Table of Contents

Cover

Introduction

1 What is Cyber Threat Intelligence and How is it Evolving?

1.1. Introduction
1.2. Background
1.3. Cyber threat intelligence
1.4. Related work
1.5. Technical threat intelligence sharing problems
1.6. Technical threat intelligence limitations
1.7. Cyber threat intelligent libraries or platforms
1.8. Discussion
1.9. Evaluation of technical threat intelligence tools
1.10. Conclusion and future work
1.11. References

2 Trust Management Systems: a Retrospective Study on Digital Trust

2.1. Introduction
2.2. What is trust?
2.3. Genesis of trust management systems
2.4. Trust management
2.5. Classification of trust management systems
2.6. Trust management in cloud infrastructures
2.7. Conclusion
2.8. References

3 Risk Analysis Linked to Network Attacks

3.1. Introduction
3.2. Risk theory
3.3. Analysis of IS risk in the context of IT networks
3.4. Conclusion
3.5. References

4 Analytical Overview on Secure Information Flow in Android Systems: Protecting Private Data Used by Smartphone Applications

4.1. Introduction
4.2. Information flow
4.3. Data tainting
4.4. Protecting private data in Android systems
4.5. Detecting control flow
4.6. Handling explicit and control flows in Java and native Android appsʼ code
4.7. Protection against code obfuscation attacks based on control dependencies in Android systems
4.8. Detection of side channel attacks based on data tainting in Android systems
4.9. Tracking information flow in Android systems approaches comparison: summary
4.10. Conclusion and highlights
4.11. References

List of Authors

Index

End User License Agreement

List of Tables

Chapter 1

Table 1.1. Threat intelligence sources
Table 1.2. Threat intelligence sub-domains
Table 1.3. Reasons for not sharing
Table 1.4. Evaluation of threat intelligence tools

Chapter 2

Table 2.1. Example of an access control list
Table 2.2. Example of policies used in ATNAC (adapted from Ryutov et al. (2005))

Chapter 3

Table 3.1. Comparative table of risk analysis methods (ANSI 2014)

Chapter 4

Table 4.1. Basic rules for derivations
Table 4.2. Formal proof of the first rule
Table 4.3. Formal proof of the second rule
Table 4.4. Explicit flow propagation logic
Table 4.5. Third-party analyzed applications
Table 4.6. Third-party applications leaking sensitive data (L: location, Ca: cam...
Table 4.7. Tracking information flow in Android systems approaches comparison

List of Illustrations

Chapter 1

Figure 1.1. Typical steps of multi-vector and multi-stage attacks by Lookheed Ma...
Figure 1.2. The Diamond model of intrusion analysis
Figure 1.3. Trend of “threat intelligence” and “indicators of compromise” in cyb...
Figure 1.4. Count of indicators by days as observed in Verizon (2015) in at leas...

Chapter 2

Figure 2.1. A basic access control model (adapted from Genovese [2012])
Figure 2.2. An abstract IBAC model
Figure 2.3. Abstract lattice-based access control model
Figure 2.4. Basic role-based access control model (adapted from Genovese [2012])
Figure 2.5. The OrBAC model
Figure 2.6. Abstract attribute-based access control model
Figure 2.7. Illustration of the functioning of a trust management system
Figure 2.8. Functioning modes of a trust management system
Figure 2.9. Architecture of the TrustBuilder TMS

Chapter 3

Figure 3.1. Risk terminology
Figure 3.2. Overall EBIOS approach (Culioli et al. 2009)
Figure 3.3. General outline of the Mehari method (Ghazouani et al. 2014)
Figure 3.4. Phases of the OCTAVE method (Bou Nassar 2012)
Figure 3.5. Different classes of attacks on a web application of an IS
Figure 3.6. Models of the Impact and Probability of occurrence parameters
Figure 3.7. Proposed risk classification
Figure 3.8. Classification of Impact and Probability of occurrence
Figure 3.9. Risk classification
Figure 3.10. Bit alternation. For a color version of this figure, see www.iste.c...
Figure 3.11. Network architecture of the e-commerce company network
Figure 3.12. Secure network architecture
Figure 3.13. Risk analysis process

