Evaluation, Assurance, Classified Systems

1. Evaluation, Assurance, Classified Systems Dr. William Hery hery@isis.poly.edu CS 996 Spring 2004

2. Terminology • Security Capabilities are what a product is supposed to do for security • Assurance is the level of trust that it really does • Assurance is the hard problem! • Evaluation is the process of determining the assurance level of a product • Certification and Accreditation is the process of deciding that an entire system is secure enough to process a given class of data (this is in a later talk)

3. The NSA on Assurance "A lot of you are making security products that are an attractive nuisance.... Shame on you. [...] I want you to grow up. I want functions and assurances in security devices. We do not beta test on customers. If my product fails, someone might die." --Brian Snow, INFOSEC Technical Director at the National Security Agency, speaking to commercial security product vendors and users at the Black Hat Briefings security conference. (As quoted by Bruce Schneier.)

4. Recent History • Early 1980s: DoD is concerned about the confidentiality of classified information on computers with multiple users (time sharing systems) • 1985: DOD 5200.28STD (Orange Book, or TCSEC): standard reference for computer security for DoD • Mid 80s-mid 90s: • The Red Book (Trusted Network Interpretation (TNI) of the Orange Book) • The whole “rainbow series” • FIPS-140 for commercial/civilian government cryptographic modules (DES, AES) • Canada, UK, European Community develop standards similar to and beyond the Orange Book • Mid 90s onward: Common Criteria

5. The Rainbow Series • Available for download at: • http://www.radium.ncsc.mil/tpep/library/rainbow/ • Downloads are monochrome, not with rainbow colors

6. CS 996 Information Security Management

7. DoD Classification Scheme • Data classification is based on need for confidentiality • Levels are based on potential damage if compromised, and defines treatment rules • Top Secret • Secret • Confidential • Unclassified • Unclassified includes • Sensitive But Unclassified (SBU); e. g., medical, salary, performance review data • For Official Use Only (FOUO). Not subject to release under the Freedom of Information Act (FOIA). May include company proprietary information.

8. DoD Classification Scheme (continued) • “Codewords” restrict access to persons with “need to know” and are only used with a security level; e.g., TS/UMBRA • Codewords can be project specific or based on nationality; e. g., NATO, Coalition, NOFORN (no foreign nationals) • Multiple codewords may be part of a security label; e. g., a document that combined information from a TS/UMBRA and a TS/OXCART would have a label TS/UMBRA/OXCART. • Clearance of an individual is a level of trust in that individual and is also at the S or TS level • Access to information is based on clearance, information classification (<= clearance), and “need to know” • The “owner” of information is the final arbiter of who gets access. This may get very fine grained with very sensitive information.

9. Orange Book Background • Defined by NSA for DoD and Intelligence community use. • Primary goal is to maintain confidentiality by restricting read access to those with the appropriate clearance and “need to know” • Assumes multiple system users (computer or network of computers) • Also used on single user workstation with a separate windows for different classifications • Uses the Bell LaPadula (BLP) model for higher security ratings • No read up • No write down • Also supports codewords to determine access rules • The set of all labels with level and codewords forms a lattice to which BLP can be applied

10. Orange book rating methodology • Rating combines both security capabilities and assurance level--both go up as the rating goes up. • Levels: • Class D: Minimal Protection • Class C1: Discretionary Security Protection • Class C2: Controlled Access Protection • Class B1: Labeled Security Protection • Class B2: Structured Protection • Class B3: Security Domains • Class A1: Verified Design

11. Core Concepts in the Orange Book Methodology for High Assurance Systems • A reference monitor (RM) that controls all access to data objects • A trusted computer base (TCB) (including the reference monitor) that does all security critical tasks • TCB includes user authentication, control of credentials • Labels: • used for all (mandatory) access control • TCB includes labeling, and ensures the label on a data object cannot be modified • Labels on a new object are automatically created by the system based on the user level and any other data objects used to create the new one.

