PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation.

Area of Science:

• Cybersecurity
• Cloud Computing
• Network Engineering

Background:

• Small and medium enterprises (SMEs) are disproportionately affected by cyber-threats, lacking the necessary skills and financial resources for robust security.
• Existing security practices often conflict with the need for external security supervision, especially in hybrid cloud environments.
• The PALANTIR project aims to address these challenges by enabling secure outsourcing of security management.

Purpose of the Study:

• To propose an innovative architecture for automating threat mitigation and remediation across diverse environments.
• To develop a framework that extends Network Function Virtualisation (NFV) for enhanced cybersecurity in SMEs.
• To provide practical solutions for managing security policies in cloud, edge, and on-premises settings.

Main Methods:

• Developed an ontology to guide the automated decision-making process for security management.
• Introduced a Fault-and-Breach-Management-based remediation policy model for proactive threat handling.
• Designed a framework for executing remediation actions and proposed adaptable deployment models.
• Created an implementation prototype for empirical evaluation.

Main Results:

• The proposed architecture effectively externalizes and automates threat mitigation and remediation.
• The framework supports the enforcement of security policies across cloud, edge, and on-premises resources.
• The developed models and prototype demonstrate feasibility and adaptability to SME constraints.

Conclusions:

• The PALANTIR framework offers a viable solution for SMEs to enhance their cybersecurity posture through automated, outsourced security management.
• The innovative architecture and remediation models provide a scalable and flexible approach to cyber-threat response.
• This work facilitates secure resource utilization across the cloud continuum for SMEs.