Re: firewalls and the incoming traffic problem

[Aleph One <aleph1 () dfw net>]

On Wed, 1 Oct 1997, Rick Smith wrote:

> For what it's worth, I've always looked at applying these mechanisms in the
> opposite way. Private corporations very, very rarely show the level of
> paranoia achieved by military agencies when protecting secrets from
> disclosure. Therefore, even B1 level MLS exceeds the degree of
> confidentiality protection that's appropriate in most commercial
> information processing situations. Also the information flow in practice
> isn't so well isolated, since the sensitivity issues aren't as significant.
> So the mechanisms would interfere with typical business operations.
>
> On the other hand, we *do* face an integrity problem, which brings us back
> around to the start of this discussion thread. This is where MLS comes in
> handy -- since a "higher" level isn't allowed to modify files belonging to
> "lower" levels, you place the big bad Internet at a "higher" level and
> install the files you don't want modified at a "lower" level. This lets the
> Internet processes read the executable files and the configuration files,
> but prevents them from modifying them. This is sort of using Bell LaPadula
> to implement Biba, if you see what I mean. And, of course, it all works
> much more cleanly with Type Enforcement (tm).

May I point out Hewlett Packard's VirtualVault web server. It uses
comparments to create three categories outside, inside, and system. System
is the lower level. Outside and inside are at the same level (but are
different compartments). Its quite a nice design. It was developed by the
members of SecureWare (HP bought part of the company). It's based on a B1
class version of HP-UX. For more propaganda check out:
http://www.hp.com:80/gsy/security_intro/products/virvault.html

> Rick Smith.                rsmith () visi com           smith () securecomputing com
> "Internet Cryptography" now in bookstores  http://www.visi.com/crypto/

Aleph One / aleph1 () dfw net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01