NETWORK ACCESS CONTROL LIST SITUATION AWARENESS

ABSTRACT

Network security is a large and complex problem being addressed by multiple communities. Nevertheless, current theories in networking security appear to overestimate network administrators’ ability to understand network access control lists (NACLs), providing few context specific user analyses.  Consequently, the current research generally seems to overlook the User Interface (UI) design needs of network administrators with respect to NACL configurations, despite the emphasis placed on them by security practitioners. To explore this incongruity, a small study was first conducted and indeed found that NACL configurations are significant factor in network security and could benefit from better user designs.  A visualization approach was then developed to address some of the UI needs identified in the study, and tested via a human-in-the-loop study that examined how well participants responded to simulated network attacks.  A novel artifact was designed and implemented, as an initial attempt to address the network administrator UI needs identified within the new visualization approach.  This artifact was hypothesized to increase network administrator situation awareness and performance.  The attacks were generated using CyberCITIES, an extension of the previously accepted design research tool NeoCITIES.  The tests indicated that visualizing ACLS did improve the situation awareness and performance of non-expert users and suggest this research could be extended to system administrators.

 

Chapter 1

Network Administration

Network administration is a large and complex problem being addressed by multiple communities. In many corporate or small business networks, the network administrator is a “Jack of all trades”.  The network administrator is often required to play the role of both the system administrator and the network administrator simultaneously. Although the same person may fulfill both the roles of a system and network administrator, there are important distinctions between these roles. The technical distinctions between a network administrator and a system administrator seem to elude many; but more concerning than this general lack of understanding is that these distinctions seem to be underappreciated by researchers studying network security.  Some definitions of a system administrator even inaccurately define a system administrator as “The person in charge of keeping a network working” ("Legal Resources Glossary," 2007).   Moreover, these distinctions are nontrivial, entailing both different skills and knowledge sets.  In order to distinguish between these contrasting roles, we use the following definitions when referring to a network administrator or a system administrator throughout this paper (Solomon, 2007).

Network Administrator: (The person) responsible for managing and maintaining an organization's Local Area Network (LAN). Network administrators normally focus on making sure an organization's LAN is tuned for optimum performance, delivering required information to end-users, and interacting properly with Wide Area Networks (WANs) like the Internet. Network administrators must be proficient with a wide variety of software and hardware, and normally hold specialized technical certifications like Microsoft Certified Systems Engineer, Certified NetWare Engineer, and Cisco Certified Networking Associate.

System Administrator: (The person) responsible for managing an organization's computer and operating systems. System administrators, or sys admins, normally manage and maintain several large-scale operating systems, such as UNIX and Microsoft Windows 2000, and are responsible for making sure that those

operating systems work together, support end-users' business requirements, and function properly. Sys admins are also responsible for the day-to-day maintenance of an organization's operating systems, including backup and recovery, adding and deleting user accounts, and performing software upgrades. Sys admins sometime hold technical certifications like Microsoft Certified Systems Engineer or Sun Solaris Certified Engineer.

In short, a network administrator manages the network and network devices that computer systems use to access local network resources and the internet while a system administrator manages and configures the computer systems connected to a given network. Wikipedia helps to offer the socially constructed definition of the term “network administrator”

("Network Administrator," 2007):

Network administrators are basically the network equivalent of system administrators: they maintain the hardware and software that comprises the network.

This normally includes the deployment, configuration, maintenance and monitoring of active network gear: switches, routers, firewalls, etc. Network administration commonly includes activities such as network address assignment, assignment of routing protocols and routing table configuration as well as configuration of authentication and authorization – directory services.

Network specialists and analysts concentrate on the network design and security, particularly troubleshooting and/or debugging network-related problems. Their work can also include the maintenance of the network's authorization infrastructure, as well as network backup systems.

While the progressive decoupling of network administration from system administration may offer new clarity regarding the roles of network and system administrators, the literature at present seems to possess some ambiguity regarding the tasks of network administration, intrusion detection, and system administration.  There are currently few existing task analyses that focus on the tasks, cognitive or otherwise, of network administrators that do not also  include tasks pertaining to system administrators.  Despite these ambiguities, the analyses regarding intrusion detection provide some general insights into the tasks and cognitive workload uniquely associated with network administration.

