How do we specify policy? • Policy specified as function from row to label Label concisely encodes read/write restriction on data
10
Where to enforce label restrictions?
11
How do we enforce labels?
12
Two kinds of code: MPs and VCs
13
extensibility
14
Is the TCB actually smaller?
15
Implementation details
16
Why Haskell?
17
Thinking about secure sub-language
18
Review: the 10 monad
19
How can we do anything useful?
20
Tracking reads & restricting writes
21
The LIO secure sub-language
22
What do we get with this?
23
What's the catch?
24
Summary
Description:
Explore a novel approach to protecting sensitive data in software systems using language-level information flow control (IFC) in this conference talk from Strange Loop. Dive into LIO, an IFC-security language embedded in Haskell, and learn how it leverages monads and strong typing to enable developers to specify and enforce security policies on data. Discover Hails, a server-side web framework built on LIO, which allows for declarative policy specification alongside the data model, separate from application functionality. Understand how these tools can help construct web applications that inherently protect user data privacy and integrity. Examine real-world examples, including a blogging web app, to see how this approach can prevent data breaches caused by overlooked security checks. Gain insights into the benefits of using Haskell for secure programming, the concept of secure sub-languages, and the practical implementation details of this security-focused development paradigm.