Paper Info
Title
Transforming commodity security policies to enforce Clark-Wilson integrity
Abstract
Modern distributed systems are composed from several off-the-shelf components, including operating systems, virtualization infrastructure, and application packages, upon which some custom application software (e.g., web application) is often deployed. While several commodity systems now include mandatory access control (MAC) enforcement to protect the individual components, the complexity of such MAC policies and the myriad of possible interactions among individual hosts in distributed systems makes it difficult to identify the attack paths available to adversaries. As a result, security practitioners react to vulnerabilities as adversaries uncover them, rather than proactively protecting the system's data integrity. In this paper, we develop a mostly-automated method to transform a set of commodity MAC policies into a system-wide policy that proactively protects system integrity, approximating the Clark-Wilson integrity model. The method uses the insights from the Clark-Wilson model, which requires integrity verification of security-critical data and mediation at program entrypoints, to extend existing MAC policies with the proactive mediation necessary to protect system integrity. We demonstrate the practicality of producing Clark-Wilson policies for distributed systems on a web application running on virtualized Ubuntu SELinux hosts, where our method finds: (1) that only 27 additional entrypoint mediators are sufficient to mediate the threats of remote adversaries over the entire distributed system and (2) and only 20 additional local threats require mediation to approximate Clark-Wilson integrity comprehensively. As a result, available security policies can be used as a foundation for proactive integrity protection from both local and remote threats.
Year
DOI
Venue
2012
10.1145/2420950.2420991
ACSAC
Keywords
Field
DocType
data integrity,mac policy,proactive integrity protection,clark-wilson model,transforming commodity security policy,approximate clark-wilson integrity comprehensively,integrity verification,web application,system integrity,clark-wilson policy,clark-wilson integrity model,forensics,malware
Virtualization,Computer security,Computer science,System integrity,Mandatory access control,Data integrity,Reference monitor,Security policy,Web application,Application software
Conference
Citations 
PageRank 
References 
4
0.42
29
Authors
6
Name
Order
Citations
PageRank
Divya Muthukumaran1568.44
Sandra Rueda213712.72
Nirupama Talele3303.02
Hayawardh Vijayakumar41348.37
Jason Teutsch512016.84
T Jaeger62635255.67