Risk Management with an Evolutionary Perspective

Evolutionary biology can provide useful insights into the risk management process that is used in information security. The current risk management process as described in NIST Special Publications 800-30, Risk Management Guide for Information Technology Systems and 800-39 Rev 1 (Draft), Managing Risk from Information Systems, could be summarized simply as: 1) identify the risks present in the environment, 2) counter/mitigate the risks that have been identified, and 3) repeat. This cycle is ultimately reactive in nature as flaws are only uncovered when vulnerabilities or new attacks are announced. SP 800-39 Rev 1 (Draft) is more focused on categorizing a system, and applying a set of requirements based on the system's categorization and security control customization based on tailoring. This methodology requires that the system's sensitivity rating has been appropriately determined and the predefined security controls appropriately address the threat environment.

If the assumption is made that information security is indeed a system which operating under the rules of a Red Queen hypothesis and that the security controls that are implemented are acting as selection pressures on our adversaries, the risk management process appears to be lacking as that there is nothing that takes into account how an adversary will respond to the environmental selection pressures (i.e. implemented security controls).

When a risk is identified, there are a number of ways that it can be handled within the current risk management framework. A risk can be corrected, accepted, mitigated, or transferred/insured. Each of these methods for dealing with an identified risk can be treated as one of the three types of selection pressures: directional, disruptive or stabilizing.

• Corrected risks can act as disruptive selection pressures. It is a disruptive selection pressure in the sense that the risk has been removed; an adversary must abandon the strategy that could be used to exploit the system. The adversary will be forced to evolve a new strategy if they are going to continue to exploit the system.
• Accepted risks can act as a stabilizing selection pressure. It is a stabilizing selection pressure in that it encourages an adversary to continue to use the existing exploitation strategy and discourages the use of other strategies in that they will cost resources to evolve and develop (which could be used elsewhere). Some would argue that an entity can also deny that a risk exists in the first place, if so then by default they are accepting the risk and treated it as an accepted risk.
• Mitigated risks can act as either a disruptive or directional selection pressure. If the mitigation causes an adversary to abandon their exploitation strategy it will be a disruptive selection pressure on the adversary. If the mitigation simply causes the adversary to modify their existing strategy it will act like a directional selection pressure.
• Transferred/Insured risks can act as a stabilizing selection pressure. Like accepted risks, transferred/insured risks will not exert a selection pressure on an adversary's strategy which causes them to either modify or abandon their existing strategy. If the risk is transferred or insured, it should be noted that it does not transfer the risk of an incident occurring. Just as when car insurance is purchased, the insurance company does not actually assume the risk of getting into an accident, the driver still carries that and the insurer carries the risk of having to payout out after an incident.

Each type of selection pressure exerts evolutionary costs in response. When multiple methods for dealing with a risk are identified, the evolutionary cost of the adversary to overcome the strategy should be considered in addition to the organization's cost for implementing (or not implementing as the case may be) a strategy. In general, disruptive selection pressures will exert the highest evolutionary cost on an adversary, while stabilizing selection pressures will tend to exert a minimal or non-existent evolutionary cost on an adversary.

• Disruptive selection pressures are the most likely method to extract the highest evolutionary cost from an adversary in that they will force them to not only evolve/develop a new exploitation strategy, but also waste the effort of continuing to maintain a strategy that may not succeed.
• Directional selection pressures will tend to exert minimal evolutionary costs on an adversary, as they must only modify an existing exploitation strategy to continue to be successful. The adversary does not need to abandon their existing strategy or develop a new strategy, just refine an existing one. There is an evolutionary cost associated with this but it will be less than if they had to abandon their current strategy and evolve a new one.
• Stabilizing selection pressures will tend to cost an adversary the least, as they do not need to modify their current strategies therefore experiencing no change in to their evolutionary costs. There may be evolutionary costs associated with stabilizing selection pressures as the maintenance of an adversary's strategies may have a cost associated with them. Stabilizing selection pressures are not likely to force an adversary to incur any additional evolutionary costs as they have already adapted to the environment, but even then an adversary may be able to reduce their costs further by evolving a more efficient method for existing in the environment.
  

