Evaluation, Assurance, Classified Systems Dr. William Hery [email protected] CS 996 Spring 2004.

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.Evaluation, Assurance, Classified Systems

Dr. William [email protected]

CS 996Spring 2004

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.

Terminology

• Security Capabilities are what a product is supposed to do for security

• Assurance is the level of trust that it really does Assurance is the hard problem!

• Evaluation is the process of determining the assurance level of a product

• Certification and Accreditation is the process of deciding that an entire system is secure enough to process a given class of data (this is in a later talk)


The NSA on Assurance

"A lot of you are making security products that are an attractive nuisance.... Shame on you. [...] I want you to grow up. I want functions and assurances in security devices. We do not beta test on customers. If my product fails, someone might die." --Brian Snow, INFOSEC Technical Director at the National Security Agency, speaking to commercial security product vendors and users at the Black Hat Briefings security conference. (As quoted by Bruce Schneier.)


Recent History

• Early 1980s: DoD is concerned about the confidentiality of classified information on computers with multiple users (time sharing systems)

• 1985: DOD 5200.28STD (Orange Book, or TCSEC): standard reference for computer security for DoD

• Mid 80s-mid 90s: The Red Book (Trusted Network Interpretation (TNI) of the

Orange Book) The whole “rainbow series”

• FIPS-140 for commercial/civilian government cryptographic modules (DES, AES)

• Canada, UK, European Community develop standards similar to and beyond the Orange Book

• Mid 90s onward: Common Criteria


The Rainbow Series

• Available for download at: http://www.radium.ncsc.mil/tpep/library/rainbow/

• Downloads are monochrome, not with rainbow colors

CS 996 Information Security Management

6


*Orange DoD Trusted Computer System Evaluation Guide DoD 5200.28.STD 008-000-00461-7Green DoD Password Management Guide SCS-STD-002-85 008-000-00443-9*Lt Yellow ComSwc Requirements-Guidance for Applying DoD TSEC in

Specific EnvironmentsCSC-STD-003-85 008-000-00442-1

*Yellow Technical Rationale Behind ComSec Requirements Guilelines... CSC-STD-004-8 008-000-00441-2*Tan Guide to Understanding Audit in Trusted Systems NCSC-TG-001 008-000-00508-7*Aqua Trused Product Evaluations: Guide for Vendors NCSC-TG-002 -*NeonOrange

Guide to Understanding Discretionary Access Control in TrustedSystems

NCSC-TG-003 008-000-00539-7

*Teal Green Glossary of COMSEC Terms NCSC-TG-004 008-000-00522-2Red Trusted Network Interpretations of TCSEC NCSC-TG-005 008-000-00486.2*Ornage 2 A Guide to Understanding Configuration Management in Trusted

SystemsNCSC-TG-006 008-000-00507-9

*Burgandy Guide to Understanding Design Documentation in TrustedSystems

NCSC-TG-007 008-000-00518-4

*DarkLavender

Guide to Understanding Trust Distribution in Trusted Systems NCSC-TG-008 008-000-00536-2

*Venice Blue Computer Security Subsysem Interpretation of TCSEC NCSC-TG-009 008-000-00510-9*Dark Red Trusted Network Interpretations Environments Guideline NCSC-TG-011 -*Pink Rating Maintenance Phase Program Document NCSC-TG-013 -Purple Guidelines for Formal Verification Systems NCSC-TG-014 008-000-00546-1*Brown Guide to Understanding Trusted Systems Management NCSC-TG-015 -Light Blue Guide to Understanding Identification and Authentication in

Trusted SystemsNCSC-TG-017 -

*MediumBlue

Trusted Product Evaluation Questionaire NCSC-TG-019 -

Grey Trusted UNIX Working Group... NCSC-TG-020-A -*Lavender Trusted Database Management System Interpretation of the

TCSECNCSC-TG-021 -

*NeonYellow

A Guide to Understanding Trusted Recovery in Trusted Systems NCSC-TG-022 -


DoD Classification Scheme

• Data classification is based on need for confidentiality

• Levels are based on potential damage if compromised, and defines treatment rules Top Secret Secret Confidential Unclassified

• Unclassified includes Sensitive But Unclassified (SBU); e. g., medical, salary,

performance review data For Official Use Only (FOUO). Not subject to release under

the Freedom of Information Act (FOIA). May include company proprietary information.

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.DoD Classification Scheme (continued)

• “Codewords” restrict access to persons with “need to know” and are only used with a security level; e.g., TS/UMBRA Codewords can be project specific or based on nationality; e.

g., NATO, Coalition, NOFORN (no foreign nationals) Multiple codewords may be part of a security label; e. g., a

document that combined information from a TS/UMBRA and a TS/OXCART would have a label TS/UMBRA/OXCART.

• Clearance of an individual is a level of trust in that individual and is also at the S or TS level

• Access to information is based on clearance, information classification (<= clearance), and “need to know”

• The “owner” of information is the final arbiter of who gets access. This may get very fine grained with very sensitive information.


