Security Labeling and Clearances to Go Mainstream?

The military and intelligence world has well-established procedures in which security labels (classifications) such as "unclassified," "restricted," "confidential," "secret," "top secret," etc., are assigned to both information objects such as physical and electronic documents and records, and to locations such as physical facilities, electronic systems, and their analogues (e.g., chat rooms, etc.). Security labels are then employed in conjunction with corresponding security clearances to restrict access to security-labeled information objects and locations.

From the IT standpoint, various specialists, such as Boldon James, provide technology to make this happen in a number of domains (email, file storage, IM, etc.). Among other things, Boldon James has plugins for a wide variety of Microsoft Office clients (Outlook, Communicator) and applications (Word, PowerPoint, Excel, etc.), running on Windows operating systems, including Mobile. Protection is also provided for RIM BlackBerry devices. A key feature of the Boldon James offering is that it doesn't just control access; it also restricts the ability of a user to send an information object to a recipient without a suitable clearance.

We hear the Australian, Canadian, and Japanese central governments are requiring: that every information object have a security label, that users have security clearances, and that their IT systems enforce access based on security labels and clearances. With the evolution of compliance requirements, it may be that other organizations will adopt this approach; for example, for maintaining "Chinese Walls" in financial institutions.

... David Ferris and Nick Shelness

One Comment

  1. Ralph Ehlers
    Posted February 26, 2008 at 12:00 PM | Permalink

    Hi David and Nick,
    I doubt if the above approach will really become mainstream. One is that I don’t believe it is fit for purpose: the concept apparently does not support access horizontal restrictions. Those I think are very common, e.g.: I may have a high clearance on IT related objects because I am an IT manager, but have no clearance at all on objects of the ‘real’ business of my company.
    The second is that I doubt tsuch a concept is really fit for use. Establishing and maintaining such a fine grained scheme would consume considerable resources and also requires a sustained management effort. I doubt that many companies will actually provide both if there is a chance to avoid that.


  2. Posted February 27, 2008 at 1:34 AM | Permalink


    I think that horizontal controls would be achieved by use of categories within labels.

    Labels would not generally be used for fine grain control. As you say, this would make it unmanageable. Let me give an example of the sort of approach that might work.

    1. Two levels of classification:
    – company internal (i.e., not for external distribution)
    – company confidential

    2. For company confidential, two categories are used: “financial”; “product”. This would enable engineering staff to be cleared to see company confidential product documents, but not financial ones.


  3. S J de Mellow
    Posted February 27, 2008 at 4:40 AM | Permalink


    Just to set Ralph straight the concept can be as granular as the organisation requires setting controls both vertically and horizontally. The real benefit of the “plug in” is that it extends COTS capability to meet the organisation’s chosen business process. For example a setting of level 4 team Alpha would not allow a person with level 4 and above clearance access to the data unless they were in team Alpha.

    Governments and defence organisations choose detailed and complicated because they need to. Large organisations will have much flatter less hierarchical structures introducing more complexity for important activities like mergers and acquisitions.



  4. Posted February 28, 2008 at 2:04 PM | Permalink

    This white paper is also probably worth reviewing–I think Steve Kille wrote it. See


Post a comment

You must be logged in to post a comment. To comment, first join our community.