Real-Time Evaluation of National Network Exposure to Emerging Threats

No ratings

Presented at OWASPindia 2012 by

Fyodor Yarochkin

This paper is real-world case study of national network exposure to emerging Internet threats. The main goal of this study is to understand the level of exposure of a national regional network (Taiwan national networking infrastructure is used as case study in this example) to emerging threats and be able to perform real-time monitoring of such exposure level. While over several thousands of vulnerabilities in software systems have been discovered through the period of ”Internet age”, the major number of these vulnerabilities does not pose risk to current infrastructure at any period of time and is merely of a historical interest. The actual threat primarily comes from the vulnerabilities, which are actively being exploited on the Internet. The number of such vulnerabilities is significantly smaller. Further, in order to understand the exposure level of national infrastructure, we need to have visibility on types and configuration systems, which are deployed across the national networks. In this study we aim to implement a platform, which integrates feeds from multiple data components in order to build national infrastructure data store. The platform would provide data mining capabilities in order to calculate the exposure level of the network infrastructure to actively exploited vulnerabilities. The knowledge of actively exploited vulnerabilities comes from a set of passive (server simulation) and active (web crawling) honeypot systems. All the data presented in this paper is collected from real network infrastructure across Taiwan. All the data presented in this paper is collected from real networks across Taiwan and sufficiently anonymised not to disclose the sources.