Tesis doctorales: TESEO

Ayuda Salir

Ficha de Tesis

Imprimir

Ministerio de Universidades - Gobierno de España

Título: VULNERABILITY ASSESSMENT FOR COMPLEX MIDDLEWARE INTERRELATIONSHIPS IN DISTRIBUTED SYSTEMS
Autor: Serrano Latorre, Jairo
Universidad: Universidad Autónoma de Barcelona
Departamento: ARQUITECTURA DE COMPUTADORES Y SISTEMAS OPERATIVOS
Fecha de Lectura: 08/11/2013
Programa de doctorado: Computación de altas prestaciones
Dirección:
- César Galobardes, Eduardo (DIRECTOR)
- HEYMANN PIGNOLO, ELISA (DIRECTOR)
Tribunal:
- BADIA SALA, ROSA MARIA (PRESIDENTE)
- Suppi Boldrito, Remo (SECRETARIO)
- GRACIANI DÍAZ, RICARDO (VOCAL)
Descriptores:
- INFORMATICA
- CIENCIA DE LOS ORDENADORES
Localización: BIBLIOTECA DE COMUNICACIÓN Y HEMEROTECA GENERAL UAB

2013serravulne.pdf

Marcador: https://www.educacion.gob.es/teseo/mostrarRef.do?ref=1055619Añadir a favoritos.
Resumen:
The fast adaptation of Cloud computing has led to an increased speedy rate of novel information technology threats. The targets of these new threats involve from large scale distributed system, such as the Large Hadron Collider by the CERN, up to industrial (nuclear, electricity, oil, etc.) distributed systems, i.e. SCADA networked systems. The use of automated tools for vulnerability assessment is quite attractive, but while these tools can find common problems in a program's source code, they miss a significant number of critical and complex vulnerabilities. In addition, frequently middleware systems of distributed systems base their security on mechanisms such as authentication, authorization, and delegation. While these mechanisms have been studied in depth and might have control over key resources, they are not enough to assure that all application's resources are safe. Therefore, security of distributed systems have been placed under the watchful eye of security practitioners in government, academia, and industry. To tackle the problem of assessing the security of critical middleware systems, we propose a new automated vulnerability assessment methodology, called Attack Vector Analyzer for Complex Middleware Interrelationships(AvA4cmi), which is able to automatically hint which middleware components should be assessed and why. AvA4cmi is based on automatizing part of the First Principles Vulnerability Assessment, an innovative analystic-centric (manual) methodology, which has been used successfully to evaluate several known middleware systems. AvA4cmi's results are language-independent, provide a comprehensive assessment of every possible attack vector in the middleware, and it is based on the Common Weakness Enumeration (CWE) system, a formal list for describing security weaknesses. Our results are contrasted against previous manual vulnerability assessment of the CrossBroker and gLite WMS middleware, and corroborate which middleware components should be assessed and why.

Imprimir

Modificar Consulta Nueva Consulta

Versión 4.4