Dynamic enforcement of various access levels in an integrated national security or law enforcement scenario requires enforcing data element protections based upon the “need to know” and organizational policies based upon data content, classification, purpose of use, and user roles and privileges. Dynamic enforcement also requires Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) enforcement at runtime or in real-time.
Edmond Scientific’s Security Labeling Service (SLS) is a standards-based service that helps you control the access and distribution of sensitive information based upon content according to agency Security Classification Guides and Instructions as provided under Executive Order (E.O.) 13526. The SLS understands and interprets the security implications of data elements at runtime by examining the contents of the data stream and classifying elements and documents according to the Security Classification Guide or Instructions, and utilizing any customized ontologies before labeling the information for proper enforcement of RBAC and ABAC fine-grained access controls.
Data or documents enter the SLS workflow from different interfaces including manual processing, automatic processing invoked by external requests, or batch processing. The data is then parsed and interpreted by the SLS. There are two main SLS submodules for processing: the submodule that processes structured data elements of a document or data stream, and the submodule that processes unstructured, narrative or freeform data through a Natural Language Processing (NLP) engine. The NLP engine would utilize customized and self-learning ontologies to improve accuracy and reduce false negative and false positive detection of classified data. The parsers and the processing submodules record sufficient metadata for each sensitivity so that once detected, it can be traced back to the specific location in the document or data element for validation or reconstruction.
The parser processing output is an abstract data structure independent of the input formats which decouples the rest of the labeling workflow from any specific document format, making the core labeling service agnostic to the document format. This abstract data structure is then fed to the labeling service, where three important modules are invoked:
- Adding security labels
- Optionally, invoking protective services to transform the document or data stream based on the access control rules and redact, mask, or annotate the document (or parts thereof) with handling instructions, and
- Computing the high-watermark labels based on the fine-grained labels assigned to underlying document sections. The high-water mark labels can be assigned to higher-level sections or the entire document.
- The labeling rules can be modified and maintained via a user interface by administrators of the system.
The outcome of the workflow is a labeled and transformed document together with a labeling report. The report provides the quality assurance information needed to reconstruct and validate correct processing. It includes the processing steps and metadata such as labeling rationale and location within the document to trace back during a manual review and for quality assurance, any sensitive context and mapped code from unstructured text detected by the NLP, and rules that have been applied in the labeling process. This facilitates both verifying the labeling outcome by a manual reviewer for quality control or auditing purposes in case of complaints, and assists (cues) manual reviewers in case the SLS has detected questionable or uncertain results during automated processing.