Title ON FOUR DEFINITIONS OF DATA INTEGRITY Ravi Sandhu George Mason University FIVE

2 OBJECTIVE Reconcile 5 definitions of data integrity Scope is limited to data integrity as opposed to system integrity None of the definitions is wrong or right

3 THE FIVE DEFINITIONS 1.CourtneyExpectation of data quality 2.Sandhu-JajodiaSafeguards against improper data modification 3.ITSEC, CTCPECSafeguards against unauthorized data modification 4.Biba (or BLP)Ensure one directional information flow in a lattice 5.Network arenaSafeguards against message modification more general less general

4 THE FIVE DEFINITIONS 1.Expectation of data quality 2.Improper data modification 3.Unauthorized data modification 4.One directional information flow 5.No modification Liveness and Safety Safety Only OBJECTIVES

5 THE FIVE DEFINITIONS 1.Expectation of data quality 2.Improper data modification 3.Unauthorized data modification 4.One directional information flow 5.No modification External actions of users + Internal actions of the TCB ENFORCEMENT IS PRIMARILY BY Internal actions of the TCB

6 THE FIVE DEFINITIONS 1.Expectation of data quality 2.Improper data modification 3.Unauthorized data modification 4.One directional information flow 5.No modification Must be articulated by the System Owners POLICY Is built in

7 THE FIVE DEFINITIONS 1.Expectation of data quality 2.Improper data modification 3.Unauthorized data modification 4.One directional information flow 5.No modification Prevention + Detection ENFORCEMENT MECHANISMS Detection

8 THE DATA QUALITY DEFINITION Integrity -- The property that data, an information process, computer equipment, and/or software, people, etc., or any collection of these entities, meet an a priori expectation of quality that is satisfactory and adequate in some specific circumstance. Bob Courtney NIST Invitational Workshop on Data Integrity, 1989

9 THERMOSTAT MODEL

10 BINARY OR GRADED? Binary view: Data has integrity if its actual state differs from the ideal state by less than the tolerable limits of deviation Graded view: Data has integrity in inverse relationship to the extent that its actual state differs from the ideal state IN OTHER WORDS THIS IS A NON-ISSUE

11 CLARK-WILSON MODEL TPs CDIs USERS UDIs IVPs Internal and external consistency of CDIs

12 CLARK-WILSON RULES C1IVPs validate CDI state C2TPs preserve valid state C3Suitable (static) separation of duties C4TPs write to log C5TPs validate UDIs E1CDIs changed only by authorized TP E2Users authorized to TP and CDI E3Users are authenticated E4Authorizations changed only by security officer

13 CLARK-WILSON MODEL Concerned with improper modification of data Does not address liveness, except to require that integrity verification procedures verify correspondence of data to external reality It is one approach to –meeting the improper data modification aspects of data integrity –with a small liveness attachment

14 TYPE ENFORCEMENT (Boebert and Kain) Type enforcement can be used to implement a number of mechanisms related to improper modification of data –well-formed transformation procedures –data encapsulation –separation of duties –assured pipelines Type enforcement does not directly support liveness requirements

15 OTHER ACCESS CONTROL MODELS HRU, TAM, SPM –can be used to implement a number of mechanisms related to improper modification of data –do not directly support liveness requirements

16 DRAFT FEDERAL CRITERIA Integrity - Correctness and appropriateness of the content and/or source of a piece of information. The Courtney and Federal Criteria definitions are close enough that they can be reconciled fairly easily Courtney's definition is more general, because it is phrased in terms of data quality, which is a more general notion than the specific attributes of correctness and appropriateness

17 DOES INTEGRITY SUBSUME SECRECY? Top Secret Contents Label: Secret By Courtney and Federal Criteria definitions this is an integrity violation (if we expect labels to be correct)

18 HOMEWORK ASSIGNMENT Unclassified Contents Label: Secret Is this an integrity violation?

19 PANELISTS John Dobson Carl Landwehr LouAnna Notargiacomo Marv Schaefer