The importance of increasing the network administrators’ situation awareness is increasing. With the ever-growing amount of digital information containing sensitive information, there is a corresponding need to secure that information. The increasing value of this stored digital information also necessitates an increase in the ability of security practitioners to defend and respond to cyber attacks. According to McPherson “Worms and viruses often target specific ports in an attempt to locate systems that are vulnerable to the mechanisms they use to spread (McPherson, Ma, Krystosk, Bartoletti, & Christensen, 2004).”  Furthermore, worms and virus are of particular concern when one considers that the propagation of worms is completely automated and can be devastating for unpatched or unprotected systems.

Further research conducted by Yegneswaran, Balford, and Ullrich (2003) indicates that on any given day that there are on average 1 to 3 million networks scans against the US—it is likely this number has increased since the study’s publication.   In their four month study involving numerous Network Intrusion Detection Systems (NIDS), Yegneswaran et al. also found that there are numerous scans directed at ports other than port 80 (i.e., the standard port for browsing the Internet).  These scans are indicative of “crackers” (malicious hackers) trying to find open ports into networks or ways that they can disguise themselves as non-malicious packets.  To summarize, these attacks are frequent, widespread, and pervasive.  Staniford, Paxson and Weaver (2002) go so far as to suggest that an attack is nearly inevitable, whether through manual or automated means.

Many organizations have networks that involve thousands of computers and thousands to millions of connections.   As previously stated, these computer networks are under constant attack by malware, worms, and viruses (Staniford, et al., 2002).  The job of network analysts is to monitor these networks. A typical network administrator must monitor thousands of computers on a networked system, involving hundreds to thousands of users often utilizing cumulative gigabyte per second (GB\S) traffic rates.  In short, the network administrator’s job is increasingly complex not only because of heightened importance placed on network security but also because of the ever-evolving nature of the threat, the dynamic nature of networking technology, and increased connectivity between systems. Hence, tools and techniques are needed to help alleviate the cognitive workload of the network administrator.

Introductory Task Analysis

Before discussing the tasks and knowledge required by a network administrator in depth, it is worthwhile to briefly introduce an existing network administration task analysis. A more comprehensive review of this task analysis is undertaken in chapter 2; however, an overview now of this analysis should prove instructive. Shibu Bashir’s task analysis of network administrators is fairly representative of the work found while conducting the literature review for this study.

Though this task analysis primarily examines the tasks associated with Intrusion Detection, Bashir’s review includes a range of tasks that for the purpose of this study are considered synonymous with network administration.  These tasks include: policy development, network preparation, preparation for intrusion detection, and reaction to intrusion detection.  In this task analysis, Bashir concludes that there are seven high-level tasks performed by a network administrator.  Bashir states, “The seven major tasks are:

Table 1-1: Bashir’s Hierarchical Task Analysis (Bashir, 2004)

Root Level Tasks	Task Goal
Developing Security Policy	Develop, deploy and review a clear security policy for the company.
Configuring Network Equipment	To properly configure and secure the networking devices governing the traffic flow in the network.
Hardening and Secure Network Servers	To harden and secure the network and servers in the network.
Preparing for Intrusion Detection	Prepare for Intrusion Detection
Root Level Tasks	Task Goal
Detecting Intrusion	To detect any form of threat to the network or the computers.
Responding to Intrusion	If an intrusion is detected by the IDS systems, take necessary steps to handle the intrusion effectively.
Improvement	Continuously improve network security.

 

It is worth noting that all of these tasks can be categorized as proactive or reactive security measures.  The importance of this categorization and the relative security importance of proactive vs. reactive tasks will be explored in greater depth in Chapter 2.

Network Access Controls

Network administration is a complex and overwhelming task (Kandogan & Haber, 2005); nevertheless, current theories in networking security generally presume that network administrators have a complete and correct understanding of network access controls.  Thus, current research tends to overlook the user interface (UI) design requirements for network access control list (NACL) configurations. Security practitioners, however, consider NACL configurations a crucial aspect of network security (Reifers, Daughtry, & Morgan, 2009). By examining network security research and proposing improved frameworks of network administration, Reifers et al. (2009) demonstrated the need for interface designs directed towards network administrators and network access controls.  The study suggested that improved designs would improve situation awareness of administrators, and thus improve the overall security of a given network.

