Internet connected organizations often employ an Internet firewall to mitigate risks of system penetration, data theft, data destruction, and other security breaches. Conventional Internet firewalls, however, impose an overly simple inside vs outside model of security that is incompatible with many business practices that require extending limited trust to external entities. The paper reports on our experience with an enhanced security firewall based on Domain and Type Enforcement (DTE), a strong but flexible form of access control. A DTE firewall provides several benefits. First, it runs application level proxies in restrictive domains, thereby increasing security, and runs network services such as HTTP and FTP under DTE controls, thereby reducing risks that network based attacks will compromise local resources. Second, a DTE firewall coordinates role based security policies that span networks by passing DTE security attributes between DTE clients and servers. These attributes allow security policies at the endpoints to be coordinated; such coordination adds defense in depth to the traditional firewall security perimeter: this permits safe exportation of normally risky services such as NFS. Finally, a DTE firewall interoperates with "non DTE" systems and associates DTE security attributes with these systems so their interaction with DTE clients or servers can be controlled. We describe the design of a prototype DTE firewall system and informally evaluate its security, compatibility, functionality, and performance.

The Internet's multicast backbone (MBone) holds great potential for many organizations because it supports low-cost audio and video conferencing and carries live broadcasts of an increasing number of public interest events. MBone conferences are transmitted via unauthenticated multicast datagrams, which unfortunately convey significant security vulnerabilities to any system that receives them. For this reason, most application gateway firewalls block MBone datagrams sent from the Internet and prevent them from reaching hosts on internal networks. This paper describes the design and rationale for a new set of facilities for the Trusted Information Systems (TIS) Internet Firewall Toolkit (FWTK). These facilities, which are fully implemented, significantly reduce the security risks of observing or participating in MBone conferences. They impose no functional constraints on MBone applications and are transparent to users. Configuration options that support tradeoffs among security, performance and ease of use are discussed.

Type enforcement is a table-oriented mandatory access control mechanism well-suited for confining applications and restricting information flows. Although both flexible and strong, type enforcement alone imposes significant administrative costs and has not been widely adopted. Domain and Type Enforcement (DTE) is an enhanced version of type enforcement designed to provide needed simplicity and compatibility. Two primary techniques distinguish DTE from simple type enforcement: DTE policies are expressed in a high-level language that includes file security attribute associations as well as other access control information; and during system execution, DTE file security attributes are maintained using a concise human-readable format in a runtime DTE policy database, thus removing the need for security-specific low-level data formats. Such formats are a major source of incompatibility for security-enhanced systems. A DTE UNIX prototype system has been implemented to evaluate these primary DTE concepts. This paper presents experiences gained and preliminary results indicating that DTE can provide cost effective security increases to UNIX systems while maintaining a high degree of compatibility with existing programs and media.>

This paper reexamines the role that the reference monitor plays in providing security for a computer system. The reference monitor, aided by a few supporting mechanisms, establishes the system security perimeter at its own boundary along which it enforces the system's security policy. In this view, the reference monitor is the primary security enforcing component of a trusted system. For this reason, the reference monitor is the focus of the TCSEC approach to assurance.>

According to the trusted systems evaluation criteria (TCSEC) paradigm, if untrusted subjects are constrained by the trusted computer base (TCB), they may safely execute software of unknown assurance while accessing sensitive information. Untrusted subjects, however, can leak sensitive information, undermine the TCB's accountability mechanisms, and destroy information integrity. Hence, the security properties needed by many organizations cannot be enforced at the TCSEC security perimeter, i.e., the TCB interface. We propose an alternative approach that redraws the security perimeter of a trusted system so that it encompasses not only a TCSEC TCB but the Controlled Application Set (CAS), a collection of software components for which some assurance of benign behavior has been obtained. Non-CAS components may also be present on a system bird may be used to manipulate only non-sensitive information. The approach advocates a form of balanced assurance in which the assurance sought for CAS components is commensurate with residual security risks they present. We propose practical assurance requirements, including new functional requirements for TCBs. Examples illustrate the applicability of the approach to confidentiality, accountability, and integrity.>

It is pointed out that, although the term 'security policy' is fundamental to computer security, its conflicting meanings have obscured important conceptual distinctions, especially where concerns other than confidentiality are involved. A clearer definition is needed to clarify routine technical discourse, facilitate resolution of key research issues, and establish the scope of security research and standardization efforts. The terms security policy objective, organization security policy, and automated security policy are proposed. These terms are based on simple generalizations of ideas that underlie the trusted computer system evaluation criteria (TCSEC). Yet, they describe a view of security that is more precise, more general, and different than 'confidentiality, integrity, and assured service'. Their usefulness in clarifying conceptual and terminological issues is illustrated through examples.>

This paper presents the initial results of a DARPA-funded research effort to define a development paradigm for high-performance trusted systems in Ada. The paradigm is aimed at improving the construction process and the future products of Ada systems that require both broad trust and high performance. The need for a process model and the notions of trust and assurance are reviewed. The foundation for the process model and its elements are presented. The process model is contrasted with traditional development approaches. The combination of a risk driven approach with the integration of trust and performance engineering into a unified whole appears to offer substantial advantages to system builders.>

In recent years it has been recognized that the protection of classified and sensitive information in an distributed, automated processing environment requires a total 'information security' (INFOSEC) solution, combining both communications and computer security technologies into an integrated security solution. While the need for INFOSEC solutions is clearly recognized, the commercial availability of true INFOSEC products is extremely limited or non-existent. The authors discuss the evaluation issues involved in an effort to take evaluated COMSEC technology and evaluated trusted system technology, and integrate them into a evaluatable INFOSEC product.>

Summary form only given. An ongoing study of audit issues in the context of trusted database management systems (TDBMSs) is discussed. The study consists of a survey of the state of the art, an analysis of issues raised, and an assessment of future relevant research. The scope of the study is broad, and includes a variety of security policies and TDBMS architectures intended for commercial and defense applications. Issues of interest have included those associated with capture, storage, protection, reduction, and analysis of audit data. The study is based on extensive interviews with a number of researchers and product development groups and an examination of audit in its historical and trusted systems contexts. The authors have found that little guidance is provided for either what needs to be audited in TDBMS contexts or when, how, or even where audit data should be captured or recorded. They have found that audit objectives and implied requirements may be specific to each application and security policy. It has also been found that surprisingly little attention has been given in practice to the analysis of TDBMS audit data.>