Chapter 4

Figure 4.1. Example of an explicit flow
Figure 4.2. Example of an implicit flow
Figure 4.3. Attack using indirect control dependency
Figure 4.4. Implicit flow example
Figure 4.5. Modified architecture to handle control flow in native code
Figure 4.6. Our approach architecture
Figure 4.7. CF-Bench results of our taint tracking approach overhead
Figure 4.8. Dynamic taint analysis process without obfuscation attack
Figure 4.9. The attack model against dynamic taint analysis
Figure 4.10. Code obfuscation attack 1
Figure 4.11. Log files of code obfuscation attacks
Figure 4.12. Code obfuscation attack 2
Figure 4.13. Code obfuscation attack 3
Figure 4.14. Target threat model
Figure 4.15. The modified components (blue) to detect side channel attacks. For ...
Figure 4.16. Leakage of private data through the bitmap cache side channels
Figure 4.17. Microbenchmark of Java overhead. For a color version of this figure...

First published 2019 in Great Britain and the United States by ISTE Ltd and John Wiley & Sons, Inc.

Apart from any fair dealing for the purposes of research or private study, or criticism or review, as permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored or transmitted, in any form or by any means, with the prior permission in writing of the publishers, or in the case of reprographic reproduction in accordance with the terms and licenses issued by the CLA. Enquiries concerning reproduction outside these terms should be sent to the publishers at the undermentioned address:

ISTE Ltd
27-37 St George’s Road
London SW19 4EU
UK
www.iste.co.uk

John Wiley & Sons, Inc.
111 River Street
Hoboken, NJ 07030
USA
www.wiley.com

The rights of Wiem Tounsi to be identified as the author of this work have been asserted by her in accordance with the Copyright, Designs and Patents Act 1988.

Library of Congress Control Number: 2019931457

British Library Cataloguing-in-Publication Data

A CIP record for this book is available from the British Library

ISBN 978-1-78630-448-3

Introduction

This book starts by dealing with cyber threat intelligence in Chapter 1. Cyber threat intelligence is an actionable defense and evidence-based knowledge to reduce the gap between advanced attacks and organization defense means in order to aid specific decisions or to illuminate the risk landscape. This chapter classifies and makes distinctions among existing threat intelligence types and focuses particularly on technical threat intelligence issues and the emerging research, trends and frameworks.

Since threat data are sensitive, organizations are often reluctant to share threat information with their peers when they are not in a trusted environment. Trust, combined with new cloud services, is a solution to improve collective response to new threats. To deepen this approach, the second chapter of this book addresses digital trust and identifies mechanisms underlying trust management systems. It introduces basic concepts of trust management and classifies and analyzes several trust management systems. This chapter shows how trust management concepts are used in recent systems to address new challenges introduced by cloud computing.

When threats are not well addressed, any vulnerability could be exploited and could generate costs for the company. These costs can be of human, technical and financial nature. Thus, to get ahead of these threats, a preventive approach aiming to analyze risks is paramount. This is the subject of the third chapter of this book, which presents a complete information system risk analysis method deployed on various networks. This method is applicable to and is based on network security extensions of existing risk management standards and methods.

Finally, a detective approach based on both dynamic and static analysis is defined in the fourth chapter to defend sensitive data of mobile users, against information flow attacks launched by third-party applications. A formal and technical approach based on a data tainting mechanism is proposed to handle control flow in Java and native applications’ code and to solve the under-tainting problem, particularly in Android systems.

Introduction written by Wiem TOUNSI

Cyber-Vigilance and Digital Trust

Cyber Security in the Era of Cloud Computing and IoT

Introduction