Brindle on Security

First a clarification: in my last post I said that least privilege is the ultimate goal of most MAC advocates but that isn’t entirely true, I accidentally ignored a large portion of MAC advocates (mostly those that predate me!). There are several different models which are commonly implemented and thought to be correct. In the government industry that model is Multi Level Security (MLS) and is in no way least privilege, but that is another topic altogether. In the civilian sector status quo encapsulation is a popular model to implement, which is what I’ll be talking about today.

Read the rest of this entry

Just about any Mandatory Access Control (MAC) advocate will tell you that their ultimate security goal is least privilege. Least privilege has become a metaphorical holy grail in the security industry. Least privilege, in its unadulterated form is giving each user, process and so on the exact access it needs and no more.

Read the rest of this entry

I’ll start this blog by introducing myself. My name is Joshua Brindle and I’ve been working on security software and such for a while. About 4 years ago I started Hardened Gentoo which exposed both myself and many users to modern security systems available for Linux. This project has, in many ways, led me up to where I am today in my career and otherwise.

Today I work at Tresys Technology on research and development on security systems. My main project is the SELinux Policy Server, which is an opensource project working on policy management and policy access control for SELinux but I also help out with various other projects around the company.

While I don’t have the 20+ years of experience that some of my peers and coworkers have I do believe that I have some unique insights that I haven’t seen published or otherwise so I’d like to take advantage of the so called “blogosphere” to share them.

Hopefully, with the help of this and other blogs, we can help make security more prevalent outside of the security industry. Large strides have been made in this respect in the last year, especially the introduction of SELinux into a mainstream, general purpose operating system (Red Hat Enterprise Linux 4). This blog will be more focused on security philosophy and theory rather than the practical and howto style posts of other blogs, such as Dan Walsh’s.

That said, I invite requests for specific subjects in posts and I’ll try to facilitate them if I’m able so keep reading and watch out for my first post, “The Myth of Least Privilege”