Cross Domain Solutions (CDS) facilitate exchange of information across networks with varying security protocols. A unified system of hardware and software authenticate manual or automatic access / transfer of information among incompatible security classification levels. A security domain can be defined as a system or multiple systems functioning under a common security policy.
Cross Domain Solutions provides strategically cost-effective solution to an array of modern day military and intelligence operations, the flawless functioning of which is contingent on seasonable information sharing. Cross Domain Solutions paves way for transfers prohibited by other rigorous data security approaches. The sensitive data of the sharer is vulnerable to be intercepted or inadvertently revealed and the deployment is pivoted around risk management.
A majority of Cross Domain Solution features dedicated software applications running on trusted computing (TC), which serve as a guard in midst of 2 discrete security domains – classified and public data. It only lets data meeting stipulated criteria to move on between domains. The acceptance criteria laid down for approval of legitimate information for inter-domain transfer may be relatively simple (antivirus entrusted with data scan prior to transfer permission from low to highly complex security domains) or complicated (a number of human reviewers vet and sanction high security documents prior to issuance). OWT, data diodes and other one-way data transfer systems are employed for moving data from low security sectors to confidential domains without letting it get tracked in the course of transfer.
These days, software companies are offering affordable Cross Domain Solutions for commercial use so that the inherent network of a company is segregated in segments to uphold the integrity of proprietary data. Companies therefore can erect an impenetrable network while still providing easy access to information, without having to incur the heavy cost of Cross Domain Solutions used in government sector.
Elements of Cross-Domain Solutions
Cross Domain Solutions can be broadly classified into access solutions and transfer solutions. The former enable users to go through information and resources scattered in multi-domains using a single workstation, whereas the latter facilitates information movement across the domains.
Cross Domain Solutions efficacy can be gauged by the success accomplished through relative deployment of its elements on the following parameters:
a) Usefulness: Cross Domain Solution capacitates a user operating from any network to locate and interact with any relevant user who is in possession of information/skillfulness conducive to successful completion of a project. Sharing of information is ad-hoc, resilient and rapid; wherein a number of linguistically diverse, concurrent users on multiple networks will be served. The information is accompanied with images and files.
b) Security: Cross Domain Solution through robust mechanisms enforces reliable compliance to Federal, DoD, and Intelligence Community’s information assurance policies. The policies encompass 3 critical aspects:
- Data Confidentiality: Assurance regarding non-disclosure of sensitive information to unauthorized and malicious processes, users and devices.
- Data Integrity: Information is safeguarded against non-legitimate alteration or destruction.
- Data Availability: Authorized users can timely access data and information services reliably.
Secure Cross Domain Solutions has the capability to moderate user’s access rights to messages at each classification and dissemination control combination point. It ensures easy and rapid identification of incorrectly marked messages. The client chat tool is aware of security restrictions and provides for pertinent classification labeling in user interface while inherently inserting this in chat message.
The Cross Domain Solution has in place strong, user-proof logging of each and every collaboration, which ensures reviewing later on regarding unauthorized disclosure of information.
c) Supportability: Cross Domain Solutions offers interoperability with earlier transfer solutions like ISSE Guard, Radiant Mercury, and Data Sync Guard. This eliminates the need of costly and unwanted duplication of existing capabilities that are proven to deliver.
d) Compatibility: Cross Domain Solutions is agreeable to emergent Federal collaboration standards. This reduces user adaptation time to a new system and prevents duplication of existing tools.
How it Works?
Cross Domain Solution embraces NSA-certified cross-domain collaboration solution founded on ‘Department of Defense’ (DoD) NCES standards. The Cross Domain Collaborative Information Environment (CDCIE) enables information exchange in text chat and white-boarding format through language translation feature and standards-based web services among DoD and other government/non-government agencies operating at varied classification levels.
The architecture is composed of 3 parts:
- Cross domain XML guard
- Collaboration Gateway (CG) which is an XMPP-enabled collaboration server
- Collaboration client which can be users’ machine run software application or CG provided web-based client.
