Chapter4:SecurityPolicies

Overview
Thenatureofpolicies
Whattheycover
Policylanguages

Thenatureofmechanisms
Types

Underlyingboth
Trust
November1,

IntroductiontoCompu

Slide#41

Overview

Overview
Policies
Trust
NatureofSecurityMechanisms
ExamplePolicy

November1,

IntroductiontoCompu

Slide#42

SecurityPolicy
Policypartitionssystemstatesinto:
Authorized(secure)
Thesearestatesthesystemcanenter

Unauthorized(nonsecure)
Ifthesystementersanyofthesestates,itsasecurity
violation

Securesystem
Startsinauthorizedstate
Neverentersunauthorizedstate
November1,

IntroductiontoCompu

Slide#43

Confidentiality
Xsetofentities,Iinformation
IhasconfidentialitypropertywithrespecttoXif
noxXcanobtaininformationfromI
Icanbedisclosedtoothers
Example:
Xsetofstudents
Ifinalexamanswerkey
IisconfidentialwithrespecttoXifstudentscannot
obtainfinalexamanswerkey
November1,

IntroductiontoCompu

Slide#44

Integrity
Xsetofentities,Iinformation
IhasintegritypropertywithrespecttoXifallx
XtrustinformationinI
Typesofintegrity:
trustI,itsconveyanceandprotection(dataintegrity)
Iinformationaboutoriginofsomethingoranidentity
(originintegrity,authentication)
Iresource:meansresourcefunctionsasitshould
(assurance)
November1,

IntroductiontoCompu

Slide#45

Availability
Xsetofentities,Iresource
IhasavailabilitypropertywithrespecttoXifallx
XcanaccessI
Typesofavailability:
traditional:xgetsaccessornot
qualityofservice:promisedalevelofaccess(for
example,aspecificlevelofbandwidth)andnotmeetit,
eventhoughsomeaccessisachieved
November1,

IntroductiontoCompu

Slide#46

PolicyModels
Abstractdescriptionofapolicyorclassof
policies
Focusonpointsofinterestinpolicies
Securitylevelsinmultilevelsecuritymodels
SeparationofdutyinClarkWilsonmodel
ConflictofinterestinChineseWallmodel

November1,

IntroductiontoCompu

Slide#47

TypesofSecurityPolicies
Military(governmental)securitypolicy
Policyprimarilyprotectingconfidentiality

Commercialsecuritypolicy
Policyprimarilyprotectingintegrity

Confidentialitypolicy
Policyprotectingonlyconfidentiality

Integritypolicy
Policyprotectingonlyintegrity
November1,

IntroductiontoCompu

Slide#48

IntegrityandTransactions
Begininconsistentstate
Consistentdefinedbyspecification

Performseriesofactions(transaction)
Actionscannotbeinterrupted
Ifactionscomplete,systeminconsistentstate
Ifactionsdonotcomplete,systemrevertsto
beginning(consistent)state
November1,

IntroductiontoCompu

Slide#49

Trust
Administratorinstallspatch
1. Trustspatchcamefromvendor,not
tamperedwithintransit
2. Trustsvendortestedpatchthoroughly
3. Trustsvendorstestenvironment
correspondstolocalenvironment
4. Trustspatchisinstalledcorrectly
November1,

IntroductiontoCompu

Slide#410

TrustinFormalVerification
Givesformalmathematicalproofthatgiven
inputi,programPproducesoutputoas
specified
SupposeasecurityrelatedprogramS
formallyverifiedtoworkwithoperating
systemO
Whataretheassumptions?
November1,

IntroductiontoCompu

Slide#411

TrustinFormalMethods
1. Proofhasnoerrors

Bugsinautomatedtheoremprovers

2. PreconditionsholdinenvironmentinwhichSis
tobeused
3. StransformedintoexecutableSwhoseactions
followsourcecode

Compilerbugs,linker/loader/libraryproblems

4. HardwareexecutesSasintended

Hardwarebugs(Pentiumf00fbug,forexample)

November1,

IntroductiontoCompu

Slide#412

TypesofAccessControl
DiscretionaryAccessControl(DAC,IBAC)
individualusersetsaccesscontrolmechanismtoallow
ordenyaccesstoanobject

MandatoryAccessControl(MAC)
systemmechanismcontrolsaccesstoobject,and
individualcannotalterthataccess

OriginatorControlledAccessControl(ORCON)
originator(creator)ofinformationcontrolswhocan
accessinformation
November1,

IntroductiontoCompu

Slide#413

Question
Policydisallowscheating
Includescopyinghomework,withorwithout
permission

CSclasshasstudentsdohomeworkoncomputer
Anneforgetstoreadprotectherhomeworkfile
Billcopiesit
Whocheated?
Anne,Bill,orboth?

