Vista and the Bell-Padula Model

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

pestocat - 05 May 2006 22:04 GMT

Where will Vista fit in with the Bell-Padilla Security Model. Will the
security be comparable to that of Unix.
pestocat

Reply to this Message

pestocat - 05 May 2006 23:09 GMT

Make that the Bell-LaPadula Model, sorry about misspelling.

> Where will Vista fit in with the Bell-Padilla Security Model. Will the
> security be comparable to that of Unix.
> pestocat

Reply to this Message

Valery Pryamikov - 06 May 2006 08:54 GMT

Hi,
well, Vista and BLP has nothing in common. Discretionary access control is
still the heart of Vista, that essentially means "no" to BLP mandatory
control stuff...

-Valery.
http://www.harper.no/valery

> Make that the Bell-LaPadula Model, sorry about misspelling.
>
>> Where will Vista fit in with the Bell-Padilla Security Model. Will the
>> security be comparable to that of Unix.
>> pestocat

Reply to this Message

Roger Abell [MVP] - 07 May 2006 08:59 GMT

You need to recognize that Bell-LaPadula is a model, not an
implementation. Also, one aspect of how ownership works
in Windows relative to access control is changing with the
Vista era. This last makes the central part of "discretionary"
no longer unavoidable in Windows. The Bell-LaPadula model
could be implemented within the access control semantics of
Windows, if the ability of a subject to pass along access grants
that fail to meet the mandatory controls could be prevented.
As I understand the new features coming in how ownership
can be handled, this will now be preventable.

> Make that the Bell-LaPadula Model, sorry about misspelling.
>
>> Where will Vista fit in with the Bell-Padilla Security Model. Will the
>> security be comparable to that of Unix.
>> pestocat

Reply to this Message

Edward Ray - 15 May 2006 03:34 GMT

>> Where will Vista fit in with the Bell-Padilla Security Model. Will the
>> security be comparable to that of Unix.

Last I heard, Role Based Access Control (RBAC) was the order of the day on
Microsoft OSes.

UNIX variants such as Trusted Solaris, Trusted HP-UX, Trusted IRIX, SELinux
(implemented on Red Hat Enterprise Linux) implement Mandatory Access Control
(MAC). These machines are role specific (i.e. database servers, mail
servers) and usually not for general deployment. AFAIK, Microsoft has no
plans for a MAC-enabled Vista client OS. Standard UNIX variants are
Discretionary Access Control Based (DAC) I believe.

As far as Vista being comparable to UNIX it depends on how well you harden
the client. If Microsoft retires the notoriously bad NetBIOS, that will
help matters.

Edward Ray
CISSP, MCSE+Security, PE, SANS GCIA, SANS GCIH

Reply to this Message

Roger Abell [MVP] - 21 May 2006 00:48 GMT

The main deterent forcing MS OSs to discretionary access control
has been the behavior/rights of owner over objects. Given that, last
I have been briefed, one will be able to control how ownership vests
upon new object creation, the door is open to attempt a deployment
that relies upon the mandatory access control patterns.

>>> Where will Vista fit in with the Bell-Padilla Security Model. Will the
>>> security be comparable to that of Unix.
[quoted text clipped - 15 lines]
> Edward Ray
> CISSP, MCSE+Security, PE, SANS GCIA, SANS GCIH

Reply to this Message