What Are Survivable Computer Systems

Definition of Survivable Computer System —————————— A computer system, which may consist of multiple individual systems and components, designed to provide critical services, must be able to function consistently and timely under varying operating conditions. It must be able to fulfill its goals and objectives, whether it is in a state of normal operation, under some kind of stress or in a hostile environment. The discussion of surviving computer systems can be very complex and far-reaching. However, in this article we will only touch on a few basic ones. Computer Security and Survivable Computer Systems ————————————————— Computer systems for survivability and computer security are related in many ways, but at a low level they are very different. For example, strengthening a particular system to be resistant to intelligent attacks may be part of a surviving computer system. It does not address the ability of a computer system to fulfill its purpose when affected by an event such as a deliberate attack, natural disaster or accident, or general failure. A survivable computer system must be able to adapt, perform its primary critical functions even when in a hostile environment, even when various components of the computer system are incapacitated. In some cases, even the entire "primary" system was destroyed. As an example; a system designed to provide real-time critical information related to the analysis of specialty drugs goes down for several hours due to a widespread loss of communications. However, it keeps the data valid when communication is restored and the systems are back online. This computer system could be considered to have survived conditions beyond its control. On the other hand, the same system fails to provide continuous access to information under normal circumstances or operating environment due to a localized failure, it may not be judged to have fulfilled its purpose or to have fulfilled its purpose. Fault-Tolerant and Highly Available Computer Systems —————————- Many computer systems are designed with fault-tolerant components so they can continue to operate when key parts of the system fail. For example; multiple power supplies, redundant disk drives or arrays, even multiple processors and system boards that can continue to function even if their equivalent component is destroyed or fails. The probability that all components designed to be redundant will fail at once can be quite low. However, a malicious entity that knows how redundant components are configured may be able to engineer critical failures across the board and render fault-tolerant components ineffective. High availability also plays a role in the survival of a computer system. However, this design component may not preserve the survivability of the computer system during certain events, such as various forms of malicious attack. An example of this might be a critical web service that has been duplicated, say on multiple machines, to allow for continuous functionality in the event that one or more individual web servers fail. The problem is that many high availability implementations use the same components and methodology on all individual systems. If an intelligent attack or malicious event occurs and targets a specific set of vulnerabilities on one of the individual systems, it is reasonable to assume that the remaining computer systems participating in the highly available implementation are also susceptible to the same or similar vulnerabilities. . Some degree of variation must be achieved in how all systems participate in a highly available implementation. What is the difference between attack, failure and accident? How These Differences Affect a Survivable Computer System ———————————————————— In many cases when I discuss system security with customers, the issue of business continuity and disaster recovery come up . Most companies that provide a service that they consider critical know that the system must work in a consistent manner. However, there is usually little discussion of the various events or scenarios surrounding this, and this can lead to great disappointment in the future when what the customer thought was a "survival computer system" does not meet their expectations. Some of the items I like to bring up during these conversations is what the goal and purpose of their computer systems is, what specifically means continuous operation for them, and specifically what constitutes an attack, failure, or accident that can cause a loss of service or failure. to meet the goals. A failure can be defined as a localized event that affects the operation of a system and its ability to provide services or meet its objectives. An example would be the failure of one or more critical or non-critical functions that affect the performance or overall operation of the system. Say a code module failure that causes a cascading event that prevents redundant modules from performing properly. Or locate a hardware failure that disables a computer system. A crash is usually an event that is beyond the control of the system and local/private system administrators. Examples include natural disasters like hurricanes if you live in south Florida like I do, or flooding or widespread power outages because a utility cut the wrong power line during a grid upgrade. About two years ago, a web-based document management client of mine was unable to provide revenue-generating services to their customers because a telecommunications engineer cut the main telephone line six blocks from their office. They lost phone and data service for almost a week. And now we come to the "attack". We all know that accidents happen, we know that everything fails at one time or another, and we can usually speculate on how these things will happen. An attack by an intelligent, experienced individual or group can be very difficult to predict. There are many well-known and documented forms of attack. The problem is that intelligence and human imagination are constantly evolving the shape of malicious attacks, and they can seriously compromise even the most advanced computer systems designed to survive. An accident or failure does not have the ability to think outside the box or realize that a highly available design is flawed because all participants are using the same design. The probability of an attack occurring and succeeding may be relatively low, but the impact can be devastating. Conclusion ————————————————— One of the reasons I wrote this article was to illustrate that it is not just about prevention. While prevention is a large part of the design of a survivable computer system, a critical computer system must be able to meet its objectives even when operating under hostile or stressful conditions. Or if steps to prevent eventually