CMU-CS-02-140
Computer Science Department
School of Computer Science, Carnegie Mellon University



CMU-CS-02-140

Intrusion Detection, Diagnosis, and Recovery with Self-Securing Storage

John D. Strunk, Garth R. Goodson, Adam G. Pennington,
Craig A.N. Soules, Gregory R. Ganger

May 2002

CMU-CS-02-140.ps
CMU-CS-02-140.pdf

Keywords: Security, survivability, intrusion tolerance, storage systems, network-attached storage

Self-securing storage turns storage devices into active parts of an intrusion survival strategy. From behind a thin storage interface (e.g., SCSI or CIFS), a self-securing storage server can watch storage requests, keep a record of all storage activity, and prevent compromised clients from destroying stored data. This paper describes three ways self-securing storage enhances an administratorís ability to detect, diagnose, and recover from client system intrusions. First, storage-based intrusion detection offers a new observation point for noticing suspect activity. Second, post-hoc intrusion diagnosis starts with a plethora of normally-unavailable information. Finally, post-intrusion recovery is reduced to restarting the system with a pre-intrusion storage image retained by the server. Combined, these features can improve an organizationís ability to survive successful digital intrusions.

30 pages


Return to: SCS Technical Report Collection
School of Computer Science homepage

This page maintained by reports@cs.cmu.edu