     |
Design Tips
Turning on MAC on a system has huge consequences for data access and processing. This requires careful planning.
Numbers of level and categories. Everything beyond a few levels and some more categories will become rather complicated to understand and maintain.
Users can be assigned different security levels but they can only use one at a time. To change they need to logout and login again.
Model levels and categories so that users can work most of the time with one security label. What works better in the intranet/internet example from above? Give Intranet level 1 and Internet level 0? Or hide the distinction in the categories? Or would it be better to use a classification and categorization that follows your companies general data classification from the security policy (you DO have one, don't you)?. E.g. make Internet content level public, intranet content level internal use only and keep the Intranet/Internet distinction just as meta-data without security impact?