Enterprise Wrappers OASIS PI Meeting August 19, 2002 Bob Balzer Neil Legend: Green Changes from February 02 PI meeting

Enterprise Wrappers Goals  Integrate host-based wrappers into scalable cyber-defense system  Create common multi-platform wrapper infrastructure  Populate this infrastructure with useful monitors, authorizers, and controllers

Enterprise Wrappers Objectives Common Network Wrapper Manager NWM Network Schema & Data Hardened System “Soft” System Manager Interface Other IA components, such as intrusion detection, sniffers, secure DNS, IDIP, etc. Boundary Controller... service WMI proxy Control Protocol Data Push/Pull Wrapper Network Interface –Off-board cyber-defense controllers –Off-board communication of wrapper data Host Controller –Manages dynamic insertion and removal of Wrappers –Multi-platform (Linux and NT) –Network-scalable Mutual protection/isolation of Host Controller & Wrappers from the system(s) being protected Linux or NT Wrapper Subsystem Data Base Hardened System(expanded) Host Controller M M M M MediationCocoon App M M M M MediationCocoon App Wrappers Policies Status Alerts

Active Available C++ Policy Editor Enterprise Wrapper APIs Deployable Version Available 12/31/01 Deployed Common Network Wrapper Manager Deploy Installed Host Controller (common API) Install Active Activate Sensed Deactivate Defined UndeployUninstall Define Host Controller (common API) Focus Wrappers Policies Enterprise Version Available 10/1/02

Enterprise Wrappers Current Implementation (as of 2/02) –Network Controller Starts and Terminates processes on controlled desktops Receives Events from controlled desktops –Host Controller Starts and Terminates processes for Network Controller Wraps started processes in accordance with local Wrapper Policy Forwards Events to Network Controller –Inter-Controller Communication via SSL Demo To Do –Deploy Policy to Host Controller

Existing NT Wrappers  Safe Attachments Document Integrity for MS Office  Executable Corruption Detector Protected Path (Keyboard  App.  SmartCard) Local/Remote Process Tracker  No InterProcess Diddling  Safe Web Brower  Safe Office Key:  Policy Driven Wrapper Planned  Single SafeExecution Wrapper Process specific policy

ByPass Prevention Module DLL Uniform mechanism for Intermodule Interactions OS Services Network Sockets CORBA...

ByPass Prevention Mediator added between Module & DLL component Mediator maintains DLL component API Module DLL Uniform mechanism for Intermodule Interactions OS Services Network Sockets CORBA...

OS Kernel Added Kernel Driver Driver ByPass Prevention NTDLL Kernel32 –Direct OS calls Need to Prevent –Direct NTDLL calls Module –Only allows mediated OS calls while in mediator Wrapper registers mediated OS calls Wrapper signals Entering/Leaving