1. Design Principles Overview Principles Least Privilege Fail-Safe Defaults Economy of Mechanism Complete Mediation Open Design Separation of Privilege Least Common Mechanism Psychological Acceptability Introduction to Computer Security ©2004 Matt Bishop

2. Overview Simplicity Fewer components so less to go wrong Fewer interfaces and hence fewer possible inconsistencies Easy to understand Restriction Minimize access Fewer interfaces inhibit interactions Introduction to Computer Security ©2004 Matt Bishop

3. Least Privilege A subject should be given only those privileges necessary to complete its task Function determines rights, not role Rights added as needed, discarded after use Introduction to Computer Security ©2004 Matt Bishop

4. Fail-Safe Defaults Default action is to deny access If action fails, system should remain as secure as when action began Introduction to Computer Security ©2004 Matt Bishop

5. Economy of Mechanism Keep it as simple as possible KISS Principle Simpler means less can go wrong And when errors occur, they are easier to understand and fix Interfaces and interactions Introduction to Computer Security ©2004 Matt Bishop

6. Complete Mediation Check every access Usually done once, on first action Checking every access can slow down system If permissions change after, may get unauthorized access In a UNIX system, open a file for reading from a process change permissions for the file and remove read permission make process read from file – what will/should happen? Introduction to Computer Security ©2004 Matt Bishop

7. Open Design Security should not depend on secrecy of design or implementation Popularly misunderstood to mean that source code should be public People are good at finding out what secrets you have Reverse engineering, social engineering, dumpster diving Revealing the design should not result is lack of security Does not apply to information such as passwords or cryptographic keys Introduction to Computer Security ©2004 Matt Bishop

8. Separation of Privilege Require multiple conditions to grant privilege Separation of duty Specific entities can grant specific privileges Entity can’t grant itself privileges Defense in depth Multiple actions needs to take place to grant privilege Moat, walls, boiling oil Introduction to Computer Security ©2004 Matt Bishop

9. Least Common Mechanism Mechanisms should not be shared Information can flow along shared channels By examining the information flow, one process can determine what the other process is transmitting/processing/doing. Isolation Virtual machines Introduction to Computer Security ©2004 Matt Bishop

10. Psychological Acceptability Security mechanisms should not add to difficulty of accessing resource Hide complexity introduced by security mechanisms Ease of installation, configuration Human factors critical here Be clear in error messages Login/password wrong. Ease of use Data format Introduction to Computer Security ©2004 Matt Bishop

11. Key Points Principles of secure design underlie all security-related mechanisms Require: Good understanding of goal of mechanism and environment in which it is to be used Careful analysis and design Careful implementation Introduction to Computer Security ©2004 Matt Bishop