Security Modeling Jagdish S. Gangolly School of Business State University of New York at Albany NOTE: These notes are based on the book Counter Hack, by Ed Skoudis and are prepared solely for the students in the course Acc 661 at SUNY Albany. They are not to be used by others without the permission of the instructor. 1/13/2019 Acc 661 Auditing of Adv Acctg Info Systems

Acc 661 Auditing of Adv Acctg Info Systems Security Modeling I Models of Confidentiality Bell- La Padula Model Subjects, Objects, set of access operations, a Set of security levels, Security clearance for subjects, Security classification for objects, Access control matrix. Ss-property (no read-up policy) *-property (no write-down policy) ds-property (discretionary security property) (Orangebook) A state is secure if the three security properties are satisfied. Basic security theorem: If the initial state is secure and all state transitions are secure, then all subsequent states are secure, no matter what inputs occur. 1/13/2019 Acc 661 Auditing of Adv Acctg Info Systems

Acc 661 Auditing of Adv Acctg Info Systems Security Modeling II Biba Integrity Model: Simple integrity property: a subject can modify a, object only if its integrity classification dominates that of the object Integrity *-property: If a subject has read access to object o, then it can have write access right to an object p only if the integrity classification of o dominates that of p. 1/13/2019 Acc 661 Auditing of Adv Acctg Info Systems

Acc 661 Auditing of Adv Acctg Info Systems Security Modeling III Harrison-Ruzzo-Ullman Model: Commands, conditions, primitive operations. Protection system: subjects, objects, rights, commands If commands are restricted to a single operation each, it is possible to decide if a given subject can ever obtain right to an object. If commands are not restricted to one operations each, it is not always decidable whether a given protection system can confer a given right. 1/13/2019 Acc 661 Auditing of Adv Acctg Info Systems

Acc 661 Auditing of Adv Acctg Info Systems Security Modeling III Clark-Wilson Commercial Security Policy: Well-formed transaction Separation of duty 1/13/2019 Acc 661 Auditing of Adv Acctg Info Systems

Security Features of Trusted Operating Systems User identification & authentication Mandatory access control Discretionary access control Object reuse protection (leakage) Complete mediation Trusted path Audit Audit log reduction Intrusion detection 1/13/2019 Acc 661 Auditing of Adv Acctg Info Systems

Acc 661 Auditing of Adv Acctg Info Systems Orange Book D: Minimal protection C1/C2/B1: requiring security features common to commercial operating systems B2: precise proof of security of the underlying model and a narrative specification of the trusted computing base B3/A1: requiring more precisely proven descriptive and formal designs of the trusted computing base 1/13/2019 Acc 661 Auditing of Adv Acctg Info Systems