Domain 3. Sec Architecture and Engineering - Security Models Flashcards
Which Bell-LaPadula rule is also known as the “no write down” rule?
Star (*) Property
Bell-LaPadula Rules
Confidentiality Model:
Most likely in Government and Military programs. Strict need-to-know environments
Simple security property: (no read up).
Star () property: (no write down).
Strong start () property: No read or write to security level you don’t have access to.
Lattice-based Model
A security model that uses a hierarchical lattice structure to define and enforce access rights. The lattice structure sets varying security levels for different resources and users.
The Bell-LaPadula model is an example of a lattice-based model. In Lattice-based models, subjects can only access objects as long as they are in range of their lattice position. The object’s classification and labels determine lattice positions.
Clark-Wilson Model
Integrity Model
Relies mostly on separation of duties.
Uses transformation procedures (TPs) and constrained data items (CDIs)
Similar to Biba Model..
Biba Model
Integrity Model
Prevents info flow from low sec level to higher.
Brewer and Nash Model
Confidentiality model (I think)
- Use a dynamic access control based on objects previous
actions.
- Subject can write to an object if, and only if, the subject
cannot read another object in a different dataset.
- Prevents conflict of interests among objects.
Information Flow Model
An information-flow model prevents the movement of information from one classification to another.
Bell LaPadula and Biba are both information-flow models.
The model controls the flow of information from high security to low security classifications. These models are used to avoid unauthorized access to data or to compromise the integrity of data.
Lipner Model
Commercial Mode BLP + Biba
Graham-Denning Model
Focuses on the secure creation and deltion of subjects and objects.
Uses an access matrix.
Rule 1: Transfer Access,
Rule 2: Grant Access,
Rule 3: Delete Access,
Rule 4: Read Object,
Rule 5: Create Object,
Rule 6: Destroy Object,
Rule 7: Create Subject,
Rule 8: Destroy
Harrison-Ruzzo-Ullman
Model
Extensionof the Graham-Denning model.
Restricts operations able to perform on an object to a defined
set to preserve integrity
M of N Control
Split knowledge control policy used to manage Key Escrow using the Minimum (M) of the total Number (N) of employees.
State Machine Model
State machine security models require that all actions that change the state must be authorized, and the machine’s state must remain secure during transitions.
State Transition
Change of a system between one state and another. i.e. A VM is booted from a snapshot.
MAC
Mandatory Access Control:
Uses classifications and labels to define user access.
Often referred to as lattice-based model because it looks like a garden wall.
Cryptology
Cryptology is the science of secure communications. It is the study of both cryptography and cryptanalysis.
Cryptography
Cryptographers study encryption
Cryptanalysis
Cryptanalysts study methods to break encryption.
Noninterference model
Class of Security Models:
Concerned with how the actions of a subject at a higher sec level affect the system state or actions of a subject at a lower level.
Loosely based on the information flow model,
Addresses how the actions of a higher security level subject impacts the system state or actions of a subject at a lower security level.
(Information flow model is in turn based on the state machine model. Information flow models are constructed to block unauthorized, insecure, or restricted information flow)
State-Machine Model
Uses state variables to represent the system’s state of security through state transitions.
Common Criteria
Security Framework- International version of TCSEC (US) and ITSEC (EU) to a global/international version of these evaluations.
Target of Evaluation
Has 7 EAL Levels, 1 is lowest, 7 is highest.
SAR (security assurance requirements)
TCSEC
This is the orange book. The Formal implementation of the bell-lapadula model.
Orange Book
THIS IS ITSEC! This book was part of the Rainbow Series of books that defined various computer security standards and guidelines. The Rainbow Series of books was published by the US Department of defence itself. Formal implementation of the bell-lapadula model.
Take-Grant protection model
Employs a directed graph to show how rights can be passed from one subject to another or from a subject to an object.
A subject with a grant right - can then GRANT that right to any other subject or object.
A subject with a TAKE right, can take a right from another subject.
Additionally there are CREATE and REMOVE rule to generate or delete rights.
BLP vs Biba
BLP = No Read Up, No Write Down
Biba = No Read Down, no Write up
Bell-Lapadula and Biba:
Reading is simpler than writing = simple rule = read.
It’s written in the stars = * rule = write.
Access Control Triple
When Subjects access and modify objects indirectly through an interface or program. This is known as the “access triple” and is made up of the subject/program/object.
Concept in Clark-Wilson model
Security Protection Rings - which are not usually implemented
1 and 2 usually contain drivers. Drivers are usually integrated into ring 0, so rings 1 and 2 functionally are not used all that often.
