论文标题
与Windows相关的安全配置指南的自动实施
Automated Implementation of Windows-related Security-Configuration Guides
论文作者
论文摘要
硬化是配置IT系统以确保系统组件和数据处理或存储数据的安全性的过程。但是，当代IT基础设施的复杂性使手动安全性硬化和维护一项艰巨的任务。 在许多组织中，SCAP中表达的安全配置指南（安全内容自动化协议）被用作硬化的基础，但是这些指南本身并没有提供自动实施所需配置的手段。 在本文中，我们提出了一种使用自然语言处理的Windows操作系统的公开可用安全配置指南中自动提取相关信息的方法。在第二步中，使用存储在Windows管理模板文件中的可用设置的信息来验证提取的信息，其中大多数Windows配置设置被定义。 我们表明，我们对这种方法的实施可以提取和实施83％的规则，而无需任何手动努力，而手动努力最少。此外，我们进行了一项研究，其中包括由2014年规则组成的12个最先进的指南，并表明我们的工具可以正确实施至少97％。因此，我们大大减少了基于现有的安全配置指南确保系统的努力。
Hardening is the process of configuring IT systems to ensure the security of the systems' components and data they process or store. The complexity of contemporary IT infrastructures, however, renders manual security hardening and maintenance a daunting task. In many organizations, security-configuration guides expressed in the SCAP (Security Content Automation Protocol) are used as a basis for hardening, but these guides by themselves provide no means for automatically implementing the required configurations. In this paper, we propose an approach to automatically extract the relevant information from publicly available security-configuration guides for Windows operating systems using natural language processing. In a second step, the extracted information is verified using the information of available settings stored in the Windows Administrative Template files, in which the majority of Windows configuration settings is defined. We show that our implementation of this approach can extract and implement 83% of the rules without any manual effort and 96% with minimal manual effort. Furthermore, we conduct a study with 12 state-of-the-art guides consisting of 2014 rules with automatic checks and show that our tooling can implement at least 97% of them correctly. We have thus significantly reduced the effort of securing systems based on existing security-configuration guides.
