RE: Security Admin package for multi level security

["V. Leveque" <vleveque@xxxxxxxxxxxxx>]

I'm not sure how Bob/Martin would define it, but conventionally it is the
security model followed for government classified information.  Each item of
information has a classification, based on the consequences if disclosed
(e.g., Top Secret means it would cause "grave harm" to national security if
disclsed, etc.).  Each user is given a clearance level corresponding to how
trustworthy they are(are they citizens?  Did they pass the polygraph test?
Did they ever "inhale"?).  The higher the clearance you have, the higher the
classification of information you can access.

A system with a multilevel hierarchical security system mimics this by
assigning users and data labels, which must match or exceed for access to be
allowed. If you only have a Secret Clearance (you inhaled!), you cannot see
Top Secret information.

IMHO, this is not a widely useful model for non-government non-national
security organizations.  The AS/400 also does not support it well.  Other
models of security include so-called discretionary access control ("I own
it, I get to decide who else sees it") and transaction-like security, based
on preserving the integrity of financial record keeping through basic
accounting controls (separation of duties, etc.).  The AS/400 handles both
of these cases fairly well - and I think excels at transactional security.


At 03:21 PM 11/2/99 -0800, you wrote:
>>I am searching for a Security Package for AS/400 based on a multi level
>>hierarchical security approach.
>
>Bob/Martin - 
>
>Would you define a "multi level hierarchical security model"?
>
>Kenneth
>
>****************************************
>Kenneth E. Graap
>IBM Certified Specialist
>AS/400 Professional
>Systems Administrator
>NW Natural (Gas Services)
>keg@nwnatural.com
>Phone: 503-226-4211 x5537
>FAX:    603-849-0591
>****************************************
>
>
>-----Original Message-----
>From: Martin A Norman [mailto:man@cct.cc]
>Sent: Tuesday, November 02, 1999 1:45 PM
>To: midrange-l@midrange.com
>Subject: Re: Security Admin package for multi level security
>
>Bob Marion
>perotsystems
>Phone:  972/461-3186
>email:  bob.marion@ps.net
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
>| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
>| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator: david@midrange.com
>+---
>
>

     |----------------------------|  "Outside of a dog, a book is a man's
     |\  /         |    \  /      |  best companion.  Inside of a dog,
     | \/ INCENT   |__E  \/EQUE   |  it's too dark to read."  
     |----------------------------|        -- Groucho Marx 

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---