Implementing and Administering an Multilevel Secure System › Assigning Security Labels to Users

Assigning Security Labels to Users

In an MLS system, after defining and creating security levels, categories, and security labels, activating them, and assigning them to data and resources (classification), the security administrator must ensure that all users and work entering the system, including started tasks, batch jobs, processes, UNIX daemons, etc., are identified. Each user must be assigned a unique acid. In addition, all users entering the system are required to have security labels. A security administrator can assign security labels to users to give them the clearance they need to perform their work in the system.

The SECLABEL field of the USER acid record is used to assign security labels to users in an MLS environment. Depending on how you implement MLS at your site, you do not have to define a Seclabel for each system user. If MLS will impact only certain departments, or certain types of data, then most users can logon to CA Top Secret without specifying a security label and perform their jobs without any knowledge of MLS. The system will default a security label for the user.

• If you do not want users to specify a security label at logon, then use the following guideline:
• Add a default seclabel to users and specify the label the user will need to perform his tasks in the DFLTSLBL field. Make sure to specify the same value in the SECLABEL field. For example, if USER01 needs to read and write to data labeled, LABELA, add DFLTSLBL(LABELA) to the user acid record for USER01.

  TSS add(user01) seclabel(labela)
                  dfltslbl(labela)
  

• USER01 can access the labeled data sets and resources by entering his acid and password. No label is required.
• If you want each user to specify a security label at logon, then use the following guideline:
• Add Seclabel's to each user and, in the SECLABEL field, specify the labels the user will need to perform their tasks. Set the default label to the lowest label in the system, SYSLOW. For example, USER01 needs to read and write to data labeled, LABELA, LABELB, and LABELAAA. Then enter:

  TSS ADD(user01) SECLABEL(labela,labelb,labelaaa,syslow)
                  DFLTSLBL(syslow)
  

• USER01 can access the labeled data sets and resources by entering his acid and password and either security label, LABELA, LABELB, LABELAAA, or SYSLOW.

Note: If a security label is not specified by a user at signon and cannot be defaulted by the system from an existing acid record, SYSLOW will be assigned for the user.

The following table lists the default security labels that are recommended for special users in an MLS system.