 |
 |
 |
 |
| |
|||||
|
|
|
Home > News & Events > MITRE Publications > The MITRE Digest > | |||||||||||||||||||
Caution! Information Crossing: Security Guards for the Future Web July 2005
The World Wide Web is a free-wheeling bazaar of information. Content producers flood the Web with information, consumers search high and low for the content they need, and Web servers upload and download it all at a frantic pace. When Web content is safe and well protected, information transactions can be conducted quickly and with no worry. But, like any marketplace, the World Wide Web contains its fair share of thieves and fraudulent goods. Security guards must be in place to prevent classified or sensitive material from falling into the wrong hands and to keep viruses from infecting systems. Having human operators oversee information exchanges offers some security, but at the cost of increases in expense and transaction time. A better alternative would be to design automated security guards that could monitor information as it is passed through Web servers between producers and consumers. So You Want to Build a Security Guard... Both the Air Force and the Army asked MITRE to create guidelines for the design and use of automated security guards for the Web. The armed forces produce a great deal of information, much of it highly classified. While these forces want to share information with our nation's partners, they may not want or need allied nations or even our own soldiers on the ground to have access to all of the information. Automated security guards are needed to ensure that allies can be briefed on joint exercises and operations and that soldiers can download battlefield maps without exposing top-secret material. Of course, the armed forces are not the only entities with sensitive information to exchange. Businesses could benefit from security guards that allow them, for example, to share manufacturing specs with a competitor regarding a joint project without inadvertently leaking details of proprietary designs. Security guards could allow consumers to provide companies they frequent with enough personal information to have products tailor-made without revealing information that would violate the consumers' privacy. In fact, the many applications of security guards require that much thought be given to their proper design. Nancy Reed, who led MITRE's Security for the Future Web projects, explains how MITRE researched this approach. "It was not our intent to develop an automated security guard. Our intent was to frame the issues and challenges of developing such a guard and provide recommendations for both sides. To the guard developer we said, if you want to build a security guard, here are the things that you should consider. To the Web services developer we said, here are the things you should consider to make your Web service security-guard friendly." A Glimpse into the Future of the World Wide Web For its recommendations to be of continuing value, MITRE wasn't content to set guidelines simply for the World Wide Web as it exists today. We had to peer into a crystal ball and make recommendations for the Web that will exist five to ten years from now. What Reed's team saw was a Web evolving through three different stages:
The World Wide Web is evolving from a time when users request, collect, and digest information to a time when computers themselves take on these tasks for their users. The challenge will be to structure the information so that automated security guards make the right choices when faced with difficult challenges: ensuring that classified material is only accessed by those with the proper clearance; preventing viruses and malware from infecting a user's system; and protecting a Web server from producers uploading unwanted information and consumers downloading forbidden information. The Final Report For her sponsors, the Air Force and Army, Reed spent two years researching the challenges automated security guards must overcome. The result was a 150-page report providing observations and recommendations regarding the security guard needs of browser-based, Web-services, and Semantic Web environments. "With the browser-based environment," Reed says, "some people may think browsers are going away, so don't even bother. We believe it's going to be around for a long time, so you still have to have solutions for it. We need to develop tools to keep the flow of legitimate content accelerating, while at the same time limiting the flow of malicious content. "The challenge with Web-services," she adds, "is structuring content so that an automated security guard is able to examine it and determine its security requirements without any help from a human administrator. "With the Semantic Web," she concludes, "the difficulty lies in making it possible for a user to express security rules in plain language and then enabling the security guard to translate those rules into the complex machine-to-machine language on which the Semantic Web is based." With MITRE's Security Guards for the Future Web final report in hand, the Army and Air Force will be able to raise pertinent issues with their vendors and point out to them potential pitfalls. But Reed is not resting on her laurels. "MITRE has tracked security guards through their evolution, and we hope to continue to help guide their development. As the security community incorporates our recommendations into their development efforts, we will be on hand to offer our expertise and advice." —by Christopher Lockheardt Related Information Articles and News Technical Papers and Presentations |
||||||||||||||||||||
| Page last updated: July 25, 2005 | Top of page |
Solutions That Make a Difference.® |
|
|
