3.3 Goals and Principles - Design Principles for Secure Systems Flashcards
What does the principle “Economy of Mechanism” mean ?
keep the design as simple and small as possible
What does the principle “Fail-safe defaults” mean ?
Base access decisions on permission rather than exclusion
What does the principle “Complete mediation” mean ?
Every access to every object must be checked for authority.
What does the principle “Open design” mean ?
The design should not be secret.
What does the principle “Separation of privilege” mean and include ?
Where feasible, a protection mechanism that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key.
avoid highly privileged accounts like root/administrator that are attractive targets for attacks
What does the principle “Least privilege” mean ?
Every program and every user of the system should operate using the least set of privileges necessary to complete the job.
What does the principle “Least common mechanism” mean and include?
Minimize the amount of mechanism common to more than one user and depended on by all users
Reduce amount of privileged code in libraries that needs to be reviewed.
What does the principle “Psychological acceptability” mean ?
It is essential that the human interface be designed for ease of use, so that usersroutinely and automatically apply the protection mechanisms correctly.
What does the principle “Work factor” mean and include ?
Compare the cost of circumventing the mechanism with the resources of a potential attacker.
increase costs to find and exploit software vulnerabilities (costs = training, skills, tools, computation, hardware)
What does the principle “Compromise recording” mean and include ?
It is sometimes suggested that mechanisms that reliably record that a compromise of information has occurred can be used in place of more elaborate mechanisms that completely prevent loss.
enable logging and (automatically) analyse logs to detect attacks
name the 8 basic design principles by Saltzer/Schroeder.
- Economy of mechanism
- Fail-safe defaults
- Complete mediation
- Open design
- Separation of privilege
- Least privilege
- Least common mechanism
- Psychological acceptability
What are the additional two mechanisms which expand
Saltzer/Schroeder ?
- Work factor
- Compromise recording
