L2 - Securicy Policies

Question 1

What is a security policy

Answer 1

It is a (set of) document(s) in which an organization’s - philosophy - strategy - practices with regard to - confidentiality, - integrity, and - availability of information systems are laid out

Question 2

What is Discretionary Access Control (DAC)?

Answer 2

Each data object is owned by a user and user can decide freely which other users are allowed to access data object Many operating systems follow this line

Question 3

What is Mandatory Access Control (MAC)?

Answer 3

Access is controlled by a system-wide policy with no say by the users Military systems often use this kind of control

Question 4

What Access Control Groupings exist in UNIX/Linux system?

Answer 4

self: owner of a file group: a group of users sharing common access other: everyone else

Question 5

What is an Access Control Matrix?

Answer 5

• specifies permissions on an abstract level
• limits the damage that certain subjects can cause
• This is organized in a matrix: subjects are in the rows,
  objects in the columns, and the rights in the cells

Question 6

How does the Bell-La Padula Model work?

Answer 6

• • every document (or information object) has a security classification
• • The more sensitive the information, the higher the classification level
• • Examples for typical levels are: top secret (ts), secret (s), confidential (c), and unclassified (uc)
• • Every user of the system has a clearance (level)
• • Classification and clearance levels are not decided by the users, some certified entity has to do this
• • To be able to access a document, a user must have at least the level of the document

Question 7

What is write-down?

Answer 7

more highly classified information is passed to a lower classified object

Question 8

What are the two ‘properties’ enforced by Bell-La Padula?

Answer 8

1. Simple Security Property
   
   • a subject at a given security level may not read an object at a higher security level
2. The * (star) Property
   • states that a subject at a given security level may not write to any object at a lower security level
3. The Discretionary Security Property
   * states that use of an access matrix to specify the discretionary access control.

Question 9

What is the difference between the Bell-La Padula and Clark-Wilson Integrity Model?

Answer 9

BLP protects data against unauthorized users The Clark-Wilson (CW) integrity model also tries to protect data against authorized users

Question 10

What are two especially important mechanisms in Clark-Wilson Integrity Model?

Answer 10

1) Well-formed transaction: user is constrained in the way they can manipulate data, e.g. record a log of changes, double entry bookkeeping 2) Separation of duty: executing different subparts of a task by different persons, e.g. authorizing purchase order, recording arrival, recording arrival of invoice, authorizing payment

Question 11

What are Constrained Data Items (CDIs) within the Clark-Wilson Integrity Model?

Answer 11

These are data items for which integrity has to be upheld Not all data items need to be CDIs, other data items are called Unconstrained Data Items (UDIs)

Question 12

What two main classes of procedures exist in the Clark-Wilson Integrity Model?

Answer 12

1) Integrity Verification Procedures (IVPs) 2) Transformation Procedures (TPs)

Question 13

What are Integrity Verification Procedures (IVPs) within the Clark-Wilson Integrity Model?

Answer 13

IVPs check that all CDIs in the system conform to integrity constraints On successful completion this confirms that at the time of running an IVP, the integrity constraints were satisfied Example for accounting: Audit functions are typical IVPs For example, an auditor confirms that the books are balanced and reconciled

Question 14

What are transformation Procedures (TPs) within the Clark-Wilson Integrity Model?

Answer 14

TPs correspond to the concept of a well-formed transaction Applying a TP to a CDI in a valid state will result in a CDI that is still in a valid state Example for accounting: A double entry transaction is a TP

Question 15

Which two important parts ensure integrity in the CW model?

Answer 15

• Enforcement (which is done by a system)
• Certification (which is done by a human)

Question 16

What are Constrained Data Items (CDIs)?

Answer 16

These are data items for which integrity has to be upheld Not all data items need to be CDIs, other data items are called Unconstrained Data Items (UDIs)

Question 17

How does CW work?

Answer 17

We start in a valid state (confirmed by IVPs) We only manipulate CDIs with TPs We will always be in a valid state

Question 18

Why do IVPs and TPs need to be certified by someone?

Answer 18

A system can enforce that CDIs are only manipulated by TPs A system cannot ensure (on its own) that the IVPs and TPs are well-behaved

Question 19

Who certifies IVPs and TPs?

Answer 19

The security officer (or an agent with similar responsibilities) certifies IVPs and TPs with respect to an integrity policy This is usually not done automatically, but semi-automatically (i.e. some human intervention is necessary)

Question 20

What is Role-based Access Control (RBAC)?

Answer 20

• is a mandatory access control model
• Mainly for commercial/civilian applications, so does not have the different levels of secrecy of Bell-La Padula Can be seen as a more strict version of the AccessControl List (ACL)
• Similar to ACL RBAC also puts users into different groups, these are called roles
• Depending on their current role, users can access (and
  modify) certain data objects
• Main difference to ACL: in RBAC a certified entity grants and revokes privileges, this is not done by the user
• Often MAC is equated with military applications, while DAC is seen as appropriate for commercial/civilian applications
• However, DAC might not always provide the appropriate security in a commercial/civilian setting
• RBAC fills this gap: it’s a MAC model without the specific military requirements

Question 21

Name four Security Policy Models.

Answer 21

Access Control Matrix, BLP, CW, and RBAC.

Question 22

What are problems with an Access Control Matrix?

Answer 22

• If applied in a straightforward fashion, this matrix doesn’t scale very well
• Example: bank with 50,000 staff and 300 applications ⇒ 15,000,000 million entries
• On top of that, most entries are empty: storing a sparsely populated matrix explicitly wastes a lot of space
• Solution: only store entries that actually exist, can be done in two different ways:
• by row, store privileges with user (capability lists)
• by column, store privileges with objects (access control
• lists)

Question 23

What is a capability list and what are its limitations?

Answer 23

Alice Op. Sys.: rwx, Acc. App.: rwx, Acc. Data: r, Audit: r
Bob Op. Sys.: rx, Acc. App.: x
… …
Makes it difficult to check who has privileges for certain files
One would have to look at every list

Question 24

What is a Access Control List and what are its limitations?

Answer 24

Op. Sys. Alice: rwx, Bob: rx, Charlie: rx, Acc. App.: rx
Acc. App. Alice: rwx, Bob: x, Charlie: r, Acc. App.: r
Acc. Data. Alice: r, Charlie: r, Acc. App.: rw
… …

• Makes it easier to check who can access which file (and, if necessary, revoke the rights)
• However, lists may still be too long and it may be too tedious to manage them
• One solution is to organize users into groups (UNIX)
• However, ownership of a file is still under control of a single user
• This user can pass on access permissions as they see fit (MAC)
• Assigning users to groups is usually done by a system administrator, though this might not always be appropriate
• for (larger) organizations this is solved by role-based access control (RBAC)

Question 25

What is a framework paper?

Answer 25

The security framework document should

• state an organization’s commitment to information security
• define a classification system (e.g. based on one of the discussed formal models)
• make clear that users and administrators will be held accountable for their behavior
• give the SO appropriate authority to enforce security policy
• state clearly the responsibilities that individuals have
• define how security will be reviewed

Question 26

What is a position paper?

Answer 26

• Position papers
  
  • address specific aspects of the security policy, e.g.
  • how to configure servers connected to the internet
  • the process to be followed in the event of a security breach
• should be focused and kept short
• can have different authors (should be written by someone with expertise in the area)