Hardening COTS software with generic software wrappers

Foundations of Intrusion Tolerant Systems, OASIS 2003

Volumn , Issue , 2003, Pages 399-413

  Fraser, Timothy ^a   Badger, Lee ^a   Feldman, Mark ^a  

^a Network Associates Laboratories   (United States)

Author keywords

Access control; Access protocols; Application software; Authentication; Cryptography; Data security; Intrusion detection; Mission critical systems; Operating systems; Protection

Indexed keywords

ACCESS CONTROL; AUTHENTICATION; COMPUTER OPERATING SYSTEMS; CRYPTOGRAPHY; HIGH LEVEL LANGUAGES; INTRUSION DETECTION; MERCURY (METAL); SECURITY OF DATA;

ACCESS PROTOCOLS; AUTOMATIC MANAGEMENT; COMMERCIAL OFF-THE SHELVES; GENERIC SOFTWARES; MISSION CRITICAL SYSTEMS; PLATFORM INDEPENDENCE; PROTECTION; SYSTEM DEVELOPERS;

APPLICATION PROGRAMS;

EID: 84946197037     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/FITS.2003.1264946     Document Type: Conference Paper

References (36)

1. F. M. Avolio and M. J. Ranum. A Network Perimeter with Secure External Access. In Proceedings of the Internet Society Symposium on Network and Distributed System Security, Glenwood, Maryland, February 1994. TIS Technichal Report #0491.
2. L. Badger, D. F. Sterne, D. L. Sherman, and K. M. Walker. A Domain and Type Enforcement UNIX Prototype. In Usenix Computing Systems Volume 9, Cambridge, Massachusetts, 1996.
3. D. E. Bell and L. L. Padula. Secure Computer System: Unified Exposition and Multics Interpretation. Technical Report ESD-TR-75-306, Electronics Systems Division, AFSC, Hanscom AF Base, Bedford, Massachusetts, 1976.
4. B. N. Bershad, S. Savage, P. Pardyak, E. G. Sirer, M. E. Fiuczynski, D. Becker, C. Chambers, and S. Eggers. Extensibility, Safety and Performance in the SPIN Operating System. In Operating Systems Review, December 1995.
5. K. J. Biba. Integrity Considerations for Secure Computer Systems. Technical Report ESD-TR-76-372, USAF Electronic Systems Division, Bedford, Massachusetts, 1977.
6. W. E. Boebert and R. Y. Kain. A Practical Alternative to Hierarchical Integrity Policies. In Proceedings of the 8th National Computer Security Conference, 1985.
7. M. Branstad, H. Tajalli, F. Mayer, and D. Dalva. Access Mediation in a Message Passing Kernel. In Proceedings of the 1989 IEEE Symposium on Security and Privacy, pages 66-72, May 1989.
8. D. F. C. Brewer and M. J. Nash. The Chinese Wall Security Policy. In Proceedings of the 1989 IEEE Symposium on Security and Privacy, pages 206-214, May 1989.
9. W. R. Cheswick. An evening with berferd, in which a cracker is lured, endured and studied. In Proceedings of the Winter USENIX Conference, 1992.
10. D. D. Clark and D. R. Wilson. A Comparison of Commercial and Military Computer Security Policies. In Proceedings of the 1987 IEEE Symposium on Security and Privacy, Oakland, California, 1987.
11. S. Forrest, A. S. Perelson, L. Allen, and R. Cherukuri. Self-Nonself Discrimination in a Computer. In Proceedings of the 1994 IEEE Symposium on Security and Privacy, Oakland, California, 1994.
12. S. Forrest and T. A. L. Steven A. Hofmeyr, Anil Somayaji. A Sense of Self for UNIX Processes. In Proceedings of the 1996 IEEE Symposium on Security and Privacy, Oakland, California, 1996.
13. FreeBSD Online Manual. OPEN, READ, REBOOT. Section 2.
14. D. P. Ghormley, D. Petrou, S. H. Rodrigues, and T. E. Anderson. SLIC: An Extensibility System for Commodity Operating Systems. In Proceedings of the USENIX 1998 Annual Technical Conference, New Orleans, Louisiana, 1998.
