Assumptions of Secure Operation University of Sunderland CSEM02 Harry R. Erwin, PhD

Definition When you do a security analysis, you identify ‘security objectives’—what the target of evaluation (TOE—i.e., the ‘system’) should do. For example, the recommendations of a risk analysis are security objectives. Some of these objectives do not require specific security mechanisms because the system operates securely for other reasons. Those other reasons are the ‘assumptions of secure operation’. We will examine typical ones from US Department of Defense sources.

Assumption Categories (from CCTool) Administrators—what can we assume about the administrators? Users—what can we assume about the users? Assumed Protection—what can we assume about the protection of security data? Procedural Security—what can we assume about administrative procedures? Communications Security—what can we assume about the security of data in transit? Physical Security—what can we assume about the physical security of the system and facility?

Administrator Assumptions Are the administrator staff authenticated and held responsible for their actions? (good idea) Is remote security administration supported? (bad idea) Are administrators trusted, hostile, or negligent? (trusted is preferred) Are administrators competent, improperly trained, or error-prone? (competent is preferred) Can administrators be trusted to be well-behaved and to act constructively? (Answer ‘yes’.)

User Assumptions Are users cooperative? (hard to say) Do they have access to security data? Can they access the system remotely? Are they competent, hostile, or error-prone? Can they bypass security? How competent are the hackers? Are viruses a concern?

Assumed Protection How secure are the password files? Can they be accessed outside of their use in identification and authentication? Do system administrators have the ability to corrupt data transiting to/from the system? (unlikely) Are programs, log files, and system data protected from corruption by users?

Procedural Security Do security administrators follow documented policies and procedures? Do security administrators review audit trails and security logs on a regular basis? Do security administrators remove user data properly from the system when user access is removed? (Discuss…) Do security administrators follow procedures to enforce proper user management of passwords? Do security administrators follow procedures to prevent the spread of computer viruses?

Communications Security Are communications media physically protected? (unlikely) Can outsiders read communications traffic? Are the systems interfacing to the TOE under the same management control, and do they follow the same security policies? (Trust, again!)

Physical Security Can hackers gain physical access to the system? Are TOE security functions physically protected? Is the system protected against natural disaster? Is the system protected against sudden loss of power? Are system communications protected from sudden loss of service?

Conclusions Clearly, it is easier to secure a system that operates in a benign or safe environment. Deploying a system in an unprotected environment makes security much more difficult, but may be required. (E.g., FAA radars and communications antennae are not physically protected.) Consider the operational environment in assessing costs and benefits.