1. Enterprise Enterprise Wrappers for Information Assurance DARPA/SPAWAR Contract N66001-C-8023 Mark Feldman, Wayne Salamon, Steve Kiernan, John Axisa NAI Labs, Network Associates OASIS Winter PI Meeting 12 March 2002 Not for Public Release

2. Enterprise Wrappers slide 2 -- 3/12/02 OASIS PI Meeting -- Not for Public Release Overview and Status Blah, blah, blah Wrappers Blah, blah, blah NAI Labs Blah, blah, blah Teknowledge Blah, blah, blah Enterprise Success, but more work to do

3. Enterprise Wrappers slide 3 -- 3/12/02 OASIS PI Meeting -- Not for Public Release A Parallel, Collaborative Effort Using Previous DARPA Research Prototypes as a Base Teknowledge: Windows NT/2000 NAI Labs: Multi-Platform, concentrating on Linux under this program http://opensource.nailabs.com/wrappers/ Base Technology and Teaming ftp://ftp.tislabs.com/pub/wrappers/

4. Enterprise Wrappers slide 4 -- 3/12/02 OASIS PI Meeting -- Not for Public Release Enterprise Wrappers Goals  Integrate host-based wrappers into scalable cyber- defense system  Create common, multi-platform, policy-enforcing infrastructure  Populate this infrastructure with useful monitors, authorizers, and controllers  Dynamically ensure a consistent, enterprise-wide policy “Scaling the power of the wrapper to the enterprise”

5. Enterprise Wrappers slide 5 -- 3/12/02 OASIS PI Meeting -- Not for Public Release Enterprise Wrappers Objectives Wrapper Network Interface –Off-board cyber-defense controllers –Off-board communication of wrapper data Multi-Platform Host Controller –Manages dynamic insertion and removal of Wrappers –Network-scalable NWM Network Schema & Data Hardened System “Soft” System Manager Interface Other IA components, such as intrusion detection, sniffers, secure DNS, IDIP, etc. Boundary Controller... service WMI proxy Control Protocol Data Push/Pull Linux or NT Wrapper Subsystem Data Base Hardened System(expanded) Host Controller M M M M MediationCocoon App M M M M MediationCocoon App

6. Enterprise Wrappers slide 6 -- 3/12/02 OASIS PI Meeting -- Not for Public Release Revisiting What “Policy” Means Here A combination of –Wrappers written in WDL –Activation Criteria –Data to drive decisions Distributed based on –Hardware/Software Platform –Network Topology –Geographic Location –Mission –Users via a secure, hierarchical distribution mechanism driven by a GUI (drag-and-drop) with local override

7. Enterprise Wrappers slide 7 -- 3/12/02 OASIS PI Meeting -- Not for Public Release What We’ve Done Lately Selected and implemented technologies –Communication using sockets (adaptable to BEEP, Spread, SSL, IPSEC) –Portable Java-based host and network controller and lightweight native host controller –Portable storage mechanism (LDAP) for policy First release with Enterprise functionality –One GUI to rule them all –Implements policy across the Enterprise Started experimentation and testing of policy model

8. Enterprise Wrappers slide 8 -- 3/12/02 OASIS PI Meeting -- Not for Public Release Come see the Demo! We’ll be demonstrating Enterprise Wrappers for the first time* Wednesday night. Please stop by to see the power of the wrapper scale to the enterprise * Outside of a preview to Jay in October

9. Enterprise Wrappers slide 9 -- 3/12/02 OASIS PI Meeting -- Not for Public Release DARPA-hard Questions we still have Is the Policy Model adequate for the user? Are pre-packaged groups of wrappers, activation criteria, and data sufficient? Will composition produce unexpected/unintended results? Will the administrator-in-the-middle hierarchical model produce unexpected/unintended results?

10. Enterprise Wrappers slide 10 -- 3/12/02 OASIS PI Meeting -- Not for Public Release NAI Start Teknowledge Start Schedule Norfolkgk PI Meetin Hawaii PI Meeting2001200020022003 Base technology build-up Host & Network Controllers Santa Fe PI Meeting Updated Wrappers New API design and implementation Hilton Head PI Meeting Interoperability Summer PI Meeting TBD: Useability Wrapper population Integration with other OASIS technologies You are here

11. Enterprise Wrappers slide 11 -- 3/12/02 OASIS PI Meeting -- Not for Public Release Technology Transfer Wrappers are available and being used; Enterprise Wrappers becoming the default. Actively seeking input on –wrappers necessary to protect mission –ways to make wrappers easier to use Continuing to make the toolkit, including new Enterprise functionality, available under the GPL. ftp://ftp.tislabs.com/pub/wrappers/ http://opensource.nailabs.com/wrappers/

12. Enterprise Wrappers slide 12 -- 3/12/02 OASIS PI Meeting -- Not for Public Release ? Questions, Suggestions, or Ideas