15. I. Goldberg, D. Wagner, R. Thomas, and E. Brewer. A Secure Environment for Untrusted Helper Applications. In Proceedings of the 6th USENIX Security Symposium, 1996.
16. Y. Ho, D. Frincke, and D. T. Jr. Planning, Petri Nets, and Intrusion Detection. In Proceedings of the 21st National Information Systems Security Conference, 1998.
17. K. Ilgun. A real-time intrusion detection system for UNIX. In Proceedings of the 1993 IEEE Symposium on Security and Privacy, 1993.
18. K. Ilgun, R. Kemmerer, and P. Porras. State Transition Analysis: A Rule-Based Intrusion Detection Approach. IEEE Transactions on Software Engineering, 21(3), March 1995.
19. B. W. Kernighan and D. M. Ritchie. The C Programming Language. Prentice Hall Press, second edition, May 1998.
20. C. Ko, G. Fink, and K. Levitt. Automated detection of vulnerabilities in privileged programs by execution monitoring. In Proceedings of the 10th Computer Security Applications Conference, 1994.
21. C. Ko, M. Ruschitzka, and K. Levitt. Execution Monitoring of Security-Critical Programs in Distributed Systems: A Specification-Based Approach. In Proceedings of the 1997 IEEE Symposium on Security and Privacy, Oakland, California, 1997.
22. A. Kosoresow and S. Hofmeyr. Intrusion Detection via System Call Traces. IEEE Software, 14(5), September/October 1997.
23. S. Kumar and E. Spafford. A Pattern-Matching Model for Intrusion Detection. In Proceedings of the 17th National Computer Security Conference, 1994.
24. B. W. Lampson. A Note on the Confinement Problem. Communications of the ACM, 16(10), 1973.
25. M. A. Monroe. Security Tool Review: TCP Wrappers. ;login:, 18(6):15-16, November-December 1993. USENIX.
26. National Computer Security Center. Department of Defense Trusted Computer System Evaluation Criteria, December 1985.
27. National Computer Security Center. Trusted XENIX Version 3.0 Final Evaluation Report, April 1992.
28. G. C. Necula and P. Lee. Safe Kernel Extensions Without Run-Time Checking. In Proceedings of the 2nd USENIX Symposium on Operating System Design and Implementation, October 1996.
29. B. C. Neuman and T. Ts'o. Kerberos: An Authentication Service for Computer Networks. In IEEE Communications, September 1994.
30. The Object Management Group, Inc., Framingham, Massachusetts. The Common Object Request Broker Architecture and Specification, revision 2.0 edition, July 1995.
31. D. Sames and G. Tally. JTF-ATD NGII Composable Services Security Analysis White Paper. Technical report, TIS Labs at Network Associates, October 1998.
32. R. Sekar, Y. Cai, and M. Segal. A Specification-Based Approach for Building Survivable Systems. In Proceedings of the 21st National Computer Security Conference, October 1998.
33. M. I. Seltzer, Y. Endo, C. Small, and K. A. Smith. Dealing With Disaster: Surviving Misbehaved Kernel Extensions. In Proceedings of the USENIX 2nd Symposium on Operating Systems Design and Implementation. Seattle, Washington, October 1996.
34. D. Wagner and B. Schneier. Analysis of the SSL 3.0 Protocol. In Proceedings of the Second USENIX Workshop on Electronic Commerce, November 1996.
35. R. Wahbe, S. Lucco, T. E. Anderson, and S. L. Graham. Efficient Software-Based Fault Isolation. In Proceedings of the 14th ACM Symposium on Operating Systems Principles, 1993.
36. K. W. Walker, D. F. Sterne, M. L. Badger, M. J. Petkac, D. L. Sherman, and K. A. Oostendorp. Confining Root Programs with Domain and Type Enforcement. In Proceedings of the 6th Usenix Security Symposium, San Jose, California, 1996.