Using the principles of selection pressures and evolutionary costs from evolutionary biology, the risk management process can be updated to anticipate how an adversary will respond to the survival strategies of a system. When responses to a risk are proposed, they should be investigated to see how an adversary could respond. In the case of SSH brute forcing, the rules act as a directional selection pressure which caused the attacker to modify but not abandon their strategy. With the implementation of virtualization throughout an environment, it can act as either a disruptive or stabilizing selection pressure on malware. Depending on the potential costs associated with an adversary's response, the one that is likely to inflict the highest evolutionary cost should be chosen as the solution. If a solution is chosen has little or no impact evolutionary cost on an adversary to over come, it will not be long before an attacker has compromised the system.

Predicting the resultant strategies is not trivial, but understanding the selection pressures involved may make the situation more manageable. In the case of the SSH brute force and the adoption of Virtualization some strategies can be determined based on the attributes of the strategy implemented. Inspecting the strategies that are found within the natural environment could provide additional insight into how an adversary could respond. Any of the following could also be potential responses.

• Some organisms have developed adaptations which advertise to others that they are something they are not, or they are poisonous. An adversary could mimic the behavior of the system employed. Malware such as Anti-Virus 2009 or Anti-Virus 360 appears to be anti-virus software which protects a user from attacks on the Internet when instead it is actually a Trojan.
  
• Like parasites subverting the central nervous systems of hosts, an adversary could exploit the strategy that is used to help the system survive. Malware can attempt to exploit vulnerabilities in anti-virus software to attack a system, as anti-malware software usually operates as a privileged service making it a priority target since it has access to the entire system in addition to protecting the system.
  
• Some animals have developed better camouflage to help mask there presence in the environment. A smaller and less noisy profile means that an attacker is less likely to detect their presence. Malware is moving to HTTP command and control channels to help mask its presence in the traffic being sent across the network.
• Another response is to completely abandon the current strategy, and develop a new strategy which catches an organism unprepared. As part of an experiment in evolutionary biology, a predatory lizard was introduced onto several islands which were inhabited by Anoles. Initially the average length of their legs increased, which allowed them to survive by running faster to evade their predators. Eventually the average leg length decreased as the Anoles were able to avoid their predators entirely by spending more time in the trees. Malware can react to countermeasures by simply avoiding the countermeasures entirely or attacking an information system at different layers. A worm can be written to exploit web applications instead of targeting flaws in the operating system.
  
• Sometimes the best response is not to respond to the strategy employed. If the counter strategy will only be infrequently encountered, it is often more cost effective to ignore it. In the case of the natural environment some predators that interact with prey populations interact so infrequently that it is more effective to not response as a population then to evolve a response. Malware authors should be aware that almost all analysis of their binaries will be conducted in a virtualized environment, yet not all malware encountered is able to detect when it is operating in a virtualized environment.
  

Each of different responses carries an associated evolutionary cost. Some of these like abandoning a strategy and evolving a new strategy can be high as the cost of evolve and develop a strategy are discarded and a new strategy must be evolved and developed. Other strategies can carry no additional evolutionary costs such as ignoring the threat and not modifying the current survival strategies.

The current risk management process has weaknesses when it is applied to an environment which evolving. The basic process is reactionary in nature and gives all of the initiative to the adversary and requires that the adversary first advertise their latest strategy before it could be countered. Instead of waiting for an adversary to attack an information system, the risk management methodology should include steps which attempt to determine how the current security strategies will force an adversary to adapt. Based the types of selection pressures that are applied to counter an adversary's strategy, anticipated actions can be made as to how an adversary will be forced to respond. When selecting among several different counter strategies, preference should be given to those strategies which have the highest evolutionary costs to counter (e.g. most likely disruptive selection pressures).

Directional Selection Pressures in SSH Brute Forcing

A practical application of evolutionary biology in information security is found looking specifically at the evolution of a common Internet attack. Selection pressures were previously examined here at a high level, but SSH brute force attacks provide a more practical example of directional selection pressures. Directional selection pressures act to move a character or strategy in a specific direction.

