A Mechanism for Risk Adaptive Access Control (RAdAC) Machon Gregory - - PowerPoint PPT Presentation
A Mechanism for Risk Adaptive Access Control (RAdAC) Machon Gregory 14 March 2007 National Information Assurance Research Laboratory (NIARL) Motivation Need for new access control model, Risk Adaptive Access Controls Commonly deployed
National Information Assurance Research Laboratory (NIARL)
National Information Assurance Research Laboratory (NIARL)
Need for new access control model, Risk
Commonly deployed systems are
Technology exists with the ability to
National Information Assurance Research Laboratory (NIARL)
Background Problem Solution Implementation Current Status Future Work
National Information Assurance Research Laboratory (NIARL)
Risk Adaptive Access Control (RAdAC)
− Global Information Grid − “Need to Know” ➔ “Need to Share” − Flexible (escalation and revoke privileges) − Access decisions based on changing risk − Risk is defined by numerous factors
National Information Assurance Research Laboratory (NIARL)
What I want to do
− Selectively Share Information − Maintain Originator Control − Flexible Access Controls
Why I can't do it now
− Trusted Computer − Access Control Limitation − State of the Remote System
National Information Assurance Research Laboratory (NIARL)
Document Server/Document Viewer Protection of documents on remote
Provide access controls over network
Escalate and revoke privileges based on a
National Information Assurance Research Laboratory (NIARL)
Document Server Client Client
National Information Assurance Research Laboratory (NIARL)
Applications of the Flask Security
− Client/Server (SELinux) − Policy over Network Object
Least Privilege Environment
− Prevents Release of Information − Provides a Level of Assurance
IPSec Labeled Security Associations
National Information Assurance Research Laboratory (NIARL)
User-space Security Server Document Server and Viewer IPSec with labeled security associations
Translation Mechanism Mandatory Access Control Operating
Local and network policy
National Information Assurance Research Laboratory (NIARL)
Client Client Document Server NSS This is paragraph
This is paragraph
two.
This is paragraph
three.
This is paragraph
This is paragraph
two.
This is paragraph
three.
This is paragraph
This is paragraph
two.
This is paragraph
three.
This is paragraph
two.
This is paragraph
three.
This is paragraph
two.
This is paragraph
three.
This is paragraph
two.
This is paragraph
three.
National Information Assurance Research Laboratory (NIARL)
Limited functionality application 3 static policies representing risk Policies for the system components
National Information Assurance Research Laboratory (NIARL)
More robust application such as a Virtual
Incorporation of a more secure windowing
Study the applicability of RAdAC concepts
National Information Assurance Research Laboratory (NIARL)