31. Security Models and Concepts - 1

Question 1

Security Models and Concepts - 1

Bell-LaPadula
(Confidentiality)

Answer 1

Mandatory Access Control
Only focused on confidentiality

1. Simple Security Property
2. Security Property
3. Strong Property

• Devloped by US department of defence
• Does not care about integrity or availability
  *

Question 2

Security Models and Concepts - 1

Bell-LaPadula:
Simple Securtiy Property

Answer 2

“cannot read up”

• Someone with secret clearance cannot read top secret documents

Question 3

Security Models and Concepts - 1

Bell-LaPadula:
Security property

Answer 3

“No write down”

• Subjects with top secret clearance cannot write top secret information to secret folders

Question 4

Security Models and Concepts - 1

Bell-LaPadula:
Strong Property

Answer 4

“No read or write up and down”

• Subjects can only access data on their own level

Question 5

Security Models and Concepts - 1

BIBA
(Integrity)

Answer 5

Mandatory Access Control

1. Simple Integrity Axiom
2. Integrity Axiom
3. Invocation Property

• Does not care about confidentiality or availability
• Developed by US department of defence

Question 6

Security Models and Concepts - 1

BIBA:
Simple Integrity Axiom

Answer 6

“No read down”

• People with top secret clearance cannot read secret information
• Not that we care they can see lower level information, but want to avoid confusion

Question 7

Security Models and Concepts - 1

BIBA:
Integrity Axiom

Answer 7

“no write up”

• Secret clearance cannot write information to top secret level folders
• Do not want inferior knowledge to influence or propagate to higher levels

Question 8

Security Models and Concepts - 1

BIBA:
Invocation Property

Answer 8

“no read or write up”

• Do not want people from lower tiers to influence higher tier information

Question 9

Security Models and Concepts - 1

Lattice Based Access Control
(LBAC)

LBAC

Answer 9

Mandatory Access Control

• May be referred to as the label based access control
• Subjects can have multiple access rights

Question 10

Security Models and Concepts - 1

Graham-Denning Model

Answer 10

Uses Objects, Subjects, and Rules
8 rules subject can execute

• Commonly used in distributed system

Question 11

Security Models and Concepts - 1

Graham-Denning Model:
Transfer Access

Question 12

Security Models and Concepts - 1

Graham-Denning Model:
Grant access

Question 13

Security Models and Concepts - 1

Graham-Denning Model:
Delete Access

Question 14

Security Models and Concepts - 1

Graham-Denning Model:
Read Object

Question 15

Security Models and Concepts - 1

Graham-Denning Model:
Create Object

Question 16

Security Models and Concepts - 1

Graham-Denning Model:
Destroy Object

Question 17

Security Models and Concepts - 1

Graham-Denning Model:
Create Subject

Question 18

Security Models and Concepts - 1

Graham-Denning Model:
Destroy Subject

Question 19

Security Models and Concepts - 1

Harrison, Ruzzo, Ullman model
(HRU)

Answer 19

Operating system level computer security model
6 primitive operations

• Integrity of acces rights in the system
• Extension of the graham-denning model
• Finite set of procedures availabel to edit access rights of a subject on an object
• Subjects are considered to be objects

Question 20

Security Models and Concepts - 1

HRU:
Create Object

Question 21

Security Models and Concepts - 1

HRU:
Create Subject

Question 22

Security Models and Concepts - 1

HRU:
Destroy Subject

Question 23

Security Models and Concepts - 1

HRU:
Destroy Object

Question 24

Security Models and Concepts - 1

HRU:
Enter right into access matrix

Question 25

Security Models and Concepts - 1

HRU:
Delete right from access matrix