12. Core (continued) • For high assurance, the RM and TCB are subject to rigorous inspection. • In some cases, development of the TCB and RM is done by cleared personnel in a classified environment under rigid control, to include independent code reviews for correctness, safety in case of failure, and to ensure that no back doors or cover channels are included. • When applied to networked systems, the TCB will include parts of routers, etc. • The methodology was applied to Government Off the Shelf (GOTS) products and custom systems • Its very hard to build a TCB on modern complex, multithreaded, caching CPUs.

13. TCSEC Evaluation • Evaluations only performed by NSA • Time consuming, expensive process; worse for higher levels of assurance • Products placed on the NSA Evaluated Product List (EPL) • http://www.radium.ncsc.mil/tpep/epl/epl-by-class.html • B level required for shared data Secret and above • Approved B level products: • Multi-level Secure (MLS) Operating Systems with hardware • MLS Network Elements • MLS DB software (running on B level OS) • Officially superceded by Common Criteria evaluations

14. MLS Workstation Screenshot

15. Common Criteria • Intended for both commercial and government use • Process can be applied to the security characteristics of any IT product. • Evaluations can be performed by any certified lab & accepted by all countries • Security Capabilities stated in a “Protection Profile” (PP) (User view of needs) • Usually defined as a generic for a product class • May be modified for a specific product into a “Security Target” (ST) (Vendor view of what they sell) • Product to evaluate is the “Target of Evaluation” (TOE) • Assurance rating is the “Evaluated Assurance Level” (EAL) • CC calls this a “grounds for confidence” • EAL rating is 1 to 7 (high) • CC Slides at http://csrc.nist.gov/cc/Guidance.html

16. EALs • Basic Assurance • EAL1: Functional Test • EAL2: Structural Test • EAL3: Methodical Test and Check • EAL4: Methodical Design, Test, and Review • Medium Assurance • EAL5: Semiformal Design and Test • High Assurance • EAL6: Semiformally Verified Design and Test • EAL7: Formally Verified Design and Tested ed

17. Common Criteria Developers National Institute of Standards and Technology, National Security Agency US Communications Security Establishment Canada Communications-Electronic Security Group UK Bundesamt fur Sicherbeit in der Informationstechnik Germany Service Central de la Securite des Systemes d’Information France National Institute of Standards and Technology National Security Agency Netherlands

18. Procurement Specifications Product Development Certification & Accreditations Evaluation Programs Uses of the Common Criteria Common Criteria

19. Security Objectives ~ The “Focal” Point TOE Requirements Assumptions Security Objectives IT Environment Requirements Threats Non-IT Environment Requirements Policies

20. Protection Profiles and Evaluated Products • US Government Protection profiles at • http://niap.nist.gov/cc-scheme/pp_registry.htm • 23 categories of profiles • Within firewalls, 4 profiles • Evaluated Products List at: • http://niap.nist.gov/cc-scheme/pp_registry.html#firewalls • 28 categories of products??? • ~30 firewalls evaluated, EALs 1-4 • Windows 2000 Professional • OS rated at EAL 4

21. Issues with Common Criteria • Time and cost of evaluation • Re-evaluations for patches, new versions, etc. • Does the PP really match the user requirements? • Environment, policies enforced by people not included • Configuration is not part of the evaluation • Impact of weak default configurations • International acceptance of rating can be rejected in any country for “national security” reasons. Effectively, NSA still evaluates products for classified use, and they want EAL 5 or better.

22. DoD Architectures for AIS with Classified Data

23. Modes of Operation for AIS with Classified Data • Terms defined in the Orange Book • AIS may be a processor or a collection of processors on a network • Dedicated--all users have clearance and need to know for all data • System High--all users have clearance, but not necessarily need to know for all data • Compartmented--All users have the clearance, but not approval for access to all data • Multilevel--Not all users have clearance to access all data

24. MLS System Architectures • In principle, systems could be built from MLS workstations, MLS network elements, etc. But: • MLS components are much more expensive • Long evaluation time means they are often not state of the art • Use and management of MLS systems is less convenient • Systems that are not connected by physically secure connections could be linked using MLS crypto equipment • This used to be the goal of NSA for classified systems

