Sigcat Software Showcase 1993/Sigcat 93 Software Showcase dataDisc.ISO/research/library/docs/scchp8.asc

Text File | 1993-02-08 | 17.8 KB | 416 lines

                     CHAPTER EIGHT

     CD-ROM IN THE CLASSIFIED SENSITIVE COMMUNITY


               CD-ROM SECURITY ISSUES

                   David S. Jernigan
       Senior Analyst, Galaxy Computer Services


In looking at security issues with any new technology it
becomes interesting. I remember 25 years ago working in
a vault. We got something brand new -- the first copier
that we were allowed to copy classified information on.
They put it down in a little room next to a security
office. It had two little men in it. You turned over your
classified document. Three days later you got it back all
copied and documented. They got away with that because it
was a very expensive item in those days. We never solved
the security issue of copying. We haven't solved it to
date. One of the things with CD-ROM we want to look at is
what are the real security issues and what are the non-
real security issues. Many security officers will say
"You can't bring that into my system until we solve all
of these problems." All of these problems are problems we
never solved in the hard copy world.


BASICS OF SECURITY

We want to start off talking about some of the basics of
security because in security we always use the same terms
we just change the definitions. By "access control" we
are talking about keeping the unintended user away from
the PC. By "authentification" what we mean is the person
at the PC is the person we think he or she is. The "audit
trail" allows us to have some idea of what that person
did while at the PC. And with good "labelling" we have
some idea what that person did to the files they handled.
These are standard computer security problems. As soon as
we started to deal with computer security about fifteen
years ago these cropped up. But it became more important
with CD-ROM. We talked about classification but just so
everyone is on the same sheet of music.
     There are only three classifications - confidential,
secret, and top secret. It's in the Executive Order, its
defined. This applies to the CD-ROM world as it applies
to the hardcopy world. There are innumberable sensitivity
levels. There is sensitive data. It is unclassified but
it should be handled as classified. In the commercial
world there is company proprietary. All the way up to
sensitive information in the TS world we have various
things. Within secret there are different types and we
have to handle them differently.


OPERATING ENVIRONMENTS

Operating environments give us different requirements
from a security standpoint. Operating here in the
continental U.S. or CONUS (Continental United States) is
a relatively benign operating environment. There are
comparatively few security problems. However, if we go
overseas we have a whole range of problems. Some
countries are essentially the same as operating here all
the way up to some countries where, if we talk to our
diplomats, it's very close to being in open combat on a
daily basis. Trying to develop a security policy that
covers that whole range is very, very difficult.
     There are a couple of special ones. We think of a
ship out in the open ocean as being a very secure well
protected environment. However, if you remember back a
few years, we did lose a ship -- captured -- and it had
a lot of classified documents on it. We lost all of them
to the North Koreans. In our future combat operations we
are going to see more and more small wars in countries we
have never heard of. To support that, we are pushing
intelligence data and other classified information
further and further down the echelon. The lower echelon
the unit is, the more likely it could be overrun. We have
this conflict right there.


AGGREGATION

Let me introduce the aggregation problem. If I have
hundreds and hundreds and thousands of pages of data does
that change the classification or sensitivity level? It
may. In the hardcopy world today there is a document that
is several hundreds of pages of all unclassified data and
that document is rightly and correctly classified and top
secret.


VOLATILITY

The volatility of the data is another problem. Some
classified data has a long shelf-life. Research and
development data on a new nuclear weapon might mean 20-50
years classified. Whereas the data on a combat operation
that's going to go off tomorrow may only have 24 hours
classification. The criticality is the bottom line. You
are looking at -- if the information is compromised can
you still get your job done? What is the damage on
compromise?
     Classified information has always had a requirement
for marking and labelling. Do you remember back when we
did typewriters and carbon paper? We had to mark
paragraphs. It gets more critical in the CD-ROM world
because there is more data. Now, we have always required
that the outside of the document be labelled, the
coversheets and so forth. CD-ROMs will require the same
thing. Recently ISO addressed the standardized label
problem for CD-ROMs. They are very similar to the ones
they came up with for floppy disks. Same color scheme as
the floppy disk labels and the coversheets. So they have
kept that. That we can handle.
     External labels we can handle. But how about
internal labelling? With mass production of CD-ROMs it is
very quick and easy to stamp out many CD-ROMs but we
don't know of any way or any company way of handling a
neat internal machine-readable serial number. Some of the
other things that fall into this are the CD-RDx project
where they have standardized the access methods for CD-
ROMs within the intelligence community with a great deal
of application outside.


ACCESS METHOD

Standardizing the access method makes the security
features more manageable because we are dealing with the
same interface. And Ed asked me to please note that CD-
RDx does not prevent the use of other than Type One
encryption. Type One encryption is the standard for
classified information, so that the CD-RDx allows the
management of classified information in a company or on
a commercial/proprietary basis. The intelligence
community is also working on standardization of internal
documentation, classification, departments and so forth.


