RFC 3114 (rfc3114) - Page 2 of 14
Implementing Company Classification Policy with the S/MIME Security Label
Alternative Format: Original Text Document
RFC 3114 Implementing Company Classification Policy May 2002
stronger protective measures than other information, which if
disclosed or modified, would cause moderate to severe damage to the
company.
Other types of information such as internal organization charts,
employee lists and policies may need little or no protective measures
based on value the organization places on it.
A corporate information classification policy defines how its
information assets are to be protected. It provides guidance to
employees on how to classify information assets. It defines how to
label and protect an asset based on its classification and state
(e.g., facsimile, electronic transfer, storage, shipping, etc.).
1.2 Access Control and Security Labels
"Access control" is a means of enforcing authorizations. There are a
variety of access control methods that are based on different types
of policies and rely on different security mechanisms.
- Rule based access control is based on policies that can be
algorithmically expressed.
- Identity based access control is based on a policy which applies
explicitly to an individual person or host entity, or to a defined
group of such entities. Once identity has been authenticated, if
the identity is verified to be on the access list, then access is
granted.
- Rank base access control is based on a policy of hierarchical
positions in an organization. It is based on who you are in the
company structure. A rank-based policy would define what
information that the position of Partner or Senior Consultant could
access.
- Role based access control is based on a policy of roles in an
organization. It may or may not be hierarchical. It is based on
who you are in the company. The role-based policy would define
what information that the role of Database Administrator, Network
Administrator, Mailroom Clerk or Purchaser could access.
Rule, rank and role-based access control methods can rely on a
security label as the security mechanism to convey the sensitivity or
classification of the information. When processing an S/MIME
encapsulated message, the sensitivity information in the message's
security label can be compared with the recipient's authorizations to
determine if the recipient is allowed to access the protected
content.
Nicolls Informational