NSA Extends Access Control to Network Storage -- Visual Studio Magazine

NSA Extends Access Control to Network Storage

By Joab Jackson
03/12/2008

The National Security Agency is leading an effort to extend its access control work into the arena of network file storage. The effort involves integrating NSA's Flask mandatory access control (MAC) architecture -- now the basis of Security-Enhanced Linux (SELinux) -- into the Network File System (NFS) protocol widely used for network-attached storage devices.

David Quigley of NSA's National Information Assurance Research Laboratory presented the latest work on the project, called Labeled NFS, at the 71st meeting of the Internet Engineering Task Force this week in Philadelphia. IETF currently oversees the NFS protocol.

NSA initiated and led the effort to develop SELinux, an implementation of NSA's Flask MAC architecture for Linux. With MAC, programs and users are assigned attributes such as security levels. Whenever a program spawns a process thread or calls a file, the attributes are checked against the organization's authorization rules.

By deploying MAC, organizations can ensure that machine intruders don't hijack programs to execute malicious tasks, and they can prevent employees from accessing documents they don't have permission to view.

Labeled NFS extends those features across the network. By having NFS handle MAC labels, someone using a trusted computer can read and write files and execute programs that reside on NFS-based network storage. Today, the Flask architecture requires that all programs and files be stored locally.

Labeled NFS can work in smart mode, which allows the file server to make access control decisions, or dumb mode, which means it takes instructions from the client machine.

James Morris, principal software engineer at Red Hat, published the first recommendation for this approach, originally called Security Enhanced NFS, last summer. The company incorporates SELinux into its Red Hat Enterprise Linux operating system.

In addition to SELinux, Labeled NFS could also support Solaris Trusted Extensions, TrustedBSD and Security Enhanced Darwin, a MAC-enhanced version of the Apple operating system.

About the Author

Joab Jackson is the chief technology editor of Government Computing News (GCN.com).

Printable Format

comments powered by Disqus

Featured

In .NET 9 Debut, Microsoft Focuses on .NET Aspire, AI

Microsoft shipped .NET 9 today with the dev team highlighting .NET Aspire and AI in a keynote and follow-on sessions of the livestreamed launch event.
Microsoft Intros 'Guided Chat Experience' for GitHub Copilot in Visual Studio

Microsoft introduced a new guided chat experience within GitHub Copilot, aiming to make developer interactions with AI more natural and effective.
Microsoft's Open-Source Semantic Kernel AI Toolkit Extends to AWS Cloud

Microsoft announced its open-source Semantic Kernel toolkit for integrating advanced AI models into applications is now available on the Amazon Bedrock managed service.
Microsoft Previews Copilot AI in SQL Server Management Studio

In announcing SSMS 21 Preview 1 this week, Microsoft revealed Copilot AI for the tool is also being previewed, privately.
DBSCAN Clustering and Anomaly Detection Using C#

Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of data clustering and anomaly detection using the DBSCAN (Density Based Spatial Clustering of Applications with Noise) algorithm. Compared to other anomaly detection systems based on data clustering, DBSCAN can find significantly different types of anomalies.