PRODUCTION

Production can cause some interesting problems and these
need solutions. If we are going to produce a classified
CD-ROM, that means we are delivering plain text,
classified information to a production facility. That
means the production facility has to be able to handle
that level of classification. There are very few that can
do that. The production facilities that we know of, the
commercial ones, often have a FOCI problem -- foreign
ownership, control and influence. For those of you who
dealt in the classified world, on every contract you have
to put in one of those FOCI statements.
     The intelligence community and other classified
communities worry a great deal about the foreign
ownership problem. Also, all the drives and other
supporting equipment that we know of are made by foreign
companies which leads us into the toughest question. Do
we need this tempesting? CD-ROM drives? Quite honestly I
don't know. As far as I can find out no one has checked
out the tempest signature of a CD-ROM drive. They are
probably not too bad. Not very dirty. They are using low
power, low frequency, low data rate transfers, and would
probably give you low radiation problems. But I don't
know; and as we go into the classified world the security
officers are probably going to want to know. And if they
are needed, who's going to make them?
     Making tempested items by foreign companies causes
other security problems. Looking at the use of CD-ROMs,
of course, provides some new problems for the security
officer. Some of these problems are well understood;
others we don't understand at all. Distribution is
something we can handle. We know how to deliver a
classified item. A CD-ROM is small -- we can deliver
that. If it is extremely sensitive it may be locked in a
briefcase and the briefcase locked to some guy's arm who
is put on a military aircraft and flown directly to your
location. We can do that. It's expensive but we can do
it. We know how to handle classified distribution.
     Storage is another problem that we can handle.
Again, we don't have the volume but we can lock it in a
safe and if necessary put the safe in a vault. The only
real problem is the small size and the potential
aggregation of the information.
     Getting back to my aggregation problem. This is one
we need to do a lot of thinking about in the security
policy world. Just how many secret pages are necessary to
kick this up to the top secret level? I don't know. The
other question is, if we kick it up, how do we justify
it? How does that classifier justify moving this CD-ROM
from secret to top secret. Let's face it, handling secret
in most organizations is not too difficult. Handling top
secret collateral information is a gigantic pain. How do
we explain to the high cheese that just because I dump
all of these ten thousand secret documents onto a disk
that it's now top secret, or to Congress for that matter?
Or, on the other hand, if we don't kick it up and we lose
it, how to explain to Congress that we didn't give it
more protection because it was all in one place and
someone stuffed it into their back pocket and walked out
of the facility with it?
     We are trying to balance the real world against the
emotional world. One potential solution I would throw out
for consideration is that perhaps what we need to do is
look at the life cycle of this classified CD-ROM disk and
protect it at its vulnerable stages? For example, in
transit maybe we want to have a secret disk handled as if
it was TS in transit so that is never goes by registered
mail but only goes by courier. But, again, we need to
think about it both from the technical side from the user
side and from the security officer's side as well, so we
don't build ourselves into a box. Probably the solution
we are going to come up with is encryption. There are a
couple ways of doing this. One way might to have a piece
of data on a disk which relates to a piece of hardware,
which then decrypts the information. Another one is the
SCSI bus solution which John is going to talk about in a
few minutes, and this is probably the most logical
solution available.      If we look at encryption, there
are several ways of looking at it. One way is to take
everything on the disk and encrypt everything on the disk
-- overall total encryption. That's fine as long as when
the disk gets to its destination we want to be able to
have a user access all of the information. In the DoD
(Department of Defense) world they have a slightly more
complex problem. They want to be able to send to a ship
one disk with all the operational intelligence files they
need. But they don't want everything on the disk to be
accessed by everyone that has clearance. So we run into
the compartmentation problem and with compartmentation we
need labelling.
     There are several possible solutions. One is
multiple level encryption where you have portions of data
encrypted and then you have the whole thing over-
encrypted. Or maybe you just have portions of it
encrypted differently. Both of these solutions need to be
looked at. As we get into the CD-ROM world in the
classified arena, we are going to have to come up with
creative solutions. But the labelling is required if we
are going to separate out the data. We need a rigidly
followed labelling schema that's standardized. The
encrypted isolation may help us in the same way that
DIA's comparted mode workstation helped us a few years
ago.


