Today we go present the first topic of Security Models and Architecture, one of the CISSP domains.
Security models are an important concept in the design and analysis of secure computer systems, because it incorporates the security policy that should be enforced in the system. To a clear understanding between Security policy and model:
- security policy provides the abstract goals;
- security model provides the DOs and DONT’s necessary to accomplish these goals.
Security policy states that subjects need to be authorized to access objects, the security model would provide the mathematical relationships and formulas explaining how x can access y only through the outlined specific methods.
The first security models were designed to meet the needs of multi-level security, defined as a class of system-containing information with different sensitivities that simultaneously permits access by users with different security clearances and needs-to-know, but prevents users from obtaining access to information for which they lack authorization (DoD TCSEC 1985). Information, also referred to as the “object,” possesses a classification; and people, also referred to as the “subject,” possess a clearance.
The purpose of a multi-level security system is to prevent compromise where users are able to read information classified at a level for which they are not cleared. Industry information may be considered commercially sensitive or have privacy considerations, such as personnel or medical information while in the military security policy, the security levels are considered hierarchical, such as unclassified > confidential > secret > top secret. To access information, a person must possess an access class whose level is greater than or equal to the level of the access class of the information.
State machine models verify the security of a system, which means that all current permissions and all current instances of subjects accessing objects must be captured (like a snapshot), it is used to describe the behavior of a system to different inputs. There are many activities that can alter this state, which are referred to as state transitions. When the system has to decide if this transition should be allowed. To allow this transition, the object’s security attributes and the access rights of the subject must be reviewed and allowed by the operating system.
The first mathematical model of a multi-level security system, and probably the most famous, is the Bell-LaPadula model (Bell and LaPadula, 1973), the model defined a number of terms and concepts that have since been adopted by most other models of multi-level security. The well known security models and their proposes:
• Bell-LaPadula, enforce rules to provide confidentiality protection.
• Biba, enforce rules to provide integrity protection.
• Clark-Wilson, are used as a framework to describe how security policies should be expressed and executed.
• Chinese Wall, conflict of interests.
References:
Official (ISC)2 Guide to the CISSP Exam
CISSP All-in-One Exam Guide, Third Edition (All in One)
CISSP ® : Certified Information Systems Security Professional Study Guide, Third Edition
Technorati : CISSP
