ITIS 3200: Introduction to Information Security and Privacy Dr. Weichao Wang

2 Chap 4: Security policies A computer system: –A finite state automaton –A set of transition functions that change states A security policy: –A statement that partitions system states into secure (authorized) and non-secure (unauthorized) states A secure system –A system that starts in a secure state and cannot enter a non-secure state

3 Types of security policies –Policy for confidentiality –Policy for integrity Role of assumptions –You must understand the security assumptions to know how effective the security policies, mechanisms, and procedures are

4 Example: when you install a software patch, you will assume: –It comes from the software company, –It has been tested, –Your system setup is supported, –It has been correctly installed, etc –At the low level, you will also assume The algorithm is correctly designed The compilation and linking is correct The hardware will do what it is supposed to do

5 Types of access control –Identity based access control (discretionary AC, the owner controls it): the access right is based on the identity of the subjects and objects –Mandatory access control (or rule based access control): a system controls access to an object and an individual user cannot override it –Originator controlled access control: the generator of the information controls access (not the owner. e.g. non-disclosure) –These methods can be used jointly

6 Finite state machine examples

7

8