1. CMSC 414 Computer (and Network) Security Lecture 10 Jonathan Katz

2. Midterm?  Likely during the week of Oct 20…  Will announce for certain next class

3. Back to computer security…

4. Access control  State of a system –Includes, e.g., current memory contents, all secondary storage, contents of all registers, etc.  Secure states –States in which the system is allowed to reside –Security policy defines the set of secure states –Security mechanism ensures that system never leaves secure state

5. Access control  Access control matrix –Characterizes rights of each active entity (“subject”) with respect to every other entity  In any secure state, only transitions to other secure states are allowed –Often concerned with transitions that affect the protection state of the system –I.e., actions which alter the actions a subject is authorized to take

6. Access control matrix  Protected entities: “objects” O  Active objects: “subjects” S (i.e., users/processes) –Note that subjects are also objects  Matrix A contains an entry for every pair (s, o) –The entry contains the rights for s on o –Examples: read/write/execute/etc.  Protection states represented by (S, O, A)

7. Some examples  Subjects/objects can be: –Files –Processes –Systems –Hosts –Functions/variables (within a program) –Database entries –Etc.

8. More complex access control  In general, “rights” may be functions –“Actual” rights depend on the system state –Equivalently, may depend on system history  May be more convenient to express in non- matrix form –E.g., boolean expression evaluation

9. Transitions  Can view transitions that modify the protection state as transformations of the access control matrix –E.g., create object; add right r to A[s,o]  Can build more complex commands out of these basic transformations –E.g., create_file: 1.Creates object 2.Gives creator rights to the file

10. Conditional commands  Can define even more complex commands using conditionals –E.g., grant_read_access Only if the function caller “owns” the file!  Only AND is used –OR can be replaced by two commands –NOT is not used

11. Attenuation of privilege  Copy right –Ability to transfer your rights to someone else –Copier may have to surrender the right  Own right –Ability to grant rights on the object to others  Attenuation of privilege –“A subject may not give rights it does not possess”

12. Final points (for now…)  Access control matrices can express any (reasonable) security policy –In practice, such matrices may not be used because of complexity, space requirements, etc.

13. Security policies

14. Security policy  View system as finite automaton –Transition functions change state  Security policy classifies states as “secure” or “insecure”  A secure system starts in a “secure” state and cannot enter an “insecure” state –“Breach of security” occurs when a system enters an “insecure” state

15. Confidentiality  I = information; X = entities  I has the property of confidentiality w.r.t. X if no member of X can obtain information about I –Note differences between “high-level” definition and “low-level” definition (i.e., encryption)

16. Integrity (of data or principles)  Let I = data or resource; X = entities  I has the property of integrity w.r.t. X if all members of X “trust” I –Again, notice differences (why do they trust I?) –They trust that the information was not modified and also trust the information itself

17. Availability  I = resource; X = entities  I has the property of availability w.r.t. X if all members of X can access I –“Availability” depends on context Available in finite, but unbounded, amount of time? Available within 3 second delay?

18. Time-dependence  Security policy may be time-dependent –E.g., contractor has the right to access data, but only as long as she is working for the company

19. Policies…  Confidentiality policy identifies states in which information is leaked to unauthorized entities  Integrity policy identifies who may alter data, and how it may be altered  Availability policy identifies which resources must be available, and to whom –If “availability” is precisely defined, this may also define “quality of service”

20. Security mechanism  A security mechanism enforces (part of) the security policy –Includes procedural/operational controls, not just technical controls E.g., who may enter the room in which backup tapes are stored How new accounts are established

21. Security policies  “Military security policy” is primarily concerned with confidentiality –Does not exclude other concerns…  “Commercial security policy” is primarily concerned with integrity (think: banking industry) –E.g., consistent transactions –The question of “trust” is much harder than the question of confidentiality