Usenet 1994 October/usenetsourcesnewsgroupsinfomagicoctober1994disk2.iso/std_unix/archive/text0004.txt

Text File | 1994-03-07 | 5.4 KB | 201 lines

Submitted-by: [e-mail] (Nicholas M. Stoughton)

               USENIX Standards Report Editor

   Nicholas M. Stoughton <[e-mail]>, Report Editor


POSIX.6: Security Extensions


Lynne Ambuel <[e-mail]> reports on the
January 10-14, 1994 meeting in Irvine, Ca.:

Introduction

As a first time snitch, I would like to indulge you with my
thoughts on standards - from a security geek's point of
view.  The general subjects include the peculiarities of
information security and those who live by it, various
activities taking place, and the status of the POSIX
security working group (previously known as P13.6).  Other
issues may creep into the discussion, but everything will
relate (no matter how obscurely) to these greater issues.

A Different Animal

Computer Security specialists are used to being called names
like `different,' `special,' and even `strange.' Although
some might take offense, I must agree with the
characterization.  Computer security really is a different
animal.  While most software designers and developers can
kick back once their code does what it is supposed to do, we
have just started - the important part is what the code also
does _n_o_t do.  For other applications, added functionality
brings cheers from users - more bells and whistles are
always better.  We add functionality and our users cringe -
more restrictions.  If we are real good, no one will notice
we have added more while our counterparts fly banners with
their latest new features.  Is it any wonder we can't get no
respect?

In the standards world, we are treated in a similar fashion.
We in the POSIX Security Working Group (P13.6) have the
unenviable job of policing the work of other POSIX groups to
be sure that gaping security holes are not mandated in the
standards.  That makes us lots of friends.  We add
interfaces that have sweeping effects on well-established
sets of interfaces.  We change those pillars of POSIX
interfaces and utilities to accommodate our added features.
And, our job never ends.  As new standards are developed we
continue to study them for the impact on the security of
POSIX-conformant systems.  We have just started looking at
what security means when systems are interconnected.  The
concepts of user identification and authentication and data
markings becomes remarkably complex once it is taken out of
a single system and spread throughout a network.  Let's say











- 2 -



that we have a lot of work to do in getting standards that
both meet the needs of the market and protect the
information of those using the end product, whether or not
they know they want it protected.

The Great Thing About Standards is There Are So Many To
Choose From

Not so many years ago computer standardization was a a
foreign and even ridiculous thought.  In the eighties,
however, we started moved toward a more friendly world and
everyone wanted to talk to everyone in the same language.
Organizations that previously held design and implementation
information excruciatingly close soon started sharing these
gems freely.  Security joined right in.  Standards were
written for what security should be in systems, first in
individual countries and then in international cooperation.
The utopian view is that someday (soon) there will be a
single security standard for the globe.  In addition,
several working groups were formed to look at
standardization of security interfaces, utilities, and data.
Some were folded into others.  Others sprouted and are still
separate.  These efforts continue with limited coordination
between the groups.  The problem with these parallel groups
is that, in these times of downsizing, organizations send
fewer representatives.  This means that each of the groups
have trouble making progress on their standards due to lack
of resources.  If these groups would pool their resources
substantive progress might be made, and there would be one
accepted standard instead of a handful of incomplete ones.

Progress of POSIX Security Working Group

Now that you have indulged my whinings about dwindling
resources I can tell you what we have accomplished.  A third
ballot of the five initial security options for POSIX.1
(access control lists, mandatory access control labels,
information labels, audit and fine-grained privileges) is
being distributed as you read.  However, it is about four
months behind schedule due to loss of half of the ballot-
resolution team.  In addition, we have identified several
interface areas that we need to tackle in order to complete
a set of security interfaces for portable applications
(identification and authentication, administration and
portable formats of security attributes, cryptography, and
network security interfaces).  Alas, we have been unable to
make any headway in these new areas because we cannot seem
to get enough organizations to submit proposals, nor can we
reach critical mass of people willing to do the work.













- 3 -



Sigh - What's a chair to do?  Flood the Internet with calls
for participation and proposals?  Done it.  Personal appeals
to ex-members?  Done it.  Complain and wallow in self-pity?
Done it.  Get mad and stomp around some Marriott?  Done it.
Ignore the problem and act like fifty new attendees will
show up?  Done it.  Continue the work and make progress, no
matter how slow?  Doing it - for as long as it takes.






















































Volume-Number: Volume 34, Number 6