How an advanced architecture can dramatically mitigate massive data breaches

An article in a widely respected journal shows how a Trusted Computer System Evaluation Criteria Class A1 operating system solves major cybersecurity vulnerabilities, such as those exposed by the recent SolarWinds hack. This technology, called a security kernel, is much more effective and efficient at mitigating supply chain attacks and massive data breaches than current futile efforts. Agencies and enterprises can also deploy this technology to dramatically mitigate the massive data breaches that have become all too common. 

For this strategy, information service providers would replace insecure, ineffective firewalls with label-based gateways built on Class A1 devices. This solution is based on a security kernel that labels data received on inbound network interfaces and enforces a mandatory access control (MAC) security policy for that data based on those labels. It mitigates an attacker’s unauthorized efforts to transfer information outside the organization, while supporting authorized business transactions through the labeled gateway.   This advanced architecture can reduce the attack surface by 99% or more. Organizations would no longer have to treat massive data losses such as those suffered by the Office of Personnel Management, Equifax, Yahoo and SolarWinds as “inevitable.”

Standard multi-tier architecture approach

The figure below represents a standard multi-tier architecture’s typical current, inadequate protection mechanisms that can be easily improved by replacing firewalls with label-based gateways.

Separation of the three functional tiers (DMZ web tier, application tier and data tier) is the standard multi-tier architecture design for web services. Web servers are closest to public networks, leaving them more exposed to attacks from outside the organization. Application servers process sensitive information they access from database servers. Firewalls attempt to filter network connections to only those needed to support the applications provided to users.

Unfortunately, today’s firewalls use operating systems that are not, themselves, trustworthy. That presents two problems that have repeatedly led directly to massive data breaches: First, since the OS cannot protect itself from attack, neither can the OS assure the firewall functions are protected. Second, since the firewall functions are not reliably protected, they are easily bypassed or reconfigured. Worse still, the changes made to these firewalls are not reliably audited, again, because their OSes are not trustworthy. That means audit records of changes to configuration, and indeed of information released to the public networks, are not reliably captured and protected from erasure by attackers hiding records of their activities.

Secure systems cannot be built on untrustworthy operating systems, and firewalls are no exception.  Firewalls are regularly hacked and bypassed, and they have repeatedly failed to deliver the protection they are intended to provide, leaving systems in the various “tiers” effectively interconnected in a single security domain connected directly to the public internet.

Enhanced architecture dramatically mitigates massive data breaches

Rectifying this situation does not require replacing everything and starting over. An inherently secure architecture does, however, require placing trustworthy systems at critical junctions where they can control the connections and information flows between tiers. The advanced multi-tier architecture (see figure below) replaces firewalls at network boundaries in the typical multi-tier architecture, with a labeled gateway built on a Class A1 device, using data object labels derived from the hardware interface from which the data enters the gateway. This approach allows authorized transaction requests and responses to flow from one tier to the next, but no others. The labeled gateway running on the trustworthy OS of the Class A1 device enforces mandatory access-control policies to protect the entire system from modification and prevents unauthorized data flows, such as massive data breaches. These labeled gateways can effectively organize tiers into separate security domains and prevent massive data breaches by relying on their trustworthy OS to:

• Protect the OS itself from modification or subversion of its security functions.
• Protect the IT application-specific labeled gateway functions (cross-domain services) the OS hosts and only allow specifically defined transactions to operate between domains.
• Prevent massive organization data transfers that bypass the labeled gateway functions.
• Protect audit information the cross-domain services generate to reliably record transactions.

For example, a defined access-control policy for a database recognizes at least two distinguishable security domains: one is commonly known as the backend that contains the database holding sensitive (e.g., customer, credit card, employee, intellectual property) information; the other domain is the familiar public network. The labeled gateway internally represents all data objects from these distinct network security domains by different labels, which have been assigned by administrators to the specific hardware network interface connected to each tier. The labeled gateway provides a cross-domain service that constrains the type and volume of data passed from the more secure “inner” domain to the less secure outer (more exposed-to-the-public) domains. It completely prevents attempts to bypass the gateway with bulk data transfers not required for enterprise application processing, thus preventing the massive breeches that imperil organizations today.

Advanced architecture summary

This advanced multi-tier architecture relies on a trustworthy OS with a compact security kernel that rigidly enforces information flow between the domains. The maturity of this approach is demonstrated by at least a half dozen security kernel-based OSs that ran for years in the face of nation-state adversaries without a single reported security patch. The National Institute of Standards and Technology Special Publication 800-160v1 recently highlighted examples of such “systems that have been verified to be highly resistant to penetration from determined adversaries.” This original equipment manufacturer technology is still commercially available today.

In current architecture, errors in any application can be exploited for a massive flow of high (database) information to a low (internet) domain.  For example, Equifax was widely blamed for its breach because it had not applied current patches to the web application software Apache Struts. In stark contrast, the advanced multi-tier architecture prevents such massive data flows in spite of application vulnerabilities by allowing (while constraining) the far more common limited and necessary IT application-specific business transaction flows. This alternative architecture reduces the attack surface by 99% or more, meaning massive breaches are no longer “inevitable.”   

This enhanced architecture has the additional advantage of rendering any previously implanted Trojan horses or backdoors, such as those left behind by SolarWinds, incapable of exfiltrating data across these boundaries in violation of the MAC policy.

Deployment roadmap

To deploy this enhanced architecture, organizations will expect to be able to purchase network components, such as a labeled gateway, from a manufacturer or their vendors to satisfy policies such as the Office of Management and Budget’s M-19-03 memo on high-value assets. Similarly, they will expect to be able to integrate the software running on the servers in the various tiers in their infrastructure -- traditionally with firewalls, but now with labeled gateways. Vendors will need to enhance their current products to include a Class A1 device, replacing the standard architecture that is vulnerable to massive data breaches.

To begin that migration, NIST Fellow Ron Ross suggested a government-sponsored competition of public-private partnerships. A coalition of the willing -- for example one or more victims of the SolarWinds attack and manufacturers -- could develop the first prototype labeled gateways and integrate them into the participating victims’ services.  Manufacturers participating in such partnerships would be contractually obligated to host the labeled gateway solutions on an OS designed to meet the Class A1 level of assurance. Those manufacturers might purchase a previously evaluated Class A1 OS integrated in a Class A1 device from a commercial OEM operating system supplier.