Optimizing networks microsegmentation policy for cyber resilience
Described herein is a system and method for improving cyber resilience for determining an optimal security policy for a network. The system uses an objective function to balance cyberattack risks, accessibility to network resources, resource limitations, minimum mission availability requirements within a network environment, or a combination thereof. The objective function comprises objectives (one or more variables that enhance accessibility to network resources and reduce cyberattack risks) and constraints (one or more variables that characterize resource limitations or minimum mission availability requirements within a network environment). The optimal security policy is selected by solving one or more optimization problems. The optimization problem may be solved by determining candidate security policies that meet the constraints and selecting among candidate security policies having the highest score for a given objective function.
1 . A method for providing a security access-control policy to a network, the method comprising:
defining a model representing an accessibility of an attacker within the network, one or more availability needs of the network, and candidate security policy rules for the network;
determining one or more constraints associated with at least one of: (a) one or more resource limitations of the network and (b) one or more minimum availability requirements for the network;
determining, based on the model, a plurality of candidate security policies that meet the one or more constraints, and
selecting the security access-control policy from the plurality of candidate security policies based on one or more objectives associated with at least one of: accessibility to network resources and reduction of cyberattack risks.
2 . The method of claim 1 , wherein the accessibility of an attacker within the network, the one or more availability needs of the network, and the candidate security policy rules for the network are represented by an attack matrix, a mission matrix, and a policy rule matrix respectively.
3 . The method of claim 2 , wherein determining, based on the model, the plurality of candidate security policies comprises finding paths in the attack matrix and corresponding paths in the mission matrix.
4 . The method of claim 2 , wherein the one or more objectives comprise minimizing a total weight of one or more blocked mission edges between host pairs in the mission matrix.
5 . The method of claim 1 , wherein the one or more objectives comprise minimizing a number of blocked edges in the model.
6 . The method of claim 1 , wherein selecting the security access-control policy from the plurality of candidate security policies comprises:
forming an optimization problem using the one or more objectives and the one or more constraints; and
solving the optimization problem at least in part by:
determining a score for each candidate security policy in the plurality of candidate security policies in meeting the one or more objectives, and
selecting the security access-control policy from the plurality of candidate security policies based on the score.
7 . The method of claim 6 , wherein defining the model comprises:
determining a hardened attack matrix by applying a policy rule matrix to an attack matrix;
determining a hardened mission matrix by applying the policy rule matrix to a mission matrix,
wherein the optimization problem is formed using the hardened attack matrix and the hardened mission matrix.
8 . The method of claim 6 , further comprising:
forming an additional optimization problem using one or more additional constraints and/or objectives, wherein the one or more additional constraints and/or objectives comprise a constraint or an objective to keep a mission impact within a predetermined budget.
9 . The method of claim 6 , further comprising:
forming an additional optimization problem using an objective to maximize a number of blocked shortest attack paths in the attack matrix.
10 . The method of claim 9 , wherein the blocked shortest attack paths are from one or more attack start hosts to one or more attack goal hosts.
11 . A system for providing a security access-control policy to a network, the system comprising:
one or more processors;
memory; and
instructions stored in the memory which, when executed by the one or more processors, cause the system to:
define a model representing an accessibility of an attacker within the network, one or more availability needs of the network, and candidate security policy rules for the network;
determine one or more constraints associated with at least one of: (a) resource limitations of the network and (b) minimum availability requirements for the network;
determine, based on the model, a plurality of candidate security policies that meet the one or more constraints, and
select the security access-control policy from the plurality of candidate security policies based on one or more objectives associated with at least one of:
accessibility to network resources and reduction of cyberattack risks.
12 . The system of claim 11 , wherein the accessibility of an attacker within the network, the one or more availability needs of the network, and the candidate security policy rules for the network are represented by an attack matrix, a mission matrix, and a policy rule matrix respectively.
13 . The system of claim 12 , wherein determining, based on the model, the plurality of candidate security policies comprises finding paths in the attack matrix and corresponding paths in the mission matrix.
14 . The system of claim 12 , wherein the one or more objectives comprise minimizing a total weight of one or more blocked mission edges between host pairs in the mission matrix.
15 . The system of claim 11 , wherein the one or more objectives comprise minimizing a number of blocked edges in the model.
16 . The system of claim 11 , wherein selecting the security access-control policy from the plurality of candidate security policies comprises:
forming an optimization problem using the one or more objectives and the one or more constraints; and
solving the optimization problem at least in part by:
determining a score for each candidate security policy in the plurality of candidate security policies in meeting the one or more objectives, and
selecting the security access-control policy from the plurality of candidate security policies based on the score.
17 . The system of claim 16 , wherein defining the model comprises:
determining a hardened attack matrix by applying a policy rule matrix to an attack matrix;
determining a hardened mission matrix by applying the policy rule matrix to a mission matrix,
wherein the optimization problem is formed using the hardened attack matrix and the hardened mission matrix.
18 . The system of claim 16 , wherein the system is further caused to:
form an additional optimization problem using one or more additional constraints and/or objectives, wherein the one or more additional constraints and/or objectives comprise a constraint or an objective to keep a mission impact within a predetermined budget.
19 . The system of claim 16 , wherein the system is further caused to:
form an additional optimization problem using an objective to maximize a number of blocked shortest attack paths in the attack matrix.
20 . The system of claim 19 , wherein the blocked shortest attack paths are from one or more attack start hosts to one or more attack goal hosts.