NDLI: Desktop Demilitarized Zone

Content Provider	IEEE Xplore Digital Library
Author	Nakamoto, G. Schwefler, J. Palmer, K.
Copyright Year	2011
Description	Author affiliation: MITRE Corporation, Bedford, MA, USA (Nakamoto, G.; Schwefler, J.; Palmer, K.)
Abstract	The Desktop Demilitarized Zone or Desktop DMZ project uses virtualization technology to maintain separation of our network infrastructure to appropriate Trust Zones (TZ). Using a two TZ concept such as a typical Enterprise and Internet network model, a key objective is to prevent Internet activities (web browsing, etc.) from impacting the Enterprise network and vice versa (preventing exfiltration, for example) while working from a single desktop. This project has created a capability to enable user actions such as clicking on an Internet web site link while on an Enterprise-connected computer running Outlook Email to automatically initiate an Internet Explorer (IE) browser on a virtual machine (VM) located outside the Enterprise network (for example, on the DMZ). This DMZ-based VM (after retrieving the requested web page) then securely “transmits” the IE browser window back to the Enterprise-connected computer with minimal risk to the host from any malware. The user continues to see a “normal” IE window on his machine. Any malware that is potentially brought back (zero day exploits or “drive by” attacks, for example) remains on the DMZ-connected disposable computer which is re-instantiated to a “clean state” periodically. While IE was used as an example, the Desktop DMZ concept extends to any arbitrary application including actions such as opening Email attachments from Outlook. In the case of email messages, attachments can be “sanitized” prior to forwarding or can be opened in a disposable VM on the DMZ network but still “viewable” on the Enterprise connected machine. A key focus of this activity is to minimize the impact to the user experience by maintaining the appearance of a single desktop (vice multiple desktops as well as the maintenance associated with multiple machines). Provisions for securely transferring content (downloaded objects/files) from one TZ to another TZ are also accommodated via the use of a “save as” file transfer service that can interface with external file sanitization services. The object is moved from the DMZ VM to an object sanitization server and made available to the Enterprise connected host for transfer (automatically - pulled into a “well known” folder). The VMs in use are not managed by the users (no need to patch or update) and are kept current through central management and differential patching concepts
Starting Page	1487
Ending Page	1492
File Size	718450
Page Count	6
File Format	PDF
ISBN	9781467300797
ISSN	21557578
e-ISBN	9781467300810
DOI	10.1109/MILCOM.2011.6127516
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-11-07
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Servers Electronic mail Malware Internet Browsers Fires Virtual machining
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in