Advanced Systems Security: Integrity
|
|
|
- Gladys Crawford
- 6 years ago
- Views:
Transcription
1 Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security: Integrity Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University Page 1
2 Choosing Security Goals Can we use the ideas for secrecy goals for integrity? Kind of Page 2
3 Least Privilege The protection mechanism should force every process to operate with the minimum privileges needed to perform its task. Due to Saltzer and Schroeder (of Multics project) One of many design principles in their paper The Protection of Information in Computer Systems (1975) Others Principle of Psychological Acceptability Principle of Fail Safe Defaults Page 3
4 Least Privilege How to compute least privilege? Aim: Determines the permissions required for the program to run effectively Run the program and see what permissions are used Proposed for a system called Systrace SELinux audit2allow: take denied permissions and add them to policy AppArmor Profile Wizard: Build an approximate profile statically and apparmor/book_apparmor21_admin/data/sec_apparmor_repo.html Page 4
5 Least Privilege Is a good goal because Is a poor goal because Can we use it to verify a policy is secure? Page 5
6 Least Privilege Is a good goal because Unnecessary permissions lead to problems (confused deputy) Accounts for function Is a poor goal because Task permissions may conflict with security How do we know when a permission is necessary, but makes the system insecure? Can we use it to verify a policy is secure? No. It defines a policy based on function, not security. Page 6
7 Information Flow for Integrity Another approach looks at the authorized flow of information among processes via objects Page 7
8 Idealized Security Biba Integrity Integrity requirement: Do not depend on data from lower integrity principals Only permit information to flow from high integrity to lower integrity E.g., Can only read a file if your integrity level is dominated by the file s Low High Page 8
9 Biba and BLP Should you use the same policy for BLP and Biba? Should you use the same labels for BLP and Biba? Page 9
10 Practical vs. Ideal Do these idealized approaches based on information flow enable practical realization of OS enforcement? Secrecy is possible in some environments Implemented in a paper world, previously Integrity has not been realized in practice Many processes provide high integrity services to others Result: Depend on many applications to manage information flows Page 10
11 Assured Guards What do we do if a system needs an information flow from low integrity to high? E.g., reading from a network socket Not authorized by Biba Unless subject is fully assured to upgrade to high integrity or discard low integrity data Called a guard Must be verified to be correct (like a reference monitor) Why? Page 11
12 LOMAC Subjects and objects have an integrity label Level and category in a lattice policy When subject reads an object of a lower integrity label in lattice Subject s label is lowered to that of object Define subject s label in terms of objects accessed When subject writes to an object of a higher integrity label in lattice Write is denied Read is still allowed Page 12
13 Biba vs LOMAC What is allowed and what is the resultant label? Lattice A à B à C Subject at A reads object at C Biba? LOMAC? Subject at C writes object at A Biba? LOMAC? Subject at C reads from object at A Page 13
14 Self-Revocation Can cause revocation of own access to objects in LOMAC Step 1: initial state. level 2 level 2 level 2 ps pipe grep Step 2: ps reads file. level 2 level 2 level 2 ps pipe grep r /proc/327 level 1 Step 3: demotion. level 1 level 2 level 2 ps pipe grep Step 4: pipe write denied. level 1 level 2 level 2 ps w pipe grep Page 14
15 Avoid Self-Revocation What could you do to avoid self-revocation in some cases? Page 15
16 Avoid Self-Revocation What could you do to avoid self-revocation in some cases? Add floors for subjects Cannot open any objects below floor label (like Biba) This was done in the IX system An MLS UNIX system by McElroy and Reeds Page 16
17 Information Flow Is a good goal because Is a poor goal because Can we use it to verify a policy is correct? Page 17
18 Information Flow Is a good goal because No false negatives an attack requires an illegal information flow Can define data and functional security requirements Is a poor goal because Function may conflict with security How do we know when a permission is illegal, but is necessary for functional requirements? Can we use it to verify a policy is correct? Yes. It defines a policy based on security. But what about exceptions? Page 18
19 Clark-Wilson Integrity Model Goal: define integrity in terms of commercial terms rather than military (MLS/Biba) Insights? Page 19
20 Clark-Wilson Integrity Model Model consists of a set of certification and enforcement rules governing integrity Own terms CDI Constrained Data Items (High integrity data) UDI Unconstrained Data Items (Low integrity data) IVP Integrity Verification Procedure (certify CDIs) TP Transformation Procedures (High integrity programs) Page 20
