Slashdot Mirror
Building Secure Computers?
maotx asks: "Growing into the job of a system administrator, I've been tasked with something I'm not quite prepared for: purchase or build a computer that meets DoD compliance for classified 'Secret' information. Several vendors, including Dell our primary supplier, offers computers that will work, but being new to the criteria I want to make sure the right computer is purchased. The computer will be used to create secure CAD drawings (Solidworks, OrCAD, etc) and must have, from what I can tell, a removable hard drive and security stickers to prevent tampering. What is you're experience in setting up a secure computer and is it better to have a vendor do it, or yourself?"
If you have to set up a secured computer and your Facility Security Officer can't direct you how (roughly), then there's no way you'll get classified information on the system. It's not like you can set up a computer and all of a sudden the government will trust you to put secure information on it. You need to have a written, approved procedure for doing so. Your DIS rep has to authorize you to put stuff on the system.
At I place I used to work, we just bought Dells. (Heck, I think we even leased them!) When they were delivered, we'd put a standard image on them that did things like warn the users before they logged on, and turned on auditing on certain directories.
I'm involved in IA (Information Assurance) on VA Class subs... for Voyage Management and Radar.
A sticker and removable hard drive complying with IA is like saying that a power cord is what's needed to make a computer.
At one point we had a meeting and reviewed the full blown DoD requirements for secure computing. Our estimation was that the resulting system would A) be unusable for anything due to the insane lockdown policies, and B) cost around a $million to configure and test to their specs.
It's all about configuration.
Ok, on the non-sensational side... other computers where I work, for dealing with classified data, are to be located in a certified secure room (forget the name of the certifying authority), and yes there is a "class" / "unclass" sticker on the PC, and yes, the hard-drive is removable, and yes must be stored in an approved safe while not being used. And access to the room is by approval only, with both a horribly hard to use combo lock, and a cipher door lock on top of that. Oh yeah, connection to the house-net is verboten. Any-net for that metter.
And my facility is a low-brow Secret only site. Travel to certain DoD contractors with only a Secret clearance and you're treated like a second class citizen.
It's all about configuration. (repeated intentionally)
Be prepared for mind-numbing configuration, test and audit sessions.
I am light on details because I do my best to stay at arms-length from IA at work... it's teh suxor
w
My suggestion would be to disable floppy as well as USB, and only allow transmission of information to and from this system via CD. USB is right out...don't let anyone try to convince you otherwise...it's an unacceptable security risk. Also, only allow data to be transferred to and from a protected 'sandbox' area on the system, and make certain that autorun of CD-ROMs is disabled in the registry. One more thing: keep the system in a locked room, and personally supervise, if not actually conduct, all data transfers.
Sure, it sounds paranoid...bit is it paranoid enough?
____
~ |rip/\/\aster /\/\onkey
To clarify:
Our company is rated for 'secret' information. We currently have classified information, it is just paper right now. We have been requested to expand our capabilities so we may develop new products to meet the demands. We have a set of papers that are pretty light on the details of what is required for a computer to be certified for secret information, but it does not go into enough details for us to have an open mind about it. If we want a secure computer, thats easy. Case sealed with stickers, operating system and software installed on removable hard drive, no network card, and a paper trail going all the way down to the details of the last person who sneezed on it.
What I was really trying to ask was, "In your experience, is the extra money going into a vendor worth it or, is it better just to by a chassis and setup a machine yourself?"
I'm a virgo and on Slashdot. Coincidence? Yes.
Most of what you need to know is contained on the Defense Security Services (DSS) Information Assurance website: http://www.dss.mil/infoas/ The guiding document for DoD contractors is the National Industrial Security Program Operating Manual (NISPOM). Classified systems have to go through a formal certification and accreditation process before they will be approved for classified processing. Since your ultimate goal is to satisfy the accreditor, you should contact him/her as soon as possible to have them explain what will be required and to hear their particular areas of concern so that you can address them early in your design. Security paperwork requires considerable time to fill out, and mistake can result in long delays in accreditation, or even the rejection of your system.