25. Multiple System Level Architectures • Instead, systems are sometimes built from enclaves of workstations and network elements • Within the enclave everything is at one level • Commercial Off The Shelf (COTS) products (workstations, network elements) can be used • C2 (Orange book) or lower EAL (common criteria) is OK • Enclaves can be linked to enclaves of other levels through “guards” that enforce BLP: information moves only from low to high. This is used to bring data into a classified environment. • An MLS network backbone can also be used to connect many enclaves in a “multi level” location to other enclaves at the same level • Enclaves that are not connected by physically secure connections could be linked using single level NSA approved crypto equipment • This cuts back the need for costly MLS/NSA equipment to the boundaries of enclaves

26. Top Secret Intranet H L Partner SCI SCI F LAN LAN Intellink F G G G G H SIPRNET F G Internet L L H Example I: Multiple enclaves SCI LAN F Unclassified Networks Secret Networks H L F G Node Host LAN Firewall Guard

27. Example II: enclaves to crypto Unclass Router UNCLASS IP to IP/ATM UNENCRYPTED SECRET KG75 Fastlane Public Network Secret Router ATM SW IP to IP/ATM UNENCRYPTED TS KG75 Fastlane TS Router IP to IP/ATM Multiple Enclaves

28. Example III: MLS network to MLS crypto UNCLASS Public Network MLS Router (user net) IP to IP/ATM UNENCRYPTED SECRET MLS ATM MUX KG75 Fastlane ATM SW IP to IP/ATM UNENCRYPTED TS IP to IP/ATM

29. Stovepipes Report Gen. Report Gen. Report Gen. Data Analysis Data Analysis Data Analysis Data Processing Data Processing Data Processing Data Collection Data Collection Data Collection

30. Sample desktops • For accessing Secret and below, people often have two desktop computers: one on a secret network, and one on an unclassifies network that may bee linked to the Internet (e. g., thru NIPRNET) • Both may be only C2 or EAL 3-4 • The Secret computer may not have an capability to write to removable media • But it may be able to read removable media from the unclassified computer for a “sneakernet” one way link (BLP model) • Higher level classified work is done in very secure, locked rooms or areas with strict physical access control, such as a “Secure Compartmentalized Information Facility” (SCIF). • The SCIF will have only secure or encrypted network links to other top secret locations. • Removable media can only be removed under very controlled circumstances.

31. Term Project • Teams of ~3 students • Pick a system (discuss choice with me) • Want simple functionality, security issues, whole system (e. g., client and server side) • Submit a 1-2 page proposal to management (Dr. Hery) • Assess risks, threats, vulnerabilities • Develop a security policy • Do a high level system security design • Present a “preliminary design review” (PDR) to management (include risk analysis, policies, system architecture) • Iterate on risk assessment, policy, design • Present a final “critical design review” (CDR) to management and the class • Write a final report to management on above

32. Example Project • System should have at least 2 elements that communicate to perform a function • e. g., client server, peer to peer • Pick a useful system, not an underlying technology • Start with a “mission need statement” • e. g., “Provide a remote credit card verification service” • State assumptions about environment • e. g., remote site is on a wired LAN connected to the Internet; verification data is on a well protected server connected to the Internet through a firewall

33. Example Project (continued) • State the basic system functions; e. g.: • Read card magnetic strip • Send card data, transaction data to verification server • Server verifies card is valid, not reported lost/stolen • If invalid, send back reject message • Server verifies sufficient credit for transaction • If invalid, send back reject message • If sufficient • Send authorization message • Post transaction to account (debits account) • The above steps should all be in the initial project proposal

34. Example Project (continued) • Your project should be somewhat more complex than this • Make explicit (and probably realistic) assumptions about infrastructure • Major project steps: • Thorough risk analysis • Develop security policies • Perform security system engineering. Use the policy to determine the security functions needed, and then to develop an architecture that has all the security functions and hardware, software components to enforce the security policies • Major project deliverables: • Proposal • Preliminary design review • Critical design review to class • Final report on the design