DESTRUCTION

We don't know of anybody who has done research as to how
standards should be set for destroying a CD-ROM. If you
think back to the hardcopy world, we say if it's this
classification we need to shred it down to this size --
it needs to be crosscut, strip shredded, powdered,
mulched whatever. We need to look at the recovery
capability of a destroyed CD-ROM disk and balance that
with the sensitivity of the data. For very sensitive CD-
ROMs we may need to go to a very expensive method of
destruction, but we don't want to do that for a
confidential or unclassified sensitive disk.
Therefore, for these various types of data -- how should
we destroy them? Also fitting into this matrix, along
with sensitivity, is -- where am I in the world? If I am
sitting here in the Washington area, in the benign
continential U.S. environment maybe if I just break it up
and throw it into the landfill that may take care of it.
If you are overseas, it may be a different problem. If
you are in military deployed situation or state
department situation, again its different. If you have a
bunch of people waving banners and signs outside your
embassy gates it's one situation. What happens when the
natives start coming over the fence? We have lost
embassies full of equipment. I will remind you of the
thousand Iranian students piecing back documents and
feeding them back to us -- rather embarrassing.
     Combat always dictates different standards. What
comes up in a U.S. environment where you have
environmental impact statements goes away in combat. We
always have to remember when we put these CD-ROM disks
(classified information) to the military, ships do get
captured, planes do go down in denied areas, and infantry
units do get overrun.
     I want to discuss some methods we have thought of.
We haven't tried them, but I want to throw them out for
you to think about. First, you can burn the thing. If the
fire is hot enough, yes, you can burn it. However, you
are probably going to get some very interesting toxic
fumes which means this method is probably not going to be
authorized except in dire circumstances. Shattering --
just breaking it up. I can make sure its not going to be
used as a CD-ROM again, but how much of that information
can be recovered? Shredding is another possibility. If
you jam that into your little office crosscut shredder,
forget it -- the CD-ROM is going to eat your shredder.
But if you get one of the large hammer mills, it will eat
it. Those, however, are very expensive and very noisy.
How about I dump it into a vat of some interesting
chemical? As far as we know, anything that will dissolve
the plastic and the aluminum gives off a lot of toxic
fumes.
     There's always going to be some unconventional means
-- for combat expediency -- so I will throw out a couple
we have come up with. What happens if I take a stack of
disks and superglue them together? That may well be
sufficient. You can't take them apart without totally
destroying them. That might be sufficient for sensitive
unclassified or even confidential. What happens if I put
the thing in a microwave and nuke it for five minutes on
high power? Our military will always go for field
expedience. What happens if I take a stick of C-4, cap it
and blow it? I think that will probably work but that's
not something you are going to do in the office. And if
you are out in one of these units and you are overrun,
what happens if I pour the battery acid on it? Does that
help? Does that hurt? We need to be able to provide these
people with suggestions. If we are going to put
classified information on CD-ROM disk we also have to
figure out how to destroy it.


CONCLUSION

I have presented a number of problems. Let me give you
some of our conclusions. The technology is here, but the
policy is not ready. I could have stood up here thirty
years ago and said the same thing. We seem to always lag
on our policy. We get overrun by policy. The hardware is
really powerful and getting cheap. It's certainly cheaper
than any other system cost around. That also means the
bad guys anywhere in the world can buy it just as
cheaply. When it gets to the point where it's easy to
build a PC out of parts, the fact that you have a
sophisticated machine means absolutely nothing from a
security standpoint. Classification and handling -- we
really need policy here. But again I could have said that
twenty-five years ago. We will probably get handling
policy long before we get classification policy. We don't
handle classification policy well -- we never have.
Encryption in its various forms will probably be the only
short-term solution and probably the mid-range and long-
term one as well.
     In summary, CD-ROM's advantages from a security
point of view are also its disadvantages. Its small. You
can easily lock it up and easily protect it. But you can
also easily steal it. It is an extremely dense
information medium. A great deal of information can be
stored, but you run into the aggregation problem in
spades. With new standards like CD-RDx, it makes it
easier to use if we can overcome the proprietary search
engine problems, but it also makes it very easy for the
wrong person to read it. In closing, CD-ROM presents an
interesting security problem. Interesting in the
classical Chinese philosophical sense -- we live in
interesting times.

Related Graphics to this paper:

%g JER01.pcx;
%g JER02.pcx;
%g JER03.pcx;
%g JER04.pcx;
%g JER05.pcx;
%g JER06.pcx;
%g JER07.pcx;
%g JER08.pcx;
%g JER09.pcx;
%g JER10.pcx;
%g JER11.pcx;
%g JER12.pcx;
%g JER13.pcx;
%g JER14.pcx;
%g JER15.pcx;





 DATA ENCRYPTION: ONE POSSIBLE ANSWER

                     John Politis
            Director, Business Development
                      Ultron Labs


This paper was done with overhead visuals listed below.

%g POL01.pcx;
%g POL02.pcx;
%g POL03.pcx;
%g POL04.pcx;
%g POL05.pcx;
%g POL06.pcx;
%g POL07.pcx;
%g POL08.pcx;
%g POL09.pcx;
%g POL10 pcx;
%g POL11.pcx;
%g POL12.pcx;
%g POL13.pcx;
%g POL14.pcx;
%g POL15.pcx;
%g POL16.pcx;
%g POL17.pcx;
%g POL18.pcx;
%g POL19.pcx;
%g POL20.pcx;
%g POL21.pcx;
%g POL22.pcx;