, subsequently protecting the knowledge base or assets of the enterprise from being unduly tampered with or used in an un-authorized manner since the knowledge base is, indeed, too valuable to allow for exploitation!
REFERENCES
Baroudi, S., Ziade, H., & Mounla, B. (2004). Are we really protected against hackers? InProceed-ings of 2004 International Conference on Infor-mation and Communication Technologies: From Theory to Applications (pp. 621-622).
Botha, M., Solms, R. V., Perry, K., Loubser, E., &
nguon tai.lieu . vn