The primary goal of the MITRE compartmented mode workstation (CMW) project was to articulate the security requirements that workstations must meet to process highly classified intelligence data. As a basis for the validity of the requirements developed, a prototype was implemented which demonstrated that workstations could meet the requirements in an operationally useful manner while still remaining binary compatible with off-the-shelf software. The security requirements not only addressed traditional security concerns but also introduced concepts in areas such as labeling and the use of a trusted window management system. The CMW labeling paradigm is based on associating two types of security labels with objects: sensitivity levels and information labels. Sensitivity levels describe the levels at which objects must be protected. Information labels are used to prevent data overclassification and also provide a mechanism for associating with data those markings that are required for accurate data labeling, but which play no role in access control decisions. The use of a trusted window manager allows users to easily operate at multiple sensitivity levels and provides a convenient mechanism for communicating security information to users in a relatively unobtrusive manner.>

The Defense Intelligence Agency (DIA) recognized that commercially available workstations could significantly enhance the capabilities of today's Intelligence Data Handling Systems (IDHS) if they could be integrated with the IDHS systems in a secure manner. The Compartmented Mode Workstation (CMW) project was started at the request of the DIA to further the state-of-the-art of computer security in general and workstation security in particular. The prototype effort had two major purposes. The first purpose was to demonstrate that operationally useful implementations of each requirement could be designed and developed. The second, more general, purpose was to gain insight into what measures could be taken to augment commercially available workstations with meaningful security. Therefore, as the Security Requirements for System High and Compartmented Mode Workstations [CMWREQS] were stated, a development team attempted to implement thereon the CMW prototype. Viable approaches were found for all requirements thereby verifying the premise that a workstation and its associated operating system could be modified such that off-the-shelf software (distributed in binary form) could execute with adequate security .This paper describes compartmented mode operation, how the prototype satisfied each requirement, and the level of effort involved in the prototype implementation.

One of the major goals of MITRE's Compartmented Mode Workstation (CWM) project is to assure that compartmented intelligence data processed on workstations has proper security labels associated, such that data is neither under-nor-overclassified. The CMW labeling strategy is different than that used in traditional secure systems (as suggested by the Department of Defense Trusted Computer System Evaluation Criteria), and revolves around associating two types of security information with objects: mandatory access control levels (MACLS), and sensitivity labels. MACLS are analogous to what are traditionally called security levels, and represent a "failsafe" level at which an object must be protected. Sensitivity labels accurately represent the classification of the data in the object, and also represent necessary handling restrictions. Supporting both MACLS and sensitivity labels for objects makes the system easier to use, helps prevent overclassification of data? and provides the capability of associating handling restrictions with data.

This paper presents an informal security model for the use of data base management systems supporting Naval surveillance applications. The paper discusses why conventional security models are inadequate for data base needs. Also, the Naval surveillance system environment is described, followed by a description of the model and its application to Naval surveillance systems. The model itself is made up of subjects (the users), objects (the data), operators, and policies. The paper concludes with a discussion of directions for model evolution and the observation that, although designed for a particular class of data base applications, the model is surprisingly general.