However, it isn't enough to just build a system with the proper hardware and software configuration -- you also have to make sure that the physical environment and users will meet the requirements of the NISPOM. If you don't already have a facility clearance, then you have a significant issue to tackle before you can even build your system. I'm hoping that you are simply building a new computer to add to an existing classified network or house in an existing DoD closed area -- if not, you may find this to be a very daunting task.
"she says i'm lousy conversation. as if that's supposed to help."
First of all, soliciting advice on the construction of a computer that meets DoD compliance on Slashdot , of all places, is probably not the brightest of ideas...you might want to keep this from your employers if you are interested in keeping your job.
I don't see a problem with it. Information on how to classify a computer is not classified.
Second, security stickers on their own simply aren't adequate to the task at hand. Remember, you're looking for tamper-proof, not merely tamper-evident.
The stickers are DoD required to prove that the system has not been tampered with. They are not a means of securing the computer.
I'm a virgo and on Slashdot. Coincidence? Yes.
---My suggestion would be to disable floppy as well as USB, and only allow transmission of information to and from this system via CD.
And I'd have the CD drive read lines under a hardware lock (like the old machines used) and have it shut off unless required.
---USB is right out...don't let anyone try to convince you otherwise...it's an unacceptable security risk.
Agreed. Have only PS/2 mouse and keyboard available. Also make sure that Firewire, serial, paralell, audio jacks on CD-ROM and sound card, and all peripherial devices are GONE, removed or jacks destroyed by one incapicating method or another. Super-glue in serial ports make an awful mess to "recover".
I, a long time ago, made an attack in which I recorded audio on a cd player through the audio jack. I was able to reconstruct the data from the "static sound". I'd call that an attack as much as hooking up a data casette to a Commie 64.
---Also, only allow data to be transferred to and from a protected 'sandbox' area on the system,
I would call that "Printouts".
---and make certain that autorun of CD-ROMs is disabled in the registry.
You ASSume Windows. Nobody running a secure environment would use windows, unless it's just confidential.
---One more thing: keep the system in a locked room, and personally supervise, if not actually conduct, all data transfers.
Double-lock the room, use mag-locks to determine when door is opened. Record open-close actions.
Have 2 video cams that record on any motion to a remote system (just as secure, as it could record confidential data). Have each room record the others' cameras while NEVER under any circumstances allow anybody from one get into the other room.
Also have a 10 minute delay safe for open events to even get to the hard drive. Set up a hypergolic charge in the safe in case of tampering. Also have safe monitor open-close events.
I also have a few ideas on unbeatable object-detection schemes, but I believe they're actually used in real Secure environments. I will not mention them.
Still, the good ol standard of having 2 "Armed to the teeth" guards at the door always suffice as a first precaution. If you can afford this, you can have double-locking doors that 2 seperate entities must open.
Example: To get in, you flash badge to 2 officers. You enter 1'st set of doors. You then submit to scans/checks of whatever to open 2'nd doors. To get out, you walk out the 2'nd doors, and ONLY 2 guys can open 1'st doors from outside. Very secure.
---Sure, it sounds paranoid...bit is it paranoid enough?
Nope.
OK... here's the basics... Excuse the AC post, but the fewer people that know you have a security clearance, the better.
Yes, you can order from Dell, Gateway, HP, etc. The removable hard drive is employed so that when the computer is not in use the hard drive can be locked in a DoD approved container (a pretty heavy duty safe or filing cabinet, normally) that only authorized users can access. If you didn't have a removable hard drive, then the entire room the computer was housed in would need to be classified as a DoD secure space. As it is, while the computer is in use it will need to be out of sight of anyone not cleared to use it. Sometimes something as simple as a curtain is used, while others might keep the computer in a separate room or closet.
The stickers are not for tamper proofing. Rather, they are used to remind you that you are dealing with a classified system and should treat it as such. You can use them across seals, but they aren't required. At the least, they will need to be put on the hard drive, hard drive caddy, computer case, and monitor.
