A Data Model for Federated Network and Security Management Information Exchange in Inter-Organizational IT Service Infrastructures
M. Steinke, and W. Hommel. IEEE/IFIP Network Operations and Management Symposium (NOMS), IEEE, (April 2018)
Operating large-scale IT infrastructures and IT services necessitates the management of the involved devices (e.g., network components and servers) and applications. Recent advances and trends in technology, such as software-defined networking, network function virtualization, and distributed data centers render many established organization-wide management processes and tools almost useless: We argue that they must be significantly re-designed to profoundly address the specifics of the new technologies and operational procedures. In this paper, we present a common data model and inter-domain information exchange procedures for integrated network and security management; it is designed for dynamically instantiated IT services in federated, i.e., inter-organizational scenarios. First, we extend STIX and TAXII to generically support network and security event exchange; then we propose a complementary lightweight data model in favor of efficient data processing and correlation. We discuss our data model's application to four layers of abstraction - from single assets to federated services - along with their management activities and the information required to support them with management tools. An exemplary implementation demonstrates the feasibility for automating several typical management tasks.