Re: firewalls and the incoming traffic problem

[Bennett Todd <bet () rahul net>]

On Mon, Sep 29, 1997 at 12:06:50PM +1000, Darren Reed wrote:
> It would seem that the "ultimate" firewall is one in which you can safely
> and accurately emulate the backend handling of some data, observe what
> happens as a result of that handling and then decide what to do with it.

I dunno; I'm not sure that's implementable in practice, and I am sure that it
would leave us with the same problem we have now, namely trying to keep up
with the cleverness of potential attackers.

I think something that's closer to implementable, and that may just give us
the boost we need to last for another decade or two, will be a richer security
infrastructure. There's a basic concept out there, for which I don't have a
good name; it lies underneath the Mandatory Access Control notions of the
rainbow book series, and TIS's Domain Type Enforcement. It also lies behind
the dataflow security implementation in Perl.

The idea is to ``tag'' data with a security level, and provide a mechanism for
guaranteeing that such tagged data isn't allowed where it shouldn't be. In
particular, I envision OSes including support for this extended to a fairly
strong networking underpinnings (perhaps using security features like the
recent IP work). As a for instance, you could run the latest steaming heap
of bits from Netscape or Microsoft, and you'd naturally install them with an
explicit trust level of Zero, or perhaps Negative:-). They could interact
with the internet, but would basically lie in a highly restricted box; only
restricted, tightly controlled interactions would be allowed with anything
else inside the security perimeter.

Right now we can achieve the same end by restricting such horrid software
to the outside of the firewall, running on sacrificial machines in the DMZ
accessed via encrypted tunnel; I do this with ssh through plug-gw. But as the
application mix gets richer this will be harder to sustain. Happily I'm seeing
signs of work in the Real World making use of these kinds of technologies;
that's the encouragement they need to really take off. Specifically I got a
real thrill when I read the design paper on PCASSO available from
<URL:http://medicine.ucsd.edu/pcasso/index.htm>.

-Bennett