>Return-Path: <NIEMCZUKJ(a)bah.com>
>Date: Wed, 03 Jul 1996 5:45pm
>From: "Niemczuk John" <NIEMCZUKJ(a)bah.com>
>To: vanbelld(a)bah.com, hapemand(a)bah.com, anthony.vitale(a)qmgate.trw.com,
> balenson(a)tis.com, ballodi(a)paralon.com, bdorsey(a)v-one.com,
> benner_tim(a)bah.com, bitting(a)mitre.org, bonatti(a)bah.com,
> cme(a)cybercash.com, crowan(a)jgvandyke.com, cscrugg(a)spyrus.com,
> dale(a)sctc.com, davidh(a)checkpoint.com, davids(a)checkpoint.com,
> fred.unterberger(a)east.sun.com, ghilborn(a)csc.com, hecker(a)netscape.com,
> hh(a)columbia.sparta.com, hittman(a)v-one.com, housley(a)spyrus.com,
> hthomas(a)smiley.mitre.org, iolson(a)mitre.org, j_rolen(a)hud.gov,
> jacksont(a)lfs.loral.com, jalexand(a)aero.org, james.prohaska(a)litronic.com,
> janispel(a)caas.com, janisple(a)caas.com, jbiggs(a)csc.com,
> jfurlong(a)mitre.org, jharrell(a)centech.com, jim.beattie(a)network.com,
> jim(a)lsli.com, jmat(a)vnet.ibm.com, jmyers(a)mitre.org, jswang(a)v-one.com,
> kearny(a)betuvic1.vnet.ibm.com, khrose(a)annap.infi.net,
> khutton(a)lfs.loral.com, kurowski(a)lfs.loral.com, lnotargi(a)us.oracle.com,
> louden(a)mitre.org, luther(a)sware.com, migues_sammy(a)prc.com,
> mikez(a)secureware.com, mjm(a)reston.ans.net, mkrenzin(a)mail.hcsc.com,
> mmancuso(a)v-one.com, mulvihil(a)smiley.mitre.org, netland(a)scc.com,
> olkowskid(a)comm.hq.af.mil, oswald(a)columbia.sparta.com, pguay(a)mitre.org,
> price_bill(a)prc.com, ray(a)sesi.com, sferry(a)raptor.com,
> shlomo(a)checkpoint.com, sledgerw(a)bdm.com, smith(a)sctc.com,
> tcfarin(a)sed.csc.com, tehrsam(a)us.oracle.com, thomps1r(a)ncr.disa.mil,
> vritts(a)cscmail.csc.com, watt(a)sware.com, wneugent(a)smiley.mitre.org,
> woycke(a)mitre.org
>Cc: jhsteve(a)missi.ncsc.mil
>Subject: Minutes Of the WWW I&A Forum
>
> Multilevel Information Systems Security Initiative
>(MISSI)
> Identification and Authentication (I&A) Forum
> 3 June 1996, Meeting Minutes
>
> The theme of this I&A Forum was security for the World Wide Web (WWW).
> The following was the agenda for the meeting:
>
> - Introduction - Dave Luddy, National Security Agency (NSA)
> - Web Technology Overview - Dave Dodge, NSA
> - INTELINK Security Needs - Susanne Rosewell, ISMC
> - Mitre Corporate Experiences Using The Web (An Information Security
>[INFOSEC] Point Of View) - Michael Louden, Mitre
> - Security Policy Summary - Dale Hapeman, Booz, Allen & Hamilton
> - Internet Engineering Task Force (IETF)/Worldwide Web Consortium (W3C)
>Secure Web Standard Activities - Judy Furlong, Mitre
> - Netscape and Web Security - Frank Hecker, Netscape
> - Protecting Web Sites From Attack - Dr. Rick Smith, Secure Computing
>Corporation
> - Security products For WWW Applications - Mike Zauzig, SecureWare
> - WWW Access (Attempting Solutions) - Dale Hapeman, Booz, Allen & Hamilton
> - Forum Wrap-up - Dave Luddy, NSA
>
> Mr. Dave Luddy, the Forum Chairperson, opened the meeting with an
>overview of the forum. He discussed:
> - The goal of the forum is "to insure the commercial availability of
>affordable I&A solutions that meet our customer's security, performance,
>interoperability, and security management needs."
