Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
369
the NATO Enterprise Identifier (NEDS terminology). Where multiple
values are used for the identifying claim, then each value should be verified
(at least by the federation broker) to ensure that it has been issued by
the correct STS;
• it will be a primitive data-type, i.e. a string value.
E. Operational security
This decision point covers the following areas:
• Assertion-Based Authentication and Authorization Assurance – it is imperative
that in a classified environment, such as the NATO enterprise,
the identity of the subject is cryptographically bound to the message that
is being sent. Therefore, when for example consuming or providing web
services, it is required that some sort of proof of possession mechanism
is used, such as one of the WS-Security Token Profiles;
• Secure Communications – the aim of secure communications is to “provide
mutual authentication and protect the integrity and confidentiality
of communications channels”. In the case of browser-based sessions, it recommends
the use of mutual authentication using client certificates over
Hypertext Transfer Protocol Secure (HTTPS). However, within a NATO
environment, confidentiality is provided at the lower levels of the stack,
and the use of HTTPS, while not forbidden, is not preferred, in order to
allow real-time monitoring by Intrusion Detection Systems;
• Assertion-Level Security – assertions issued by the STS MUST be digitally
signed to ensure that they are trusted by the relying parties. Although
the confidentiality of the token in the NATO environment is again provided
by the lower layers of the stack, Encrypted Assertions MAY be used
to further protect the contents of SAML assertions that are distributed by
the STS. Therefore, any STS MUST be able to issue both encrypted and
unencrypted tokens, and any Policy Enforcement Point (PEP) MUST be
able to process both encrypted and unencrypted security tokens;
• Audit and Forensics – regardless of the NATO dimension being considered
(“NATO as an Enterprise” vs. “NATO as an Alliance”), the NATO applications
require tight controls within the domains where they are used.
It implies a requirement to use strong detective controls, not just the preventive
ones. Currently, NATO is executing the NATO Computer Incident
Response Capability (NCIRC) project, aimed to deploy the cyber defence
capabilities (including audit and forensic functions) in both NS and NU/
NR environments. In the context of the “NATO as an Enterprise” scenario,
the task would be to identify the interfaces and mechanisms through which
the federation services can be controlled and secured by the operational
security infrastructure provided with the NCIRC project. The situation