21 Clark-Wilson Integrity Model Model consists of a set of certification and enforcement rules governing integrity C1 When an IVP is executed, it must ensure the CDIs are valid. C2 For some associated set of CDIs, a TP must transform those CDIs from one valid state to another. C3 Allowed relations must meet the requirements of separation of duty. C4 All TPs must append to a log enough information to reconstruct the operation. C5 Any TP that takes a UDI as input may only perform valid transactions for all possible values of the UDI. The TP will either accept (convert to CDI) or reject the UDI. Page 21
22 Clark-Wilson Integrity Model Model consists of a set of certification and enforcement rules governing integrity E1 System must maintain a list of certified relations and ensure only TPs certified to run on a CDI change that CDI. E2 System must associate a user with each TP and set of CDIs. E3 System must authenticate every user attempting a TP. E4 Only the certifier of a TP may change the list of entities associated with that TP. Page 22
23 Clark-Wilson Integrity Model How does it work? Certify TPs and IVPs IVPs certify CDIs and TPs modify them TPs must also be able to handle an UDIs they receive securely Run the system Authenticated users can modify a CDI if and only if: They can access TP and CDI and TP is authorized to change CDI Page 23
24 Clark-Wilson Results Was this used? Not so much Why do you think it may be difficult to apply in practice? Are the information flows authorized different than Biba or LOMAC? Page 24
25 Impact on Labeling and Transition How should security goals impact labeling and transitions? Labeling assignment of objects to labels What are the requirements for various secrecy/integrity levels? Transitions conditions that determine when a label will change What are the requirements for causing a label change? What experience do we have? Page 25
26 Labeling How do we choose the label of a subject or object when created? Traditional: same label as creator Alternatives Based on certification E.g., code hashes for integrity verification Based on location of created object Store this with garbage, so make it garbage Based on creator preference Trust the creator to decide (within a range) Page 26
27 Transitions When do we change the label of a subject or object? And to what? Traditional: don t change Alternatives Based on operations performed by subject or on object Low-water mark integrity; High-water mark secrecy There are access control models based on these Based on operations of others E.g., When another process receives untrusted input, downgrade the whole system Page 27
28 Take Away To build a secure system, we need to define a mandatory protection system But, what should guide the design? Security goals Usually serves as a rough guide Types of security goals biased toward security or function Functional: least privilege; Security: information flow Need to develop approaches to design goals for entire mandatory protection system from function and security Page 28
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Security Goals
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Integrity Policies. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger.
CSE497b Introduction to Computer and Network Security - Spring 2007 - Professor Jaeger Policies CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Chapter 6: Integrity Policies
Chapter 6: Integrity Policies Overview Requirements Biba s models Clark-Wilson model Slide #6-1 Overview Requirements Very different than confidentiality policies Biba s model Clark-Wilson model Slide
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Integrity Policies. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Integrity Policies Murat Kantarcioglu Requirements of Policies for Commercial Applications [Lipner 1982] 1. Users will not write their own
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
May 1: Integrity Models
May 1: Integrity Models Biba Clark-Wilson Comparison Trust models May 1, 2017 ECS 235B Spring Quarter 2017 Slide #1 Integrity Overview Requirements Very different than confidentiality policies Biba s models
Justifying Integrity Using a Virtual Machine Verifier
Justifying Integrity Using a Virtual Machine Verifier Joshua Schiffman, Thomas Moyer, Christopher Shal, Trent Jaeger, and Patrick McDaniel ACSAC 09 1 1 Cloudy Horizons Utility-based cloud computing is
Advanced Systems Security: Securing Commercial Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Topics in Systems and Program Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Topics in Systems and
CCM Lecture 14. Security Models 2: Biba, Chinese Wall, Clark Wilson
CCM 4350 Lecture 14 Security Models 2: Biba, Chinese Wall, Clark Wilson Introduction Bell-LaPadula model designed to capture a specific military security policy. At one time treated as the model of security.
