1. An Approach to Correctness of Security and Operational Business Policies October 5, 2013 Discussant Graham Gal

2. University of Waterloo Symposium on Information Integrity and Information Systems Assurance Outline Policies and Permissions Constraints Representation of Policies Evaluation of Policies

3. University of Waterloo Symposium on Information Integrity and Information Systems Assurance Policies and Permissions Policy is a management statement on acceptable states – Can be based on intensions or extensions Permissions are related to an action Implies permissible states And how to get there (transitions) Not just permit and deny

4. University of Waterloo Symposium on Information Integrity and Information Systems Assurance Types of Policy statements Intensions – On multiplicities Employees must be assigned to a single department Each department must have a single manager – Based on Type Specifications Internal Auditors must have these qualifications – Permissions as Policies REA patterned Sale – Salespeople (Internal Agent Type) can – Sell (Event Type) – Inventory (Resource Type) to – Customers (External Agent Type) Delegate and Perform Permissions

5. University of Waterloo Symposium on Information Integrity and Information Systems Assurance Constraints Restricted States (Preventive Controls) – Unassigned employees – No paychecks to non-employees – No labs to dead patients Possibly violated states – Temporal Separation of events Sale cannot cause customer’s balance to exceed credit limit – Database transactions versus Business transactions Person must be assigned to one and only one department – Accumulation of Evidence Orders over $1000 must be approved by Department Manager

6. University of Waterloo Symposium on Information Integrity and Information Systems Assurance

8. Order #DateBuyer Approved by $ Amount 1233S9/30/133433 $995 1245A9/30/133421 $987 16789C10/1/133421 $567 1569V10/1/133433 $998 34335Z10/2/133456 $989 5644N10/1/133456 $994 8977G10/2/133422 $989 Order over $1000 Must Have Approval