Collaboration Gateway sits at the heart of CDCIE. It supplies mechanisms conducive for triggering collaboration via any Cross Domain Solutions guard capable of XML traffic transfer. Collaboration Gateway ascertains the legitimacy of user, his presence and the nature of metadata to control the information type approved for viewing by individual users. Collaboration Gateway carries out verification of data passing through cross-domain guard for enforcing adequate security policies. Collaboration Gateway paves way for secure and reliable cross-domain information transfer by aligning itself with an XMPP-capable chat client.
The functions performed by Collaboration Gateway are:
- Implementing user security policy
- Authenticating and authorizing users
- Determining users’ authority to initiate cross-domain chats
- Controlling users’ access to different chat rooms
- Impose Message security policy
- Forward or block messages by checking message’s classification labels
- Checking message’s integrity
- Verifying digital signature to prevent message repudiation
- Identifying message transformation
- Scanning messages for potential viruses
- Providing services pertaining to logging, archiving, searching and retrieving information
- Logging and archiving the entire array of cross-domain messages to local database
- Logging every administrative action to controlled log files
- Creating new log files every day
- Preventing access to log files by collaboration users.
Collaboration Gateway integrates the XML Digital Signature and XML Encryption algorithms to implement aforesaid security policies coupled with strong user identification, authentication, and authorization provision. This allows for enhanced confidentiality and data integrity. Collaboration Gateway extends support for US Intelligence Community (IC) metadata standard meant for chat messages’ classification labeling. Collaboration Gateway has in place modular, plug-in architecture supportive of every XMPP collaboration tool with the cross-domain extensions required for enforcing security policies.
Implementing Cross Domain
Cross Domain Solutions implementation starts with identification of people who require collaborating. Their needs are mapped. Various situations are explored like the need for synchronous collaboration capability combining text chat and whiteboarding, general purpose use, or whether a real-time operational support requirement for enhanced availability is justified. The need for language translation is taken into consideration. Would the users like to continue with existing tools like chat clients? If users opt for asynchronous collaboration, would they require the ability for erecting multiple simultaneous domains?
Identifying the type and number of domains to be supported :
Correct level of information assurance can be provided by cross-connecting the right domains. CG paves way for concurrent cross-connection of multiple domains. Several national domains can be connected through demilitarized zone via CG, allowing each domain to lay down its peculiar security policy. Higher-level classifications can be protected through a different accreditation method.
Identifying existing Cross Domain Solutions requirements and infrastructure :
The pre-existence of cross-domain transfer solution makes addition of simple Cross Domain Solution. If no infrastructure exists, evaluation of requirements is to be carried out to obtain benefits contingent upon the specific message types to be transmitted.
Development of installation, integration and training plan :
The specifics of installation are to be assessed based on criteria like need for perfectly new installation, or extension of cross-domain transfer solution already in place. All relevant users and administrators should be imparted adequate training to ensure streamlined transition to new system. The nature and complexity of Cross Domain Solutions will have a bearing on implementation timeline which can stretch to several months. Significant time is consumed in obtaining required administrative approvals.
Installation, integration and training :
Once the permission to hook on to live networks is obtained, adequate assistance is extended to onsite personnel for plan execution. Cross Domain Solutions that are starkly new would require close coordination with solution providers.
Need & Importance of Cross Domain Solutions
Cross Domain Solution enables information flow among incompatible security domains and classification levels spread over heterogeneous networks. It is a cost-effective way to provide access to sensitive and critical information that was earlier locked upstream, hence proving to be of immense help to military, intelligence and other organizations. Cross Domain Solution curtails cost by not posing the responsibility of closely guarding secrets on a high system exclusively. Consistent human review before downgrading highest classified information for lower level access is done away with. At the cost of substantial risk, Cross Domain Solution tends to distribute information at various classification levels by authenticating and authorizing individuals through multiple classifications. The high implementation cost is therefore significantly brought down.
Cross Domain Solution discloses specific information to users without requiring exposing the entire confidential data at multiple levels, which can make it vulnerable to unintended revelations. The risk of subversion is subjectively ascertained in the light of potential program flaws.
