Practical non-government uses of Biba, Bell-LaPadula, etc. models

Question

For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't allowed to write to system (high) objects. Inevitably, this kind of fades away as the end user just starts clicking yes every time the dialog pops up, but at least the framework exists...

Some of this also appears in the Qubes project. (good blog entry), and that's something that one might actually use on a daily basis for their own integrity and security.

Any additional examples for applying these models to data that isn't in the traditional government intel / classified data realm?

Answer 1

Maybe not so much as in the formal definitions, but the more generic Mandatory Access Control, and the subsets of no-write-up etc, are sometimes used, in combination with other models, as part of a more complex authorizations scheme, usually in custom business applications.

The need to differentiate permissions based on a strict hierarchical model, and/or persist the current "state", does occur in complex business systems, albeit not often.

I would also point out that XACML can support this too (even if kinda indirectly).

The techniques are also sometimes "used" in some risk analysis excercises (e.g. tracing possible data flow violations of these expectations).

Besides, as you mentioned, a similar form is being implemented in current OSs - Windows, and also SELinux as @D.W. mentioned - so yeah, it seems to be generally applicable, and becoming very common.

Answer 2

Generally speaking, those models tend not to be used exactly as-is. The problem is that very quickly "everything becomes low", because everything depends (through some long chain of dependencies) on something you got over the Internet. As a result, you got a lot of false positives or annoying dialogue boxes.

However, there are widely-used systems which are partly based upon the ideas found in those models. You mentioned Windows. Another example is SELinux, which is widely deployed on Fedora Linux machines. A third example (more loosely related) is taint tracking, which is used to detect vulnerabilities and protect systems against data-driven attacks. Taint tracking is conceptually to the Biba model: untainted data is "high", tainted data is "low", and anything that depends upon tainted ("low") data is also tagged as tainted ("low").

So while the models have largely proven to be unworkable in their originally envisioned form (for general-purpose computing), less restrictive variants have had some impact.