> - The focus is on MISSI FORTEZZA based solutions.
> - The development of an I&A Concept Of Operations (CONOPS) will be used as
>the means of capturing I&A requirements for WWW access and other network
>applications.
> - The forum participants and modus operandi are documented in the I&A
>Forum Charter.
>
> Mr. Dave Dodge, from the Operations Directorate of NSA, presented an
>introduction to the WWW technology. Mr. Dodge presented an overview of:
> - The Hypertext Transport Protocol (HTTP) which is one of the most
>flexible tools for navigating the Internet.
> - Uniform Resource Locators (URLs) which allow a user to identify the
>location of a resource and the method used to retrieve it.
> - The HyperText Mark-up Language (HTML) which is used to format Web pages
>and present URLs to users.
> - The Common Gateway Interface (CGI) which allows programs run on a server
>to receive data from a user via an HTTP connection.
> - JAVA which allows a program to be moved from the server to a client and
>then executed on the client. JAVA is designed to "protect you from itself".
> It has checks that are made during execution. JAVA is not universally
>implemented yet. There is no tag in the HTML
> - The Secure Socket Layer (SSL)
> - The Secure-HTTP (S-HTTP)
>
>Questions and Answers:
>Q: Is a firewall able to differentiate an access made by a user from an
>access originated by a JAVA applet?
>A: (from Dave Dodge and Frank Hecker): No. A JAVA applet can open any
>random port to the server that provided it.
>Q: Can a JAVA applet make an access through a proxy?
>A: (from Frank Hecker). Either the applet needs to know about that proxy
>ahead of time or it can make use of the existing HTTP browser.
>Q: Do search engines present any special I&A issues?
>A: Most search engines are implemented using the GET or POST HTTP commands
>which feed a program running on the server. Control of access to that
>program is the same as access to any Web page.
>Q: Is there an IETF Working Group (WG) for WWW?
>A: The W3C is an industry consortia that deals with Web issues (it's
>responsible for the new HTML standard). There are many IETF WGs and
>standards related to Web topics.
>
> Ms. Susanne Rosewell, from the ISMC Security office presented a
>briefing on INTELINK security needs. She pointed out that there is a panel
>working on security issues that meets monthly. They are supported by several
>WGs that are addressing:
> - JAVA
> - Access Control
> - Firewalls
> - Inter Domain security
>
> Ms. Rosewell discussed some of the security issues and goals related to
>INTELINK:
> - Currently, Local Administrators provide security by reviewing server
>logs to track who has had access to a server (i.e., no access control).
> INTELINK would like to provide access control at the "front door" and not
>at individual servers.
> - They are looking at using X.509 Version 3 certificates to provide the
>ability to limit access to no foreign (NOFORN) information. They also want
>to use X.509 certificates to identify community of interest (COI).
> - The Inter Domain WG is investigating the use of commercial off-the-shelf
>(COTS) multi-level security (MLS) servers to allow a Secret user to access
>Secret and below data from a server that also contains Top Secret data.
> - A long term goal is to provide "true data labeling" so that data may
>carry and maintain a sensitivity label.
>
>Questions and Answers:
>Q: Isn't it harder to get Secret data into a Top Secret enclave than to
>get Secret data out of a Top Secret enclave?
>A: Yes.
>Q: Is the goal to provide servers that contain both Top Secret and Secret
>data that is connected to both (S and TS) networks?
>A: Yes.
>Q: Is data aggregation an issue?
>A: Current efforts are to only label individual data objects.
>Q: How will an individual user determine what technology to use and when
>to upgrade?
>A: INTELINK will be mandating a SSL capable browser in the future and is
>asking people to comply with that requirement now.
>Q: Will the INTELINK e-mail solution be Simple Mail Transfer Protocol
>(SMTP) or X.400.
>A: The E-mail application package that INTELINK will standardize on is
>still an issue. They need a application now and consider SMTP as the only
>current option. X.400 applications (from the Defense Message System [DMS])
>are somewhere down the road.
