Automating Network Perimeter Threat Prevention for Decentralized Network Administration

Decentrally administered networks consist of a plethora of hosts providing various services to the Internet and several administrators are responsible for mitigating software vulnerabilities. Therefore, these networks potentially expose a large attack surface depending on the capabilities and workload of administrators. In this paper, we present the automateD nETwork pERimeter thREat pRevention System (DETERRERS). It automatically scans hosts at the network perimeter, assesses the risk of exposed vulnerabilities, and performs actions based on the assessed risk. This supports administrators in their work and enables faster reaction to software vulnerabilities. Additionally, host-based security policies can be configured in a modular user interface by system administrators and firewall configurations can be generated automatically. We deploy our system in a university network with decentralized administration and evaluate the risk assessment process, the influence on the attack surface of the network, and the time-to-remediate from vulnerabilities.