November1,

IntroductiontoCompu

Slide#414

AnswerPart1
Billcheated
Policyforbidscopyinghomeworkassignment
Billdidit
Systementeredunauthorizedstate(Billhavingacopy
ofAnnesassignment)

Ifnotexplicitincomputersecuritypolicy,
certainlyimplicit
Notcrediblethataunitoftheuniversityallows
somethingthattheuniversityasawholeforbids,unless
theunitexplicitlysaysso
November1,

IntroductiontoCompu

Slide#415

AnswerPart2
Annedidntprotectherhomework
Notrequiredbysecuritypolicy

Shedidntbreachsecurity
Ifpolicysaidstudentshadtoreadprotect
homeworkfiles,thenAnnedidbreach
security
Shedidntdothis
November1,

IntroductiontoCompu

Slide#416

Mechanisms
Entityorprocedurethatenforcessomepart
ofthesecuritypolicy
Accesscontrols(likebitstopreventsomeone
fromreadingahomeworkfile)
DisallowingpeoplefrombringingCDsand
floppydisksintoacomputerfacilitytocontrol
whatisplacedonsystems

November1,

IntroductiontoCompu

Slide#417

ExampleEnglishPolicy
Computersecuritypolicyforacademic
institution
Institutionhasmultiplecampuses,administered
fromcentraloffice
Eachcampushasitsownadministration,and
uniqueaspectsandneeds

AuthorizedUsePolicy
ElectronicMailPolicy
November1,

IntroductiontoCompu

Slide#418

AuthorizedUsePolicy
Intendedforonecampus(Davis)only
Goalsofcampuscomputing
Underlyingintent

Proceduralenforcementmechanisms
Warnings
Denialofcomputeraccess
Disciplinaryactionuptoandincludingexpulsion

Writteninformally,aimedatusercommunity

November1,

IntroductiontoCompu

Slide#419

ElectronicMailPolicy
Systemwide,notjustonecampus
Threeparts
Summary
Fullpolicy
Interpretationatthecampus

November1,

IntroductiontoCompu

Slide#420

Summary
Warnsthatelectronicmailnotprivate
Canbereadduringnormalsystem
administration
Canbeforged,altered,andforwarded

Unusualbecausethepolicyalertsusersto
thethreats
Usually,policiessayhowtopreventproblems,
butdonotdefinethethreats
November1,

IntroductiontoCompu

Slide#421

Summary
Whatusersshouldandshouldnotdo
Thinkbeforeyousend
Becourteous,respectfulofothers
Dontnterferewithothersuseofemail

Personaluseokay,providedoverheadminimal
Whoitappliesto
ProblemisUCisquasigovernmental,soisboundbyrulesthat
privatecompaniesmaynotbe
Educationalmissionalsoaffectsapplication

November1,

IntroductiontoCompu

Slide#422

FullPolicy
Context
DoesnotapplytoDept.ofEnergylabsrunbytheuniversity
Doesnotapplytoprintedcopiesofemail
Otherpoliciesapplyhere

Email,infrastructureareuniversityproperty
Principlesofacademicfreedom,freedomofspeechapply
Accesswithoutuserspermissionrequiresapprovalofvice
chancellorofcampusorvicepresidentofUC
Ifinfeasible,mustgetpermissionretroactively

November1,

IntroductiontoCompu

Slide#423

UsesofEmail
Anonymityallowed
Exception:ifitviolateslawsorotherpolicies

Cantinterferewithothersuseofemail
Nospam,letterbombs,emailedworms,etc.

Personalemailallowedwithinlimits
Cannotinterferewithuniversitybusiness
Suchemailmaybeauniversityrecord
subjecttodisclosure
November1,

IntroductiontoCompu

Slide#424

SecurityofEmail
Universitycanreademail
Wontgooutofitswaytodoso
Allowedforlegitimatebusinesspurposes
Allowedtokeepemailrobust,reliable

Archivingandretentionallowed
Maybeabletorecoveremailfromendsystem
(backedup,forexample)
November1,

IntroductiontoCompu

Slide#425

Implementation
Addscampusspecificrequirementsand
procedures
Example:incidentalpersonalusenotallowedifit
benefitsanonuniversityorganization
Allowsimplementationtotakeintoaccountdifferences
betweencampuses,suchasselfgovernanceby
AcademicSenate

Proceduresforinspecting,monitoring,disclosing
emailcontents
Backups
November1,

IntroductiontoCompu

Slide#426

KeyPoints
Policiesdescribewhatisallowed
Mechanismscontrolhowpoliciesare
enforced
Trustunderlieseverything

November1,

IntroductiontoCompu

Slide#427