>Q: Commercial MLS servers are not readily available, the market has not
>been established. How will INTELINK obtain COTS MLS servers?
>A: There are a few MLS workstations available. INTELINK is working with
>NSA and vendors to solve this issue.
>Q: INTELINK is requiring the use of Version 3 X.509 certificates, DMS has
>an infrastructure based on Version 1 certificates. Is anyone working on
>solving this issue.
>A: There is an INTELINK representative on the MISSI Key Privilege &
>Certificate WG (KP&CWG) which is working on the problem of incompatible
>X.500 infrastructures. Conversion from Version 1 to Version 3 X.509
>certificates is a transition issue for DMS. The issue is the timing of the
>conversion to Version 3 certificates. There was never any intention to
>interoperate between the two versions.
>
> Mr. Michael Louden, who is involved with Mitre corporate management of
>computer and network operations briefed "A Corporate Experience Using The
>Web (An INFOSEC Point Of View). The briefing provided an overview of the
>Mitre Information Infrastructure (MII). In the area of security, the
>briefing included the MII security environment, key security features,
>security trade-offs, and security issues. Miter has different access control
>mechanisms (e.g., Passwords, Tickets) for different servers and would like
>to centralize/standardize the access control mechanisms.
>
>Questions and Answers:
>Q: When Mitre splits into two separate organizations, will you have to
>totally rework your access control rights?
>A: Mitre plans to duplicate the access control system and then delete the
>individuals from the other organization.
>
> Mr. Dale Hapeman, the Booz(Allen I&A task leader, presented a briefing
>on "Sensitive But Unclassified (SBU) WWW Requirements." He started the
>brief by reviewing the Context Diagram from the I&A CONOPS and presented an
>operational environment which showed Web clients an servers relative to SBU
>enclaves. Mr. Hapeman followed with an explanation of how each facet of a
>MISSI security policy could be applied to data as it is being transferred
>between a Client and Server through multiple firewalls. He provided
>definitions of Authorized and Authenticated. Mr. Hapeman finished with an
>invitation to the audience to consider the policies they would like to see
>implemented at the different components involved in a WWW access (client,
>server, and firewall).
>
> Ms. Judith Furlong is a lead INFOSEC Engineer at the Mitre corporation.
>She presented a briefing titled "IETF/W3C Secure Web Standards Activity."
> Ms. Furlong started her briefing with a discussion of the following
>existing Web security standards
> - SSL Protocol
> - S-HTTP
> - Private Communication Technology (PCT) protocol
> - Secure Electronic Transaction (SET) Protocol
>
> Ms. Furlong followed with an overview of the W3C, including a
>discussion of the W3C Security WG. Ms. Furlong covered:
> - The Protocol Extension Protocol (PEP), a W3C proposal for extending HTTP
>to accommodate additional capabilities such as security, watermarks,
>labeling etc. She further described the Security Extension Architecture
>(SEA) using the proposed PEP.
> - The Joint Electronic Payment Initiative (JEPI), a joint WG between the
>W3C's Electronic Payments WG and CommerceNet which is developing an Internet
>payment protocol negotiation scheme and a standard interface for payment
>modules.
> - The Digital Signature Initiative which deals with issues associated with
>applying digital signatures to objects such as video frames.
> - The Platform for Internet Content Selection (PICS) WG which has the
>charter to design technology to support "values-based" content
>rating/labeling. The PICS technology has security applicability.
>
> Ms. Furlong provided an overview of the IETF and its Web Transaction
>Security (WTS) and Transport Layer Security (TLS) WGs.
> She completed her briefing with a discussion of the following security
>areas not being addressed by standards efforts:
> - Secure Search capabilities
> - Mobile Code Security
> - Security Management Functions
> - Interfaces to Security Infrastructures
>
> Mr. Frank Hecker, a senior systems engineer with Netscape
>Communications Corporation, presented a briefing on Netscape and Web
>Security. The briefing covered the security areas and technologies that
>Netscape is active in. Mr. Hecker started with a discussion of SSL and how
>Netscape has improved it through upgrades to their Navigator software as
>well as additional SSL issues they are investigating. He also covered
>Netscape's security related issues:
> - Support for hardware tokens other than FORTEZZA.