Orange Book Background

• Defined by NSA for DoD and Intelligence community use.• Primary goal is to maintain confidentiality by restricting

read access to those with the appropriate clearance and “need to know”

• Assumes multiple system users (computer or network of computers) Also used on single user workstation with a separate windows

for different classifications• Uses the Bell LaPadula (BLP) model for higher security

ratings No read up No write down

• Also supports codewords to determine access rules• The set of all labels with level and codewords forms a

lattice to which BLP can be applied

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.Orange book rating methodology

• Rating combines both security capabilities and assurance level--both go up as the rating goes up.

• Levels: Class D: Minimal Protection Class C1: Discretionary Security Protection Class C2: Controlled Access Protection Class B1: Labeled Security Protection Class B2: Structured Protection Class B3: Security Domains Class A1: Verified Design


Core Concepts in the Orange Book Methodology for High Assurance

Systems

• A reference monitor (RM) that controls all access to data objects

• A trusted computer base (TCB) (including the reference monitor) that does all security critical tasks TCB includes user authentication, control of credentials

• Labels: used for all (mandatory) access control TCB includes labeling, and ensures the label on a data

object cannot be modified Labels on a new object are automatically created by

the system based on the user level and any other data objects used to create the new one.


Core (continued)

• For high assurance, the RM and TCB are subject to rigorous inspection.

• In some cases, development of the TCB and RM is done by cleared personnel in a classified environment under rigid control, to include independent code reviews for correctness, safety in case of failure, and to ensure that no back doors or cover channels are included.

• When applied to networked systems, the TCB will include parts of routers, etc.

• The methodology was applied to Government Off the Shelf (GOTS) products and custom systems

• Its very hard to build a TCB on modern complex, multithreaded, caching CPUs.


TCSEC Evaluation

• Evaluations only performed by NSA• Time consuming, expensive process; worse for higher

levels of assurance• Products placed on the NSA Evaluated Product List (EPL)

http://www.radium.ncsc.mil/tpep/epl/epl-by-class.html

• B level required for shared data Secret and above• Approved B level products:

Multi-level Secure (MLS) Operating Systems with hardware

MLS Network Elements MLS DB software (running on B level OS)

• Officially superceded by Common Criteria evaluations


MLS Workstation Screenshot


Common Criteria

• Intended for both commercial and government use• Process can be applied to the security characteristics of any

IT product.• Evaluations can be performed by any certified lab &

accepted by all countries• Security Capabilities stated in a “Protection Profile” (PP)

(User view of needs) Usually defined as a generic for a product class May be modified for a specific product into a “Security Target”

(ST) (Vendor view of what they sell)• Product to evaluate is the “Target of Evaluation” (TOE)• Assurance rating is the “Evaluated Assurance Level” (EAL)

CC calls this a “grounds for confidence” EAL rating is 1 to 7 (high)

• CC Slides at http://csrc.nist.gov/cc/Guidance.html


EALs

• Basic Assurance EAL1: Functional Test EAL2: Structural Test EAL3: Methodical Test and Check EAL4: Methodical Design, Test, and Review

• Medium Assurance EAL5: Semiformal Design and Test

• High Assurance EAL6: Semiformally Verified Design and Test EAL7: Formally Verified Design and Tested ed


US

Canada

UK

Germany

France

Netherlands

National Institute of Standards and Technology,National Security Agency

Common Criteria Developers

Communications Security Establishment

Communications-Electronic Security Group

Bundesamt fur Sicherbeit in der Informationstechnik

Service Central de la Securite des Systemes d’Information

National Institute of Standards and TechnologyNational Security Agency

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.Uses of the Common Criteria

Evaluation Evaluation ProgramsPrograms

Product Product DevelopmentDevelopment

ProcurementProcurementSpecificationsSpecifications

CertificationCertification& &

AccreditationsAccreditations

CommonCommonCriteriaCriteria


Security Objectives ~ The “Focal” Point

Threats

Policies

SecurityObjectives

Assumptions

IT EnvironmentRequirements

Non-IT EnvironmentRequirements

TOE Requirements

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.Protection Profiles and Evaluated Products

• US Government Protection profiles at http://niap.nist.gov/cc-scheme/pp_registry.htm 23 categories of profiles Within firewalls, 4 profiles

• Evaluated Products List at: http://niap.nist.gov/cc-scheme/pp_registry.html#firewalls 28 categories of products??? ~30 firewalls evaluated, EALs 1-4

• Windows 2000 Professional OS rated at EAL 4


Issues with Common Criteria

• Time and cost of evaluation• Re-evaluations for patches, new versions, etc.• Does the PP really match the user requirements?• Environment, policies enforced by people not

included• Configuration is not part of the evaluation

Impact of weak default configurations

• International acceptance of rating can be rejected in any country for “national security” reasons. Effectively, NSA still evaluates products for classified use, and they want EAL 5 or better.


