IT Security Design Principles

Question 1

What is Least privilege

Answer 1

• Should only have the rights necessary to perform a given function
• Default setting should be lack of access
• access needed temporarily, then it should be rescinded after use

Question 2

Economy of mechanism

Answer 2

• Sufficiently small and simple as to be verified and implemented – e.g. security kernel
• Simpler means less can go wrong – and when errors occur, they are easier to understand and fix

Question 3

Complete mediation

Answer 3

• Every access to every object must be checked

* Must be efficient with little overhead

Question 4

Open design

Answer 4

• Don’t depend on secrecy of the design
• Security through obscurity’ is a bad idea - Should be open for scrutiny by the community
• Kerckhoffs’ Principle

Question 5

Separation of privilege

Answer 5

• Access to objects should depend on more than one condition being satisfied
• Separation of duty - two person rule

Question 6

Least common mechanism

Answer 6

•Minimise the amount of mechanisms common to more than one user and
depended on by all users
•Do not share state between programs; corruption of one = corruption of all

Question 7

Psychological acceptability

Answer 7

•User interface must be easy to use, so that
users routinely and automatically apply the mechanisms correctly
•Security mechanisms should not add to difficulty of accessing resource

Question 8

Fail securely

Answer 8

•If software has to fail ensure that it does it securely

Question 9

Defence in depth

Answer 9

•Use diverse defensive strategies
•If one layer isn’t good enough, another layer will hopefully prevent a complete
compromise

Question 10

Secure the weakest link

Answer 10

• A software security system is only as strong as its weakest link
• Attackers go after the easy targets
• Identify and strengthen weak links until an acceptable level of risk is achieved

Question 11

Fail-Safe defaults

Answer 11

• If action fails, system as secure as when action began
• The default state is lack of access
• Need to argue why a user should have access, not argue why a user should not have access

Question 12

Compartmentalise

Answer 12

• Minimize the amount of damage that can be done by breaking the system into units
• Very few operating systems do this because it is difficult to manage
• Root privilege is an example of how not to do it

Question 13

Fail securely

Answer 13

•If software has to fail,make sure that it does it securely

Question 14

Keep it simple

Answer 14

•Complexity can cause errors

Question 15

Use your community resources

Answer 15

•Public scrutiny promotes trust