Do you believe that more than one single security paradigm exists? We do.

Most computer scientists reflexively reject the idea of a malicious universe due to its conflict with the dominant scientific paradigm of a non-teleological impartially disinterested universe. While computer scientists might not view the universe as benign, neither do they view the universe as actively hostile. In addition, most scientist would take the view that a teleological universe equals paradigmatic heresy.

This panel will address users' perceptions and misperceptions of the risk/benefit and benefit/nuisance ratios associated with information security products, and will grope for a solution, based on the psychology of personality trait-factoring results, among other multidisciplinary approaches, to the problem of user non-acceptance of information security products. This problem has acquired a much more scientific guise when amalgamated with the psychology of personality and reinforced by reflections from the field on patterns of user behavior. A gross simplification of the main thrust of the panel is this thesis: if we start profiling the defenders rather than the offenders and do it on the basis of real science rather than very crude personality tests, then we will, at the very least, understand what is happening and possibly create a desirable profile for sysadmins, CIOs, and perhaps even CFOs. This swept-under-the-rug problem is information security's dirty little secret. No other forum is designed to address this, and it may well become yet another major conceptual and paradigmatic shift in the field, of the type initiated in the NSPWs over the last decade. We know that the panel will generate an assured considerable interest among the participants.

Our thesis is that biometric and other intertwined technologies will be used to supplement the work of people in the security field. When these technologies are used, we fear that a high degree of misinterpretation and error is likely. Because of this, we need to identify the technical measures required for these systems. This thesis, along with a justification, and proof sketch, was given to the panelists.Five areas of the technology life-cycle were investigated: modeling, implementation, interpretation of results, database protection, and social issues.The format was simple. After the introduction, each panelist gave a brief presentation. Afterwards the workshop participated in a highly interactive and collegial way, with the panel chair keeping things orderly.A lively discussion resulted, with many good comments and questions from the NSPW attendees, some of which we report.

Has anything actually been accomplished by the New Security Paradigms Workshop since its inception in 1992? If so, what? This, in a nutshell, was the basis of our panel. We had three high-profile NSPW groupies as panelists: our illustrious founder Hilary Hosmer who gave a passionate ponderment of the past 8 years, a perspective from Mary Ellen Zurko who entered NSPW during the middle of its current lifetime (1996) and has authored many reviews of NSPW for CIPHER, and some punishing comments by Marv Schaefer. I also entered the NSPW community in 1996, and was the panel chair in what was a very interactive panel. We had a view from the early days and a view from the more mature days of the ten year old New Security Paradigms Workshop.What did we find out? Were the past years of NSPW wasted? Or did they result in some of the best ideas to hit the information security field? Or something in between?In either case, where should we go from here?The format of the panel was simple. Each panelist gave a brief presentation with the workshop participating in its usual collegial style, with the panel chair to keep things on track.After the workshop, the original panel charge was revised to reflect and add the comments of the workshop attendees.

Golomb analyzed the Z-channel, a memoryless channel with two input symbols and two output symbols, where one of the input symbols is transmitted with noise while the other is transmitted without noise, and the output symbol transmission times are equal. We generalize to the timed Z-channel, where the output symbol transmission times are not equal. The timed Z-channel appears as the basis for a large class of covert (communication) channels appearing in multilevel secure computer systems. We give a detailed mathematical analysis of the timed Z-channel and report a result expressing the capacity of the timed Z-channel as the log of the root of a characteristic equation. This generalizes Shannon's work on noiseless channels for this special case. We also report a new result bounding the timed Z-channel's capacity from below. We show how an interesting observation that Golomb reported for the Z-channel also holds for the timed Z-channel.

The common security policies of access control and resource management are based upon a central managing authority, called the system administration, that is ultimately responsible for the management of a usage policy.This management is usually done with some combination of mandatory access control and discretionary access control methods, where each user is granted (or denied) privileges and resources depending on the usage policies enforced at that particular system.System administration includes the management of system resources, user accounts, and user privileges.This security policy is typified by an operating system such as UNIX, and it introduces several dificulties when working in a distributed computing environment.This paper addresses distributed resource management and access control.It proposes a new version of the "Distributed Compartment Model" (DChf), first developed by Greenwald in his 1994 doctoral dissertation.DCM consists of two major components: Handles, a method for role based access control, and Distributed Compartments, a method allowing users to manage resources within a distributed system across administrative domain boundaries.This new version of DCM dis-cussed in this paper is a refinement of the original formal security policy model.This paper concentrates on the history and background of the problems motivating the creation of DCM, describes the informal security policy, proposes some ezample scenan'os as to how DCM could be used, and concludes with a discussion of the results of this research. CompartmentModel (DCM) [8, 91 is a new paradigm for the man-'The author is obviously open to suggestions for more appropriate terminology, and is also interested in exactly when JASP first came into existence.

Our timed Z-channel (a general case of the Z-channel) appears as the basis for a large class of covert channels. Golomb (1980) analyzed the Z-channel, a memoryless channel with two input symbols and two output symbols, where one of the input symbols is transmitted with noise while the other is transmitted without noise, and the output symbol transmission times are equal. We introduce the timed Z-channel, where the output symbol transmission times are different. Specifically, we show how the timed Z-channel applies to two examples of covert timing channel scenarios: a CPU scheduler and a token ring network. We then give a detailed analysis of our timed Z-channel. We report a new result expressing the capacity of the timed Z-channel as the log of the root of a trinomial equation. This changes the capacity calculation from an optimization problem into a simpler algebraic problem and illustrates the relationship between the noise and time factors. Further, it generalizes Shannon's (1948, 1949) work on noiseless channels for this special case. We also report a new result bounding the timed Z-channel's capacity from below. Finally, we show how an interesting observation that Golomb reported for the Z-channel also holds for the timed Z-channel.