1. Security Modeling Jagdish S. Gangolly School of Business
State University of New York at Albany
NOTE: These notes are based on the book Counter Hack, by Ed Skoudis and are prepared solely for the students in the course Acc 661 at SUNY Albany. They are not to be used by others without the permission of the instructor.
1/13/2019
Acc 661 Auditing of Adv Acctg Info Systems

2. Acc 661 Auditing of Adv Acctg Info Systems
Security Modeling I
Models of Confidentiality
Bell- La Padula Model
Subjects, Objects, set of access operations, a Set of security levels, Security clearance for subjects, Security classification for objects, Access control matrix.
Ss-property (no read-up policy)
*-property (no write-down policy)
ds-property (discretionary security property) (Orangebook)
A state is secure if the three security properties are satisfied.
Basic security theorem: If the initial state is secure and all state transitions are secure, then all subsequent states are secure, no matter what inputs occur.
1/13/2019
Acc 661 Auditing of Adv Acctg Info Systems

3. Acc 661 Auditing of Adv Acctg Info Systems
Security Modeling II
Biba Integrity Model:
Simple integrity property: a subject can modify a, object only if its integrity classification dominates that of the object
Integrity *-property: If a subject has read access to object o, then it can have write access right to an object p only if the integrity classification of o dominates that of p.
1/13/2019
Acc 661 Auditing of Adv Acctg Info Systems

4. Acc 661 Auditing of Adv Acctg Info Systems
Security Modeling III
Harrison-Ruzzo-Ullman Model:
Commands, conditions, primitive operations.
Protection system: subjects, objects, rights, commands
If commands are restricted to a single operation each, it is possible to decide if a given subject can ever obtain right to an object.
If commands are not restricted to one operations each, it is not always decidable whether a given protection system can confer a given right.
1/13/2019
Acc 661 Auditing of Adv Acctg Info Systems

5. Acc 661 Auditing of Adv Acctg Info Systems
Security Modeling III
Clark-Wilson Commercial Security Policy:
Well-formed transaction
Separation of duty
1/13/2019
Acc 661 Auditing of Adv Acctg Info Systems

6. Security Features of Trusted Operating Systems
User identification & authentication
Mandatory access control
Discretionary access control
Object reuse protection (leakage)
Complete mediation
Trusted path
Audit
Audit log reduction
Intrusion detection
1/13/2019
Acc 661 Auditing of Adv Acctg Info Systems

7. Acc 661 Auditing of Adv Acctg Info Systems
Orange Book
D: Minimal protection
C1/C2/B1: requiring security features common to commercial operating systems
B2: precise proof of security of the underlying model and a narrative specification of the trusted computing base
B3/A1: requiring more precisely proven descriptive and formal designs of the trusted computing base
1/13/2019
Acc 661 Auditing of Adv Acctg Info Systems