Quiz (Access Control)

Question 1

What is a policy?

Answer 1

The rules of security.

Question 2

How does policy achieve secrecy?

Answer 2

• Don’t allow reading by unauthorized subjects
• Control where data can be written by authorized subjects

Question 3

How does policy achieve integrity?

Answer 3

Don’t permit dependence on lower integrity data/code

Question 4

How does policy achieve availability?

Answer 4

The necessary function must run

Question 5

What is a protection domain?

Answer 5

Specifies the set of resources (objects) that a process can access and the operations that the process may use to access such resources

Question 6

How are protection domain done today?

Answer 6

• memory protection
• UNIX protection memory, file-system permissions

Question 7

What is an access control system?

Answer 7

Determines what rights a particular entity has for a set of objects

Question 8

What are subjects, objects and rights in simplified access control?

Answer 8

• Subjects are the active entities that do things
• Objects are passive things that things are done to
• Rights are actions that are taken

Question 9

What is a protection state?

Answer 9

Defines what each subject can do

Question 10

A reference monitor enforces the protection state. What are some guarantees that a correct reference make?

Answer 10

• Tamperproof
• Complete mediation
• Simple enough to verify

Question 11

What does a protection system consists of?

Answer 11

• A protection state
• operations to modify that state
• a reference monitor to enforce that state

Question 12

What is the principle of least privilege?

Answer 12

A system should only provide those rights needed to perform the processes function and no more.

Question 13

What is the Discretionary Access Control?

Answer 13

• object “owners” define policy
• users have discretion over who has access to what objects and when)
• canonical example: the UNIX file system

Question 14

What is the Mandatory Access Control?

Answer 14

• Environment enforces static policy
• access control policy defines by environment, user has no control over access control
• canonical example: process labeling

Question 15

In DAC, subjects can _______, and subjects’ programs can _______. But in MAC, they cannot.

Answer 15

pass right onto other subjects; pass their rights

Question 16

For most DAC models, safety is _____.

Answer 16

undecideable; thats why we need to either 1) restrict the model, 2) test incrementally

Question 17

There is a ____ relation between users and roles, roles and permissions in RBAC.

Answer 17

many-to-many

Question 18

RBAS is a class of access control not direct MAC and DAC. T/F

Answer 18

True

Question 19

Groups are ____; a role is ____.

Answer 19

collections of identities who are assigned rights as a collective; a collection of privileges/permissions associated with some function of affiliation

Question 20

What is a multi-level security?

Answer 20

Tags all objects and subjects with security tags classifying them in terms of sensitivity/access level.

Question 21

In US DOD, read access is allowed if ____.

Answer 21

subject clearance level >= object sensitivity level and subject categories /in object categories. (read down)

Question 22

BLP model enforces: ___ and ___.

Answer 22

Simple security policy (no read up); star property (no write down).

Question 23

Biba defines ____.

Answer 23

a dual of secrecy for integrity