HP Safeguard software enhanced with ACL Warning Mode

January 29, 2004

Access Control List (ACL) object-level Warning Mode, a new feature for Safeguard software, is being released with the general availability of release version update (RVU) G06.22 of the HP NonStop operating system.

With the new object-level Warning Mode feature, warnings can be enabled on an individual protection record, making it possible to tune new settings while maintaining global system security.

Comparing system-level and object-level Warning Mode

This new feature is important because previous Safeguard warning mode functionality did not allow the user to test settings on new applications or files without lowering the security for the entire system. For example, with the old, system-level Safeguard Warning Mode, common application migration practice might start by running Safeguard software with Warning Mode enabled. An initial set of access controls would have been designed and added to Safeguard. Then the audit trails would be examined to find and resolve the object access denials that were enforced by the Safeguard security settings. When the access controls were determined to be appropriate, Warning Mode would be switched off. However, this system-level Warning Mode scenario does not allow for test settings on new applications or files without lowering the security for the entire system.

With the new object-level Warning Mode functionality, Guardian security is in control of access to any object that has the Warning Mode attribute enabled in an ACL. Safeguard software then unconditionally audits the new access decision even if the ACL would deny the access. This allows the security administrator to easily and safely tune new ACLs.

Second new Safeguard enhancement results from requests by the ITUG Security SIG

The commitment made by HP to implement the Safeguard ACL Warning Mode enhancement is the result of work done by the ITUG Security Special Interest Group (SIG) to develop a list of the six most desirable enhancements to Safeguard software. In response to the Security SIG’s work, the NonStop Enterprise Division has added additional developers to the Safeguard team, and this release is the second of their efforts to implement the Security SIG’s recommendations. For more information about the release of the first Safeguard enhancement, see HP Safeguard software enhanced with ACL diskfile persistence.

Ordering information

There is no change in the license fees for Safeguard software (product ID 9750). Customers currently licensed for Safeguard software will receive this new feature automatically when they order a NonStop operating system RVU G06.22 site update tape (SUT).

This news is published on NonStop Computing websites. January 2004.