Goal-Oriented Auditing and Logging
Author
Matt Bishop,Christopher Wee,Jeremy Frank
Entry type
techreport
Abstract
This paper presents a technique for deriving audit requirements from security
policy, with examples for informal specifications. Augmenting these requirements
with a system model allows an analyst to determine specific functions within
the system that must be audited. We demonstrate the effectiveness of this
technique by deriving audit criteria for the Network File System, and show that
the results would detect numerous well-known attacks upon implementations of
that protocol.
Address
Davis, CA 95616-8562
Institution
ACM Transactions on Computing Systems
Key alpha
Bishop
Pages
1-24
Publication Date
2001-01-01