1. Enterprise Wrappers for Information Assurance DARPA/SPAWAR Contract N66001-C-8023
Mark Feldman, Lee Badger,
Steve Kiernan, Larry Spector,
Wayne Salamon, John Axisa
NAI Labs
OASIS Summer PI Meeting
24 July 2001
Not for Public Release

2. Base Technology and Teaming
A Parallel, Collaborative Effort Using Previous DARPA Research Prototypes as a Base
Teknowledge: Windows NT/2000
NAI Labs: Multi-Platform, concentrating on Linux under this program

3. Enterprise Wrappers Goals
“Scaling the power of the wrapper to the enterprise”
Integrate host-based wrappers into scalable cyber-defense system
Create common, multi-platform, policy-enforcing infrastructure
Populate this infrastructure with useful monitors, authorizers, and controllers
Dynamically ensure a consistent, enterprise-wide policy

4. Enterprise Wrappers Objectives
NWM
Network
Schema
& Data
Hardened
System
“Soft”
Manager
Interface
Other IA components,
such as intrusion detection,
sniffers, secure DNS, IDIP, etc.
Boundary
Controller
...
service
WMI
proxy
Control Protocol
Data Push/Pull
Linux or NT
Wrapper
Subsystem
Data
Base
Hardened System(expanded)
Host Controller M
Mediation
Cocoon
App
Wrapper Network Interface
Off-board cyber-defense controllers
Off-board communication of wrapper data
Multi-Platform Host Controller
Manages dynamic insertion and removal of Wrappers
Network-scalable

5. Code Red Trojan (Hard DARPA Problem)
Could wrappers have prevented this Trojan?
Yes. Through specification-based or other fine-grained access control wrappers (e.g., napenfoce wrapper) and through sequence-based (Hofmeyr, Forrest, Somayaji) ID&R.
Would the existence of an Enterprise Wrappers infrastructure make fighting such attacks easier for admins?
Yes. The admin could view the attack and update systems in near real time.

6. What We’ve Done Lately Modularized GSWTK Identified technologies
Provided interoperation with other LKMs
Augmented infrastructure and APIs for host and network controllers
Identified technologies
Communication for policy distribution (BEEP, Spread)
Portable, Java-based host and network controller
Portable storage mechanism (LDAP) for policy
Selected policy model

7. Design for Java-based GUI and controllers

8. What “Policy” Means Here
A combination of
Wrappers written in WDL
Activation Criteria
Data to drive decisions
Distributed based on
Hardware/Software Platform
Network Topology
Geographic Location
Mission
Users
via a secure, hierarchical distribution mechanism driven by a GUI (drag-and-drop) with local override

9. Questions we have (DARPA-hard)
Is the Policy Model adequate for the user?
Are pre-packaged groups of wrappers, activation criteria, and data sufficient?
Will composition produce unexpected/unintended results?
Will the administrator-in-the-middle hierarchical model produce unexpected/unintended results?

10. Schedule and Status 2001 2000 2002 2003 NAI Start Teknowledge Start
Host & Network Controllers
Base technology build-up
Updated Wrappers
New API design and implementation
...
2001
2000
2002
2003
Santa Fe PI Meeting
Norfolkgk PI Meetin
Hawaii PI Meeting

11. Technology Transfer
Wrappers are available and being used; Enterprise Wrappers will become the default.
Actively seeking input on
wrappers necessary to protect mission
ways to make wrappers easier to use.
Continuing to make the toolkit available under the GPL, including new Enterprise functionality.

12. Questions, Suggestions, or Ideas?