DoD Architectures for AIS with Classified Data

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.Modes of Operation for AIS with Classified Data

• Terms defined in the Orange Book• AIS may be a processor or a collection of

processors on a network• Dedicated--all users have clearance and need to

know for all data• System High--all users have clearance, but not

necessarily need to know for all data• Compartmented--All users have the clearance,

but not approval for access to all data• Multilevel--Not all users have clearance to

access all data


MLS System Architectures

• In principle, systems could be built from MLS workstations, MLS network elements, etc. But: MLS components are much more expensive Long evaluation time means they are often not state of

the art Use and management of MLS systems is less

convenient

• Systems that are not connected by physically secure connections could be linked using MLS crypto equipment

• This used to be the goal of NSA for classified systems

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.Multiple System Level Architectures

• Instead, systems are sometimes built from enclaves of workstations and network elements Within the enclave everything is at one level Commercial Off The Shelf (COTS) products (workstations,

network elements) can be used C2 (Orange book) or lower EAL (common criteria) is OK Enclaves can be linked to enclaves of other levels through

“guards” that enforce BLP: information moves only from low to high. This is used to bring data into a classified environment.

An MLS network backbone can also be used to connect many enclaves in a “multi level” location to other enclaves at the same level

Enclaves that are not connected by physically secure connections could be linked using single level NSA approved crypto equipment

• This cuts back the need for costly MLS/NSA equipment to the boundaries of enclaves


Example I: Multiple enclaves

H L

H

SCILAN

Intellink

SIPRNET

G

SCILAN

Partner

F

G G

L

H

FG

Internet L

Top Secret Intranet

F

G

SCILAN

Unclassified Networks Secret Networks

F

H Host L LAN F Firewall G GuardNode


Example II: enclaves to crypto

UnclassRouter

IP to IP/ATM

IP to IP/ATM

IP to IP/ATM

UNCLASS

UNENCRYPTEDSECRET

UNENCRYPTED TS

Multiple Enclaves

SecretRouter

TSRouter

ATMSW

KG75Fastlane

KG75Fastlane

PublicNetwork

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.Example III: MLS network to MLS crypto

MLSRouter

(user net)

IP to IP/ATM

IP to IP/ATM

IP to IP/ATM

UNCLASS

UNENCRYPTEDSECRET

UNENCRYPTED TS

ATMSW

KG75Fastlane

MLSATMMUX

PublicNetwork


Stovepipes

Data Collection

Report Gen.

Data Analysis

Data Processing

Data Collection

Report Gen.

Data Analysis

Data Processing

Data Collection

Report Gen.

Data Analysis

Data Processing


Sample desktops

• For accessing Secret and below, people often have two desktop computers: one on a secret network, and one on an unclassifies network that may bee linked to the Internet (e. g., thru NIPRNET) Both may be only C2 or EAL 3-4 The Secret computer may not have an capability to write to

removable media But it may be able to read removable media from the unclassified

computer for a “sneakernet” one way link (BLP model)

• Higher level classified work is done in very secure, locked rooms or areas with strict physical access control, such as a “Secure Compartmentalized Information Facility” (SCIF). The SCIF will have only secure or encrypted network links to other top

secret locations. Removable media can only be removed under very controlled

circumstances.


Term Project

• Teams of ~3 students• Pick a system (discuss choice with me)

Want simple functionality, security issues, whole system (e. g., client and server side)

• Submit a 1-2 page proposal to management (Dr. Hery)• Assess risks, threats, vulnerabilities• Develop a security policy• Do a high level system security design• Present a “preliminary design review” (PDR) to management

(include risk analysis, policies, system architecture)• Iterate on risk assessment, policy, design• Present a final “critical design review” (CDR) to

management and the class• Write a final report to management on above


Example Project

• System should have at least 2 elements that communicate to perform a function e. g., client server, peer to peer

• Pick a useful system, not an underlying technology

• Start with a “mission need statement” e. g., “Provide a remote credit card verification service”

• State assumptions about environment e. g., remote site is on a wired LAN connected to the

Internet; verification data is on a well protected server connected to the Internet through a firewall


Example Project (continued)

• State the basic system functions; e. g.: Read card magnetic strip Send card data, transaction data to verification server Server verifies card is valid, not reported lost/stolen

If invalid, send back reject message Server verifies sufficient credit for transaction

If invalid, send back reject message If sufficient

Send authorization message Post transaction to account (debits account)

• The above steps should all be in the initial project proposal


Example Project (continued)

• Your project should be somewhat more complex than this• Make explicit (and probably realistic) assumptions about

infrastructure• Major project steps:

Thorough risk analysis Develop security policies Perform security system engineering. Use the policy to

determine the security functions needed, and then to develop an architecture that has all the security functions and hardware, software components to enforce the security policies

• Major project deliverables: Proposal Preliminary design review Critical design review to class Final report on the design

Evaluation, Assurance, Classified Systems Dr. William Hery [email protected] CS 996 Spring 2004.

Documents

security assurance

security level

security label

computer security

security products

security devices

information classification

assurance level