Domain 3: Security Engineering; Security Models Flashcards
Is Bell-LaPadula mandatory or discretionary?
Mandatory.
What is reading down?
When a subject reads an object at a lower security level.
What is writing up?
When a subject passes information to an object which has higher sensitivity than the subject has permission to access.
What is the State Machine Model?
A state machine model is a mathematical model that groups all possible system occurences, called states. Every possible state of a system is evaluated, showing all possible interactions between subjects and objects. If every state is proven to be secure, the system is proven to be secure.
What is the focus of the Bell-LaPadula Model?
Maintaining the confidentiality of objects. This means not allowing users at a lower security level to access objects at a higher level.
What are the two rules Bell-LaPadula observes?
The Simple Security Property and the * Security Property.
What is the Simple Security Property?
“no read up”. A subject at a specific classification level cannot read an object at a higher level.
What is the * Security Property? (Star Security Property)
“no write down”. A subject at a higher classification level cannot write down to an object at a lower level.
Within the Bell-Lapadula access control model, what are the two properties that dictate how the system will issue security labels for objects?
The Strong Tranquility Property states that security labels will not change while the system is operating. The Weak Tranquility Property states that security labels will not change in a way that conflicts with defined security properties.
What is Lattice-based access control?
Lattice-based access control allows security controls for complex environments. For every relationship between a subject and object, there are defined upper and lower access limits implemented by the system. The subject can be allowed access to higher or lower classification depending on their needs. Subjects have a Least Upper Bound (LUB) and Greatest Lower Bound (GLB) depending on their position in the latice.
What is the Biba-Model?
Focuses on Integrity of data. “no write up;no read down”. This prevents bad data from being written to higher classification levels, and bad data being read from lower classification levels.
Within the Biba-Model, the rule for “no read down” is called?
The Simple Integrity Axiom.
Within the Biba-Model, the rule for “no write up” is called?
The * Integrity Axiom.
What is the Clark-Wilson model?
Clark-Wilson is a real-world integrity model that protects integrity by requiring subjects to access objects via programs. Because the programs have specific limitations to what they can and cannot do, this model effectively limits the capabilities of the subject.
What are the two primary concepts Clark-Wilson uses to ensure the security policy is enforced?
Well-formed transactions and Separation of Duties.
Within Clark-Wilson, what does Well-formed transactions describe?
It describes Clark-Wilson’s ability to enforce control over applications. This process is comprised of the “access control triple:” user, transformation procedure, and constrained data item.
Within Clark-Wilson, describe the “access control triple”.
A transformation procedure (TP) is a well-formed transaction.
A constrained data item (CDI) is data that requires integrity.
An unconstrained data item (UDI) are data that do not require integrity.
Within Clark-Wilson, what is IVP?
Integrity Verification Procedures, ensures that the data are kept in a valid state.
Within Clark-Wilson, for each TP…
… an audit record is made and entered into the access control system. This provides both detective and recovery controls in case integrity is lost.
Within Clark-Wilson, what is the purpose of separation of duties?
To ensure authorized users do not change data in an inappropriate way.
What is the Chinese Wall Model?
It’s designed to avoid conflict of interest by prohibiting one person, such as a consultant, from accessing multiple conflict of interest (CoIs) categories. The Chinese Wall model requires that CoIs be identified so that once a consultant gains access to one CoI, they cannot read or write to an opposing CoI.
What is the Noninterference model?
It prevents covert channel communication from occuring by ensuring data at different security domains remain separate from one another. This separation prevents information from crossing security boundaries.
What is a covert channel?
A cover channel is policy-violating communication that is hidden from the owner or users of a data system.
What is the Take-Grant Protection Model?
The Take-Grant Protection Model contains rules that govern the interactions between subjects and objects, and permissions subjects can grant to other subjects. Rules include: take, grant, create, and remove.