For the drives, it's probably a good idea to disable anything that you won't be using. You can leave floppy drives intact if you want, just be aware that as soon as a non-write-protected floppy goes in the drive, it is required to immediately be labeled as a classified disk and logged. You can take material from unclassified to classified systems, but not vice versa (duh, I know, but it needs to be said). Since this system will be stand-alone, you might consider disabling all the USB ports via the BIOS and just using PS2 for the mouse/keyboard. That will help prevent USB thumb drives from being used. Remember, if the system can write to it, then it has just become classified material. CDs are safe, but floppies, thumb drives, etc. are not unless they are in write-protect mode.
Hope that helps!
You'd need to be prepared to deal with people hardwiring USB keyloggers to the motherboard or inserting into keyboard itself. Or inserting whatever into any other bits of the computer which are available. Add more when you might have to deal with actual professionals in the business of compromising such systems to get at their contents or install bugs for audio. Sounds like a really poor concept to try mixing use. But do ask the real experts, who I assume are your customers.
As a US Air Force member who handles information and uses computers classified as Secret, I can tell you that there's no physical difference between a Secret machine and an ordinary one. If vendors are telling you that they can build a DoD Secret classified computer, then they are simply blowing smoke up your ass.
DoD classifications are all about policy, paperwork, and regulations. Not fancy computers. Most people, when they hear of DoD classifications and security clearances, are quick to imagine black vans, polygraph tests, and high-tech datacenters protected better than Fort Knox. Honestly, that's all a bunch of nonsense. All of the classified systems that I've used were just ordinary computers from ordinary manufacturers.
In my current workplace, we have a standard Gateway PC with a removable hard disk and a few Panasonic Toughbooks. Nothing special at all. The only visible difference between these and the regular office PCs is that they have red stickers all over them that say "Secret" and the fact that we are not to process Secret data on the unclassified PCs and vice versa. The Gateway machine can only be connected to SIPRNET (google it) and the Toughbooks are never connected to any network. That's it. No crazy combination case locks, no biometric devices, no odd software. They all run Windows for crying out loud.
If it is your job to configure a computer to the equivalent of DoD's Secret classification (I know you don't work for DoD or you'd already have people showing you how), I'd recommend getting whatever kind of computer will fit your needs.
Then start looking at writing mountains of policies. The first thing you have to do is restrict physical access. This can be done by putting the machine in a locked room with no windows. A laptop would be even easier... just get a GSA-approved safe and keep it in there when it's not in use. Obviously, you would never, ever, ever connect it to any network, period. All the data going in and out should be on CDRs or USB keys and should be accountable somehow. Figure out who needs to have access to it and if they can be trusted. Be sure to emphasize that failure to follow proper security procedures is grounds for immediate termination, whether any information was compromised or not. Ensure that whenever the machine is used, there are never less than two people present. Create an emergency checklist of what to do if the building catches fire, for instance.
That's all I can think of off the top of my head, you'll probably be able to envision a lot more with some careful thought. Good luck.
You cannot use the machine in both a classified and a non-classified environment. You will get the machine certified for a specific level of classified processing and lock it into a room that is effectively a people-sized safe. Access to the room will be controlled and only cleared and authorized people will be permitted in. They will log their entrances and exits. Each project hard drive and associated backup media will be stored in a separate, individually lockable and differently keyed drawer of a safe certified for classified processing. Users will log every item in each safe drawer and will log every time they open or close any drawer of the safe. EVERY scrap of out put from the system (optical media, magnetic media, or hardcopy) will have to be logged and controlled at both creation and destruction - destruction requires special handling and facilities.
Issues of bootable CD-ROMS, USB data sticks, and product licensing are trivial housekeeping compared to the work you are going to have to undertake to create and maintain a secure processing facility. By the way, printers have memory and printer ribbons retain images - you have to address those items, too. Certified print required.
If you already have a secure processing facility, you also have a certified site security officer (SSO) who has been trained in the use and requirements of the NISPOM. You should be talking to this person, not us.
Spiritus ex Machina
"The universe is not only stranger than we imagine, it's stranger than we CAN imagine."
Any of you /.'ers ever study art history? Here is a little lesson about fraud.
/. mods. You just got social engineered.
