Towards a theory of penetration-resistant systems and its applications

A theoretical foundation for penetration analysis of computer systems is presented, which is based on a set of formalized design properties that characterize resistance to penetration. By separating the policy-enforcement mechanisms of a system from the mechanisms necessary to protect the system itself, and by using a unified framework for representing a large set of penetration scenarios, the authors develop an extensible model for penetration analysis. Furthermore, they illustrate how the model is used to implement automated tools for penetration analysis. The theory, model, and tools only address system-penetration patterns caused by unprivileged users' code interactions with a system.<
>