| Security attribute assignments are representations of the properties or characteristics of an entity. For the IDPS this most likely will apply to user access privileges and classification metadata associated with reports, logs, or other information stored on the components.
Security attributes and labels should be leveraged to protect stored information, as well as information flowing to external devices. Information stored, processed, and transmitted by the IDPS include sensors event logs, local audit logs, and application files. Security attributes and labels must also be leveraged to protect communications between the IDPS components and other devices, such as sensors, the management console, non-local management computers, firewalls, routers, and other network elements. Examples of possible IDPS security attributes that may be used by the organization to implement security policy include: session of packet identifiers; source and destination IP addresses; protocol identifiers; traffic classification; or VLAN identification.
If the security attributes are disassociated from the information being transmitted, stored, or processed, then access control policies and information flows which depend on these security attributes will not function and unauthorized subjects or entities may gain access to the information. |
