Zero Trust Intrusion Containment for Telemedicine

Abstract

Abstract : Intrusion Management Systems (IMS) serve to protect complex computer systems from unauthorized intrusions. Our objective is the design and analysis of 'zero-trust' Intrusion Tolerant Systems. These are systems built under the extreme assumption that all intrusion detection techniques will eventually fail. Our approach, Self-Cleansing Intrusion Tolerance (SCIT), centers around two key concepts: zero trust and system self-cleansing. Our zero trust principle assumes that a successful intrusion may have taken place on any part of the system that is currently running. System self-cleansing involves both hardware and software elements that periodically restore themselves from a trusted source. Our goal is to provide increased resistance to intrusions with minimal disruption of the services provided by the overall system. This final report summarizes our research. This research project introduces a new approach to information security that we call Self-Cleansing Intrusion Tolerance (SCIT). System self-cleansing involves both hardware and software components that periodically restore themselves from a trusted source. We began this work by focusing on one key component of such a system - a SCIT firewall. Thereafter we built a SCIT web server. To confirm applicability of SCIT to the telemedicine arena, we performed perceptual testing and evaluating the effects of SCIT on packet loss and perceived performance.