Cross Domain Solutions provides information to critical users who are in need of it while restricting access to classified data from unauthorized users; in the process protecting networks from being maliciously or inadvertently suffering data corruption. Cross Domain Solutions has made the process of sharing data among coalition partners in warfare extremely streamlined.
Areas Where Cross Domain Solution System Can Be Used
Cross Domain Solutions appeals to numerous areas owing to the relatively inexpensive information assurance mechanism with least chances of corruption of sensitive data.
Cyber-security: The situational analysis mandates incorporation of large volume of high speed data from internal and external sources. Cross Domain Solutions messaging tools enable real time access to events, logs, sensors, and intelligence data across multiple networks without logically connecting them.
Disaster-response: Cross Domain Solutions permit Federal agencies to easily establish quick communication lines with non-government agencies during a natural disaster for coordinating response and support services. Cross Domain Solutions facilitate open access to geo-spatial services, intelligence feeds and other communication for police, volunteers etc.
Supply Chain Security: Mission critical information is required to be strategically delivered to external partners with whom a company has entered into collaboration to ensure steady supply flow. Cross Domain Solution offers immunity to sensitive information from inside threats and corporate espionage.
Defense, Intelligence Services: Cross Domain Solution enables timely and highly secure communication between multiple coalition partners, military or government agencies to store, process and save data critical to security. The flexibility, speed and security provided are unprecedented. Federal agencies are no longer required to squeeze the entire computing paraphernalia in a fighter or military jet.
Cloud Assurance: Cloud has exploited Cross Domain Solutions to introduce an information sharing environment with numerous user communities each having their own set of unique security policies and checks. Cross Domain Solutions facilitate real time processing and information storage. Information is protected from malicious attacks as it passes along the cloud without the organization directly controlling it through physical or logical checks.
Information Sharing Through Cross Domain Solutions
Cross Domain Solutions is centered on traversing multiple heterogeneous networks to arrive at a destination holding the requested information of user by determining the accessibility right.
Cross Domain Solution distinguishes the data types (text, voice, video, and other) and the related applications (telephony, instant messaging, video feeds, pictures, teleconferencing and video conferencing) to ensure uninterrupted service over a common infrastructure. The varying needs for bandwidth, speed and latency is taken into account. Cross Domain Solutions has to exercise discriminatory scheduling during peak demand periods to keep users updated about latest events.
Cross Domain Solutions require making information accessible to all participating domains that matches the security criteria for data handling. The requirements boil down to 3 discrete levels; 1-way (lower to higher classification domain), 1-way (higher to lower classification domain), bi-directional (transfer of higher to lower classification domain and vice versa). Another scenario is that data is positioned in the parent domain and is available for viewing in other security domain lower or higher than current. There is need to access data in security domain that is at a higher or lower rung compared to current domain. It does not necessarily mean transmission of unencrypted, classified information on an unclassified network. It has to be immune against any suspected, virus rich program. A combination of manual and automated means is in place to ensure data availability, security and integrity during storage or transmission through domains. This is brought about by connecting each security domain to one or greater number of trusted, cross-domain solutions. Information flows through domains in adherence to policies and constraints meant for protection of classified information.
Cross Domain Solution demands tagging of each piece of information with trusted security labels for supporting assured information sharing by transcending multiple security domains.
Cross Domain Challenges & Solutions
The major challenges faced by Cross Domain Solutions are:
- Enhancing the capability of defense systems at reduced cost of development, acquisition and operation through creation of multi-level secure systems operating numerous simultaneous applications on single processor.
- Should be able to provide higher lethality, survivability, functionality, mobility, connectivity, security, safety at lower purchase, implementation and technical training cost.
The potential solutions are:
- Harnessing increase in microprocessor capability through faster, multi-core processors to allow running of many simultaneous software components on a single or lesser number of processors. It is to be ensured that multiple software components produce no interference in malicious way in each other’s jurisdiction and interacting as desired.
- A monolithic, cost-intensive review system has to be disintegrated and partitioned into numerous software components while exercising strict control on mutual interactions. A large application is to be split in smaller security critical parts and larger non-secure components. The security can be downgraded while the component to component interaction is closely guarded.