Until recently, little attention has been paid to the difficulties associated with implementing access controls in a corporate environment.  Implementing access control policies of any type is a demanding and challenging task that often involves a team of certified administrators. Though Bauer et al. (Bauer, Cranor, Reeder, Reiter, & Vaniea, 2009) highlight the difficulties associated with implementing physical or file system access controls and Barret et al. (Barrett, et al., 2004) the need for unique administrator interfaces, neither work addresses network access control lists (ACL).

Network ACLs are a way to manage and implement access controls for network traffic.

They operate at a relatively low level in the TCP/IP protocol stack, not allowing network traffic (e.g. TCP/IP or UDP) to pass through a network device (e.g. firewall, router or switch) unless they match the established rule set. Network administrators may define network ACLs; or default ACLs may apply. Network ACLs can restrict or allow network traffic based on any combination of the following: source, destination, protocol, and port.  In a large network, ACLs are more complicated than either physical or file system access controls. They are also more relevant to overall network security because they address every device on the network as well as Internet based access to the network. Because network attacks are primarily through means of Internet access (Killcrece, Kossakowski, Ruefle, & Zajcek, 2003; Lipson, 2002), interfaces addressing network ACLs governing Internet access deserve adequate attention and research.

A related research direction has been to focus on the administrative misunderstandings of individual system firewalls. For example, Raja, Hawkey and Beznosov (Raja, Hawkey, &

Beznosov, 2009) studied the mental models of administrators for individual system firewalls.  While this research is a useful beginning, it is important operationally to improve the mental models of administrators of NACLs within a broader corporate environment, rather than focusing on mental models of administrators for individual systems.   NACLs govern all traffic traversing a network including all systems hosted on that network.  Furthermore, NACLs provide the layered Defense-in-Depth approach advocated by the department of Homeland Security, the

NSA, and nearly all other security practitioners (Control Systems Cyber Security: Defense in

Depth Strategies, 2006). Therefore, examining mental models of network administrators managing NACLs, and developing innovative interfaces for network administrators would be a more practical and cost effective approach for improving network security.

Research Approach Overview

For this study, a literature review was first conducted that examined the theoretical frameworks most frequently referenced in association with network security.  The purpose of this review was to not only survey the current literature but also to determine what underlying themes and principles seem to inform network security interface design.  A summary of this review is then presented that discusses these themes, specifically in regards to network security visual interface design.  The overview is concluded by identifying some significant implications of these frameworks as they manifest in the actual practice of network security before offering a visualization approach for expanding and deepening this work.

Upon review (detailed in chapter 2), the current literature appears to both underestimate the role of NACLs and overestimate the comprehension of network administrators regarding NACLS.   Elaborations are offered to an existing network administration cognitive task model and a network security situation awareness model. In addition, a design of interfaces specific to network administrators and NACLs are developed.  This user model was assessed and validated by comparing its premises to survey data collected from domain area experts.  Analysis of the data assisted in determining whether a design thrust focused on making NACL configurations more intelligible is in fact warranted.

The initial survey results further indicated that interface design research dedicated to NACLs and network administration is warranted.   The results also suggested that developing a modified network security situational awareness (SA) model could help address this gap in the literature by more explicitly defining the knowledge dependencies present in ACL SA tasks.

Such a model can also serve as an epistemological model for better understanding administrator tasks and identifying instances where network administrators are more likely to incorrectly understand their network.  In this study, an epistemological model is offered as a framework for critique and revision to help increase understanding regarding the relationship between different errors and how those errors affect each other, as well as overall ACL SA.  In our study, we ground the design of an visualization artifact using the model, specifically by accounting for areas of misunderstanding elucidated by the NACL epistemological model.

 

 

NETWORK ACCESS CONTROL LIST SITUATION AWARENESS

Sharing is caring!