In the Art world when a piece of Art has a past where the time record has some glitches in it (Read: unaccountable) it is automatically considered a fraud. When things don't have a timeline, like this guys posting record here and the fact that his myspace profile says he is 19, you gotta know something is up.
Congratulations though
Taken from GP's Myspace profile:
thomas's Blurbs
About me:
if u really want to know just ask
Who I'd like to meet:
i would like to meet peopl from hawaii but i like meeting other people too.
thomas's Details
Status: Single
Here for: Dating, Serious Relationships, Friends
Orientation: Straight
Hometown: wipahu
Zodiac Sign: Capricorn
Smoke / Drink: No / Yes
Children: Someday
Education High school
If you're working for the DoD, you'll need a system that has been certified to handle classified material. The certification process means that it has undergone DITSCAP and meets certain criteria such as EMSEC. You really don't want to be homebrewing a machine that is going to be processing classified material, especially if it's not certified.
Rubbish. Why wouldn't you use windows in a secure environment? Windows is no less secure than any other item of equipment in those situations. Ok, it may get a viral infection which hoses the system, or it may crash more frequently. Other than that nothing is likely to be a problem.
Have you seriously worked in a secure environment or are you making up a load of crap again? You have a code lock and some sort of ID card swipe, so you can identify who has opened the door. People have to swipe out too.
No, you do not have a remote video system anywhere near a secure computer. How secure is the wiring, how secure is the recording device?
Why? You're hardly going to be asked to open the safe at gunpoint, which is the point of time delayed safe locks.
Why, again? They themselves are more a security threat.
It addresses virtually none of the concerns that need to be addressed when dealing with Secret or Top Secret documentation.
My recomendations are:
1. No other eletrical equipment within a 2 metre radius of the computer, this includes telephones, desk lamps, etc
2. Computer is not in a room with windows
3. Computer is enclosed in a faraday cage.
4. Computer is on a desk with no "modesty panel"
5. Door to room where computer is is code lock and id card protected.
6. An independant log is kept of who uses the computer when.
7. Computer is powered on before use and off after use.
8. Harddrive is removed when not in used and kept in a secure safe with a code lock.
9. All staff who have access to the door to the room it is kept have security clearance. (yes, this includes the cleaners)
10. All staff who have access to the door are well paid.
11. the AC inlet to the computer is shielded from other AC cables and is seperated by at least a metre airspace from other cables.
The weakest link in all security is people - keep strict control on those who have access and when, this includes security staff.
Sigh!
t xt
o peratingsystem
The link you refer to points to material that is up to two decades old. The assurance levels you refer to (A, B, and C) are from the Orange Book, the seminal work of the Rainbow Series of security development manuals produced for the U.S. DoD.
The Rainbow Series was superceded in 1996 by the Common Criteria, an international agreement about security functional requirements, assurance requirements, and the processes needed to evaluate the security characteristics of IT products. Products that have met the requirements and undergone the process are listed in an Evaluated Products List. Among operating systems that have met the Common Criteria requirements are Mac OS X, Red Hat Enterprise Linux AS/WS 3, Solaris 9, SuSE Linux Enteprise Server V8, and Windows 2000 Server. All of these must be run on specific hardware configurations and with specific software configurations to retain their certified status in an operational environment. A recent project I was working on needed an HTML-based interface - imagine creating that on a Linux box that could not run X or even activate the frame buffer!
Secure systems are not just platforms that resist the latest script kiddie 'sploit. A system includes people, processes, hardware, software, development methodologies, and the operational environment. This is what makes a secure, assured SYSTEM, not just an expensive doorstop.
Links of (possible) interest:
Orange Book
http://csrc.ncsl.nist.gov/secpubs/rainbow/std001.
Rainbow Series
http://csrc.nist.gov/secpubs/rainbow/
Common Criteria
http://www.commoncriteriaportal.org/
U.S. "Scheme"
http://niap.nist.gov/cc-scheme/
Evaluated Products List (EPL)
http://niap.nist.gov/cc-scheme/vpl/vpl_type.html#
Spiritus ex Machina
"The universe is not only stranger than we imagine, it's stranger than we CAN imagine."