Understanding Hierarchical Protection: How to Build Trustworthy Secure Systems

Dec 31 / Nancy Jones

Understanding Hierarchical Protection: A Critical Security Design Principle

In the world of cybersecurity and systems engineering, there are a multitude of principles designed to create secure, resilient systems that can withstand threats. One such principle that stands out as crucial to building trustworthy systems is Hierarchical Protection. Rooted in the National Institute of Standards and Technology (NIST) Special Publication 800-160, Volume 1, this concept plays an essential role in how we build systems that integrate various components with different levels of trustworthiness.

But what exactly does Hierarchical Protection mean? And how can you leverage it to design more secure and efficient systems? Let’s dive in.

What is Hierarchical Protection?

At its core, Hierarchical Protection is a security design principle that focuses on how system elements should be protected depending on their trustworthiness. According to this principle, a system element does not need to be protected from more trustworthy elements. In other words, when designing a system, you don’t have to build protections for a more trustworthy component if it is interacting with a less trustworthy one. However, the inverse is true — the less trustworthy element must protect itself from the more trustworthy element.

This principle is particularly useful when you are dealing with a mixture of system elements that vary in trustworthiness, such as commercial off-the-shelf (COTS) hardware, software, firmware, and code libraries. In these environments, decisions about what needs protection and how much protection is required depend on trust assertions made about these elements.

The Importance of Hierarchical Protection in Systems Engineering

Systems engineers are often tasked with creating complex systems that rely on various components, each with different levels of trust. Hierarchical Protection is one of the design principles that helps them make these trade-off decisions efficiently. It allows engineers to:

  1. Determine the degree of protection each element requires: Some system elements (like operating system kernels) are inherently more trustworthy and should be protected from less trustworthy elements, like third-party applications.

  2. Focus on the most vulnerable components: If a system element is highly trustworthy, the priority is to protect the elements that interact with it. For example, an operating system kernel might be trusted to handle critical functions, but apps interacting with it should be limited to avoid compromising the system.

  3. Reduce complexity: Instead of building protective layers around each element, engineers can prioritize defense where it’s most needed, leading to a more efficient system architecture.

This makes Hierarchical Protection not only a key principle for building secure systems but also an important decision-making framework when it comes to resource allocation and risk management.

Real-World Applications of Hierarchical Protection

Let’s explore how this principle plays out in the real world.

1. Operating System Kernels vs. Applications

A simple yet effective example of Hierarchical Protection is the relationship between an operating system’s kernel and the applications running on it. The kernel is considered the most trustworthy element in the system — it’s responsible for core functions such as memory management, hardware abstraction, and security enforcement.

On the other hand, applications are not inherently trustworthy and may contain vulnerabilities or be subjected to malicious activity. Here, the kernel must protect itself from these potentially harmful applications. It does so by isolating them in separate memory spaces and preventing direct access to sensitive kernel resources.

However, applications do not need to protect themselves from the kernel. This is because, in this case, the kernel is assumed to be trustworthy enough to interact with the applications without compromise.

2. The Human Element in Systems

Another example of Hierarchical Protection comes into play when a human element is involved. Humans are often the most trusted components in a system, such as system administrators who manage the infrastructure. However, malicious insiders or human errors can still jeopardize the system’s integrity. The assumption here is that the human administrator is trusted up to a point, but beyond that limit, they may not be.

For example, a system may trust an administrator to configure and maintain secure software settings, but if that administrator becomes compromised or malicious, their actions can become a significant threat. The system needs to be able to protect itself from these actions, even if the administrator is trusted in other areas.

3. Supply Chain and Production Environments

One of the most concerning threats to a system is the supply chain attack, where a trusted component — say, a hardware or software vendor — becomes compromised during the manufacturing or distribution phase. The attacker might insert vulnerabilities into the product, which could lead to a compromise deep within the system.

With Hierarchical Protection in mind, systems designers must assume that not all elements in the supply chain can be fully trusted. They need to design protections that safeguard against potential vulnerabilities introduced by third-party vendors or during the production process, even if these elements were once trusted.

The Risks of Not Implementing Hierarchical Protection

Failing to implement Hierarchical Protection can lead to significant vulnerabilities in a system, especially in complex, multi-layered systems. Here’s why:

  • Overprotecting trust elements: If you mistakenly add unnecessary layers of protection around the most trustworthy elements, you create unnecessary complexity, which may slow down system performance and increase the attack surface.

  • Underprotecting weaker elements: Conversely, underestimating the risks associated with less trustworthy components can expose critical vulnerabilities. This can lead to exploits and damage, particularly when attackers gain access to trusted elements from less secure points in the system.

  • Lack of clear risk prioritization: Without Hierarchical Protection, it becomes more difficult to identify where protections are needed most. This might cause engineers to spread resources too thinly, leading to gaps in coverage and increased risk.

Implementing Hierarchical Protection in Your Systems

To implement Hierarchical Protection effectively, you need to:

  1. Evaluate the trustworthiness of each system element: Determine which components you can trust and which require more stringent protection mechanisms.

  2. Assess potential vulnerabilities: Understand that even the most trustworthy elements have limits. For example, even a trusted operating system kernel must still be defended from lower-trust applications that could compromise the system.

  3. Design layers of defense around less trustworthy elements: Rather than adding unnecessary complexity to highly trusted elements, focus on protecting the elements that interact with them, like third-party apps, network devices, and external interfaces.

  4. Revisit the design as new threats emerge: Trustworthiness is not static — it changes over time as new vulnerabilities are discovered and as your system evolves. Regularly assess your protection strategies and update your system elements’ trustworthiness accordingly.

Conclusion

Hierarchical Protection is more than just a theoretical security concept — it’s a practical, essential principle that can guide systems engineers in creating more secure, efficient, and resilient systems. By focusing protection efforts on the most vulnerable components and trusting that more trustworthy elements are already secured, you can reduce complexity and enhance your system’s overall defense against adversaries.

So, whether you’re designing a simple application or a complex enterprise system, keep Hierarchical Protection in mind to help you make better, more informed decisions about where and how to apply protection.

Trustworthiness matters, and how you apply it within the system is critical to building a robust, secure infrastructure.