SSH attacks are simply result of taking a list of accounts with common passwords and trying all of the username/password combinations to see if any of them allow access into a system. Early attempts simply tried to supply all of the combinations as fast as possible to determine if there was a valid combination present. Applications such as denyhosts, fail2ban, and sshguard exist to detect brute force attempts and ban those IP addresses from trying to access the server.

At a high level the counter strategy employed to prevent successful brute force attempts on a system implements a rule similar to the following: If a number of unsuccessful login attempts are detected within a short period of time; block all connection attempts from that address for an extended period. This rule acts as a directional selection pressure in that it forces attackers that are using the brute force strategy in a specific direction by controlling the login attempt frequency and number of source IP addresses.

Beginning in May of 2008 through December 2008 and into January of this year, there were reports of a newer Slow/Low-key Brute force attempts from various BotNets. With these newer attacks, the attack strategies were modified such that they are occurring at a much slower rate and occurring from various source addresses. In deed, upon inspection of the rules that were implemented to counter the attack, as they were acting as a directional selection pressures, it should have been expected to see a response in the attack strategies as they evolved in reaction to the selection pressures.

The SSH brute force detection rules have two principle components which act on the attack in as a selection pressure in a directional manner; the number of failed attempts per period and the source IP addresses. Only attacks which slowed their rate (in response to the failed attempts per period directional selection pressure) and distributed their attacks (in response to the source IP address selection pressure) could be expected to have a reasonable chance of being able to get through their account/password dictionaries.

It is possible that an attacker could have modified their strategy in only one direction to continue their attacks. If the attacker simply distributed their attack and failed to throttle the login attempts, all of the hosts which were participating in the attack would have been banned fairly quickly. If the attacker just used a single host and throttled their attack, it would take a substantial amount of time to iterate through the account/password dictionary.

If the attack strategy is inspected further, to find that the account list that is attempted is in alphabetical order and is synchronized across the BotNet. By making use of these additional characters, the strategy employed to block these attacks could continue to evolve.

A counter-strategy could be employed to include tracking the addresses that are using brute forcing by seeing if they are supplying accounts alphabetically. This counter-strategy has the weakness in that the attacker would only need to modify the order in which the accounts are tracked to a random sequence. This would get around the alphabet test but at the cost of additional resources to track the combination of usernames and passwords which have been attempted. Without tracking the attempted combinations, the BotNet would eventually starting using previously supplied combinations which are known to have failed and count as wasted attempts (and resources). Or the attacker could simply increase the number of bots that were participating in the attack such that only one bot supplies an account/password combination. This would require a large number of bots to participate in the attack, and also have the cost of requiring additional coordination through out the BotNet. By increasing the number of bots participating in the attack, it also exposes the attacker to additional risk in that it would allow a researcher to learn the identity of more of the bots in their network.

By devising a counter strategy which targets the synchronization of the accounts across the BotNet, a new strategy could be used as a basis for augmenting the firewall rule set by keeping a list of accounts that were attempted recently. If another address attempts to use that account, it would automatically drop the connection and block further connection attempts from that address.

Another counter-strategy could be implemented which borrows from Conficker/Downadup's attack strategy. Conficker scans for infect-able hosts on the same network, as they are typically all configured in a similar way (in the enterprise there are GPO policies which are frequently pushed out and for the home user they are almost always left in the default configuration). Making use of this information, instead of blacklisting just the host which is attempting to brute force the system, the attacker's network could instead be blacklisted.

The server could simply nullify the ability of the attacker's brute force attempts by requiring a form of multifactor authentication.

To the researcher who conducted further analysis of the attack, it appeared that the Slow/Low-key SSH brute force attempts began to modify their strategy further to avoid the OpenBSD machines that they were monitoring.

SSH brute forcing provides an easy way to compromise a host, as no exploit is needed and a host running SSH is designed to be remotely administered. Since the strategy employed to detect SSH brute force attempts acted as a directional selection pressure, the attacker was able to modify their strategy to avoid detection for an unknown period until the total number of failed login attempts rose to the level in which administrators and researchers noticed. Eventually the attacker further modified their strategy to avoid the OpenBSD machines that were being used all together.