Life-Cycle Management - Army Logistics University - U.S. Army

Team hacker attacks. The attacks were designed to probe
the ability of UltraLog’s multiple security defenses to
preserve the confidentiality and integrity of its logistics
functions against real-world threats based on the concept
of operations scenario. Emphasis was placed on determining
if the defense performed as expected and what
the likely impact of the success or failure of the defense
would be on the resulting logistics plan. A sample of
these experiments follows.
Invalid User Log-in
This experiment tested if an unauthorized user could
gain entry into the UltraLog system. It involved a nonexistent
user with a bad password, a valid user with a
bad password, and a valid user with a bad certificate.
UltraLog successfully prevented the breach of this
“first-line” security defense. The logistics functionality
of the system was protected by successfully deflecting
unauthorized users at the log-in screen. This
defense is particularly important in a deployed and distributed
system, where it may be relatively easy for an
unauthorized user to gain access to a processor running
an operational UltraLog logistics system.
Unauthorized Access
A trusted user operating as an enemy agent or working
with other malicious intentions can be extremely
damaging to military operations. Compartmentalizing
access to systems and data is a fundamental mechanism
for limiting potential damage. An UltraLog user has
defined levels of access to various UltraLog services. In
an operational context, these levels of access would be
used to define the roles of maintenance and supply technicians,
logistics planners, and decision and approval
authorities at different levels in the chain of command.
The purpose of this experiment was to determine if
a user would be allowed access to functions for which
permission had not been granted. A valid user with a
valid password logged in and attempted to access several
unauthorized services. Access to these services
was successfully denied in every instance. The runs
were repeated with the user attempting to access resources
for which use was authorized. In these runs,
the user was able to access the authorized services.
These experiments were repeated using authenticating
certificates, and again the user gained only the appropriate
level of access. Messages were generated advising
security managers of the attempt to access
unauthorized functions. This combination of successful
deflection of access and generation of alerts provided
a sufficient defense against unauthorized access.
Disallowed Messages
A series of experiments was performed on controlling
the transmission of information and instructions
22
between agents. UltraLog agents, whether physical
agents such as a combat or support unit or UltraLog
functional agents such as the security manager, are required
to perform specific tasks with specific communications
requirements. Policy establishes with whom
an agent may communicate and the nature of that
communication. From an operational perspective,
this ensures that communications are limited to what
is needed and that commands and instructions flow
correctly along the military and logistics chains of
command. These experiments demonstrated the following
successes—
• Agents were prevented from sending messages
prohibited by policy. In the experimental runs, UltraLog
successfully stopped the message on the
sender’s node and the message was not delivered to the
intended recipient. Security messages were generated
documenting the attempted transmission of a message
in violation of policy. Operationally, this defense
could be used to isolate military units that display suspicious
behavior or to compartmentalize the force
structure so that the impact of a rogue agent can be
limited to a subset of correspondent agents. [“Correspondent
agents” are a group of agents with which
the bad agent communicates.]
• Agents were prevented from sending disallowed
directives. Messages may contain directives that ask
or direct that something be done. Policy determines
which directives an agent may use and which are prohibited.
For example, it might be inappropriate for a
signal company to direct that a transportation company
move a tank from one location to another. Based on
the experimental data, UltraLog’s access control service
on the send side enforced policies that specify the
directives an agent is allowed to send. Operationally,
this prohibits a military unit from issuing orders without
appropriate authority.
• Receivers rejected disallowed directives. This
experiment examined the situation that occurs when
a compromised agent successfully sends a message
with disallowed directives and determined if the
receiving agent detected and rejected the prohibited
message. In the experimental runs, the message
access control service successfully prevented
agents from receiving messages containing disallowed
directives.
• Receivers rejected disallowed messages. This
experiment examined what happens when a compromised
agent successfully sends a disallowed message
and determined if the receiving agent detected and
rejected the prohibited message. The experiment
demonstrated that UltraLog agents detected, rejected,
and reported when messages disallowed by policy
were received. Operationally, this defense
effectively isolated a military unit from a rogue
MARCH–APRIL 2005