New SPI: More refined and integrated system checks.

摘要

Current research and development at Lawrence Livermore National Laboratory will soon provide the system/security administrator a new set of tools ranging from monitors and intrusion detection to sensitive information detectors. However, the full potential of both existing and future tools will not be realized until a complimentary set of utilities has been integrated into a single computer security workbench in which the results from one process can be used as input to another. The Security Profile Inspector (SPI), a UNIX and VMS security profiler, has taken the first step toward providing this integration. This is accomplished by using an interpreted query language which allows specific, general, and even recursive queries of system configuration information. The new SPI is extremely flexible, so that users can easily tailor existing checks for their system or even add new checks. Similarly, other tools can ask specific questions, for example limiting their inquiries to a single user or a list of users which meet certain criteria. Furthermore, the query language was designed to support multiple architectures and operating systems and to ease the transition of tools to new platforms.