1
10/3/05 15:29
Lecture 3:
Policy
James Hook
CS 591: Introduction to
Computer Security
10/3/05 15:29
Objectives
•Explore what a security policy is;
develop a vocabulary to discuss policies
•Examine the role of trust in policy
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Guidelines and tips
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Understanding Security Policies: Confidentiality, Integrity, and Access Control - Prof. Ja, Study notes of Computer Science
A lecture note from a computer security course (cs 591) focusing on the concept of security policies. The lecture covers the basics of security policies, the importance of confidentiality, integrity, and availability, and the role of trust and assurance. It also discusses scenarios and examples to help students understand the concepts.
Typology: Study notes
Pre 2010
1 / 13
This page cannot be seen from the preview
Don't miss anything!
Related documents
Partial preview of the text
Download Understanding Security Policies: Confidentiality, Integrity, and Access Control - Prof. Ja and more Study notes Computer Science in PDF only on Docsity!
10/3/05 15:
Lecture 3:
Policy
James Hook
CS 591: Introduction to
Computer Security
10/3/05 15:
Objectives
- Explore what a security policy is;
develop a vocabulary to discuss policies
- Examine the role of trust in policy
10/3/05 15:
What is a Security Policy?
- Statement that articulates the security goal
- In the state machine model it identifies the authorized or secure states (which are distinct from the unauthorized or nonsecure states)
- A secure system is one in which the system can only enter authorized states - Note: The policy doesn’t make the system secure; it defines what secure is 10/3/05 15:
Confidentiality
- X: set of entities
- I: some information
- I has the property of confidentiality with
respect to X if no member of X can
obtain information about I
- What is information?
10/3/05 15:
Integrity
- If Alice and Bob trust their horoscopes do horoscopes have integrity?
- What about their elected representatives?
- Does this definition imply that “anything’s legal as long as you don’t get caught” [Traveling Wilburys; Tweeter and the Monkey Man]
- If the users of a system trust the file system does it have integrity?
- Is it reasonable for integrity to be an extrinsic property? 10/3/05 15:
Assurance
- Assurance aims to provide intrinsic evidence of integrity
- We trust the integrity of the bank because we intrinsically trust the accounting practices used by banks
- We also trust the bank because
- The bank is audited for compliance with these trusted practices
- The bank’s data is scrutinized for signatures of fraud
10/3/05 15:
Integrity
- Although we may desire an intrinsic
notion of integrity we must accept an
extrinsic notion in the general case
- If we do not have intrinsic assurance
the best we can demand is that no
agent can refute integrity
10/3/05 15:
Availability
- Let X be a set of entities, I a resource
- I has the property of availability with
respect to X if all members of X can
access I
- What is access?
- Quality of service is not always binary
10/3/05 15:
Dimensions of Policy
- Policy defines security objective:
- Confidentiality: Protect Information and Resources I from X
- Integrity: …in a manner trusted by Y
- Availability: …to be accessible to Z
- Mechanisms can be evaluated to determine if they help meet the objective 10/3/05 15:
Does this model match
reality?
- Recall PSU AUP
- What facets focus on
- Confidentiality: what is I? who/what is X?
- Integrity: I? X?
- Availability: I? X?
- What facets are outside of this model?
10/3/05 15:
PSU Computer & Network
Acceptable Use Policy
- This acceptable use policy governs the use of computers and networks at Portland State University (PSU). As a user of these resources, you are responsible for reading and understanding this document. …
- Portland State University encourages the use and application of information technologies to support the research, instruction, and public service mission of the institution. PSU computers and networks can provide access to resources on and off campus, as well as the ability to communicate with other users worldwide. Such open access is a privilege and requires that individual users act responsibly. Users must respect the rights of other users, respect the integrity of systems and related physical resources, and observe all relevant laws, regulations, and contractual obligations. 10/3/05 15:
PSU AUP (cont)
- Acceptable use terms and conditions:
- The primary purpose of electronic systems and communications resources is for University- related activities only.
- Users do not own accounts on University computers, but are granted the privilege of exclusive use. Users may not share their accounts with others, and must keep account passwords confidential.
- Each account granted on a University system is the responsibility of the individual who applies for the account. Groups seeking accounts must select an individual with responsibility for accounts that represent groups.
- The University cannot guarantee that messages or files are private or secure. The University may monitor and record usage to enforce its policies and may use information gained in this way in disciplinary and criminal proceedings.
- Users must adhere strictly to licensing agreements and copyright laws that govern all material accessed or stored using PSU computers and networks.
- When accessing remote systems from PSU systems, users are responsible for obeying the policies set forth herein as well as the policies of other organizations.
- Misuse of University computing, networking, or information resources may result in the immediate loss of computing and/or network access. Any violation of this policy or local, state, or federal laws may be referred to appropriate University offices and/or, as appropriate, law enforcement authorities.
10/3/05 15:
Policy model vs reality
- Consider password policies (e.g. Sans
model policy
http://www.sans.org/resources/policies/)
- What dimension of security do
password polices primarily address?
10/3/05 15:
Policy informed by experience
- Most organizations have a policy that
has evolved
- Reflects understanding of threat
environment (or at least threat history)
- Can reveal critical assumptions
10/3/05 15:
Policy vs. Mechanism
- Policy says what is allowed and what isn’t
- Mechanism is an entity or procedure that enforces some part of the policy
- Discuss
- List some mechanisms
- Facets of policy for which mechanisms are appropriate
- Facets of policy for which mechanisms are unlikely to be appropriate 10/3/05 15:
Security Model
- A security model is a model that
represents a particular policy or set of
policies
- Abstracts from the policy
- We will see various security models:
- Bell LaPadula for Confidentiality
- Clark-Willson Integrity
- Chinese Wall Model
10/3/05 15:
Trust
- What are some assumptions of
- the PSU AUP?
- The sans password policy? 10/3/05 15:
Access Control
- Discretionary Access Control (DAC)
- An individual user can set allow or deny access to an object
- Mandatory Access Control (MAC)
- System mechanism controls access
- User cannot alter that access
- Originator Controlled Access Control (ORCON)
- Access control set by creator of information
- Owner (if different) can’t alter AC
- Like copyright