General Workflow. The following indications are general and apply to all instances above. It is the responsibility of everybody to strive for each event to exceed expectations and meet the highest possible standards, as well as to disseminate the promotion materials and the dissemination materials.
General Workflow. The Attestation Engine is responsible for establishing trustworthiness of the infrastructure and security services. This is obtained by applying trusted computing attestation to the platforms and Security Capabilities starting at the initial deployment through operation. The following figures describe the workflow of each phase of the attestation procedures performed by the Attestation Engine. Figure 2: Initial Attestation Workflow The initial attestation occurs each time a new instance of a given Security Capability is deployed. Figure 2 depicts the workflow for initial attestation of every new instance. The Security Capabilities Orchestration, which is in charge of the overall management of the security capabilities, notifies the Attestation Engine when a new instance of the Security Capability is deployed or when a new platform is introduced in the SCHI. The Attestation Engine performs remote attestation procedures on the SC to validate its state. The SCHI also assists with the integrity reports from the AE agent hosted in SCHI for verification. If the verification fails, the AE sends a failure response to the Recovery Service (RS) suggesting the SCO not to use that SC and to exclude it from the infrastructure. Figure 3: Periodic attestation Workflow In order to maintain the trustworthiness of the infrastructure and services, the Attestation Engine performs periodic runtime attestations after the initial attestation as interpreted in Figure 3. The SCHI periodically notifies infrastructure topology updates to the Attestation Engine to keep the AE aware of the latest topology of the infrastructure. The infrastructure topology is iterated periodically per node and SC. If the verification fails at any time, the Attestation Engine sends a failed attestation notification to the RS. The failed attestation notification is also forwarded to Threat Intelligence for further analysis.
General Workflow. The general workflow of the IR component is presented in Figure 9, where two different scenarios and two differently modelled FSMs are triggered by the TI. • In the first scenario S1, a data breach detected by TI is triggering the FSM1, which alerts the user in the PALANTIR Portal about the detected data breach. Shortly after, the IR starts running the service defined for the detected incident (e.g. Data Backup) and notifies the user again about the action performed. • In the second scenario S2, a data breach detected by TI is triggering the FSM2, which asks for user intervention through service reconfiguration and awaits user response. Once the confirmation is received from the user about the reconfiguration, the IR component refines the response policy with the RR in the TI. Then the IR deploys the recommended service, gets the information back from the SCO and finally can send the notification to the Portal.