> - Making a browser "firewall aware" (e.g., able to authenticate to
>intermediate firewalls) without becoming susceptible to man-in-the-middle
>attacks.
> - Providing directory services for use by many different types of
>applications.
> - Downloadable applications (JAVA and JAVASCRIPT)
> - Financial transactions - Netscape will implement SET
> - Secure e-mail - S/multipurpose internet mail extensions (MIME)
>(initially not FORTEZZA)
> - Public key infrastructure - Committed to X.509 Version 3 Certificates
> - User and/or administrator configurability - Netscape will have a toolkit
>to support Navigator 3.0.
>
>Questions and Answers:
>Q: What are Netscape's plans for supporting applications other than Web
>browsing over SSL connections?
>A: Netscape currently implements HTTP, NNTP over SSL. They plan on
>implementing lightweight directory access protocol (LDAP) over SSL in the
>future. file ransfer protocol (FTP), TELNET, and SMTP/POP3/IMAP4 are
>possible but not planned. Other vendors or individuals have implemented
>TELNET and FTP over SSL.
>Q: How does a user deal with non-SSL servers or optionally implementing
>SSL on a connection?
>A: A page that must be accessed with SSL is designated with a URL starting
>with https:// (instead of http://).
>
> Dr. Rick Smith an information security consultant with Secure Computing
>Corporation presented a briefing titled "Protecting Web Sites From Attack".
> Dr. Smith started his presentation with a history of some of the more well
>known sever penetrations. Dr. Smith discussed several types of attacks and
>methods of protection with Type Enforcement Encapsulation.
>
>Questions and Answers:
>Q: Where are the tables used for type enforcement defined?
>A: There is an Administrators Tool that includes this function.
>Q: How many domains and types can Sidewinder implement?
>A: Dozens.
>
> Mr. Mike Zauzig, a senior products development engineer with
>SecureWare, presented a briefing on "Security Products For WWW
>Applications." Mr. Zauzig provided an overview of his company, aspects to
>web security, and the following SecureWare products:
> - Hannah - Network Security
> - Troy - Platform Integrity Assurance
> - SecureMail - E-mail Security
> - Secure Web Platform Integrity - Safe Web Server
> - Interceptor - Transmission Control Protocol (TCP)/IP Firewall
> - Internet Scanner - Attack Simulator
>
>Questions and Answers:
>Q: Is SecureWare's mail package interoperable with other FORTEZZA e-mail
>implementations.
>A: Yes (Dave Luddy).
>Q: The Security First Network Bank shows a Web server that is connected to
>directly the Internet (not through the firewall). Is this machine running
>SSL on one side and Hannah on the other?
>A: Yes.
>
> Mr. Hapeman presented a briefing which attempted to summarize the
>security requirements presented at the day's meeting. He reviewed the
>security services needed and the requirements that are allocated to
>components. He also discussed the protocol requirements and possible
>solutions available to secure the Web. Different options for authenticating
>to firewalls placed between clients and servers were presented. Much work
>remains to secure the proxy or tunneling solutions.
>
>Questions and Answers:
>Q: The Internet Protocol Security (IPSec) protocol has not been mentioned
>all day. It is very mature and has had much NSA input (especially the
>Internet Security Association and Key Management Protocol [ISAKMP] key
>management protocol). It should be considered as a security solution.
>A: Agreed. IPSec is a viable option, especially for authenticated
>firewall-to-firewall connections. It was not mentioned by name but is
>certainly being considered as a solution.
>
> Mr. Luddy's closing comments were:
> - NIST FIPS PUB JJJ has been discussed at previous I&A Forums. Although
>it presents an authentication scheme, it does not provide for interoperable
>solutions. Dave Kemp has authored a Public Key Login Protocol that provides
>the detail needed for interoperability. The document will be submitted as
>an IETF Internet draft. Comments are solicited.
> - The I&A CONOPS document will be sent out by e-mail to everyone who
>registered.
> - The topic for the next I&A Forum is Access Control. It is scheduled for
>8-9 July 1996.
>
>
>
