Evaluating Security and Availability of Multiple Redundancy Designs when Applying Security Patches

摘要

In most of modern enterprise systems, redundancy configuration is oftenconsidered to provide availability during the part of such systems is beingpatched. However, the redundancy may increase the attack surface of the system.In this paper, we model and assess the security and capacity orientedavailability of multiple server redundancy designs when applying securitypatches to the servers. We construct (1) a graphical security model to evaluatethe security under potential attacks before and after applying patches, (2) astochastic reward net model to assess the capacity oriented availability of thesystem with a patch schedule. We present our approach based on case study andmodel-based evaluation for multiple design choices. The results show redundancydesigns increase capacity oriented availability but decrease security whenapplying security patches. We define functions that compare values of securitymetrics and capacity oriented availability with the chosen upper/lower boundsto find design choices that satisfy both security and availabilityrequirements.