CSE Computer Security
CSE 543 - Computer Security Lecture 11 - Access Control October 10, 2006 URL: http://www.cse.psu.edu/~tjaeger/cse543-f06/ Access Control System Protection Domain What can be accessed by a process Default
Topics in Systems and Program Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Topics in Systems and
CIS433/533 - Introduction to Computer and Network Security. Access Control
CIS433/533 - Introduction to Computer and Network Security Access Control Professor Butler Winter 2011 Computer and Information Science Trusted Computing Base The trusted computing base is the infrastructure
Verifiable Security Goals
C H A P T E R 5 Verifiable Security Goals 57 In this chapter, we examine access control models that satisfy the mandatory protection system of Definition 2.4 in Chapter 2. A mandatory protection system
Toward Automated Information-Flow Integrity Verification for Security-Critical Applications
CSE 598A - Spring 2007 - Sandra Rueda Page 1 Toward Automated Information-Flow Integrity Verification for Security-Critical Applications Umesh Shankar, Trent Jaeger and Reiner Sailer Presented by Sandra
Advanced Systems Security: Multics
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CSE509: (Intro to) Systems Security
CSE509: (Intro to) Systems Security Fall 2012 Radu Sion Integrity Policies Hybrid Policies 2005-12 parts by Matt Bishop, used with permission Integrity Policies: Overview Requirements Very different than
Access control models and policies. Tuomas Aura T Information security technology
Access control models and policies Tuomas Aura T-110.4206 Information security technology 1. Access control 2. Discretionary AC 3. Mandatory AC 4. Other AC models Outline 2 ACCESS CONTROL 3 Access control
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Introduction to Security
IS 2150 / TEL 2810 Introduction to Security James Joshi Associate Professor, SIS Lecture 6 October 6, 2009 Hybrid Models Role based Access Control 1 Objective Define/Understand various Integrity models
CSE Computer Security
CSE 543 - Computer Security Lecture 25 - Virtual machine security December 6, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Implementation and Results Experimental Platform Exact specification
Advanced Systems Security: Putting It Together Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Information Security & Privacy
IS 2150 / TEL 2810 Information Security & Privacy James Joshi Associate Professor, SIS Hybrid Models Role based Access Control Feb 3, 2016 1 Objective Define/Understand various Integrity models Clark-Wilson
Advanced Systems Security: Security-Enhanced Linux
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CS 392/ CS Computer Security. Nasir Memon Polytechnic University Module 7 Security Policies
CS 392/ CS 681 - Computer Security Nasir Memon Polytechnic University Module 7 Security Policies Course Logistics Security Week Questions about Midterm grading Read parts of chapters 4, 5, 6 and 7. Homework
Advanced Systems Security: Security-Enhanced Linux
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CCM Lecture 12. Security Model 1: Bell-LaPadula Model
CCM 4350 Lecture 12 Security Model 1: Bell-LaPadula Model Why Security Models? When we have implemented a security policy, do we know that it will (and can) be enforced? E.g., if policies get too intricate,
Access control models and policies
Access control models and policies Tuomas Aura T-110.4206 Information security technology Aalto University, autumn 2013 1. Access control 2. Discretionary AC 3. Mandatory AC 4. Other AC models Outline
PRIMA: Policy-Reduced Integrity Measurement Architecture
PRIMA: Policy-Reduced Integrity Measurement Architecture Trent Jaeger tjaeger@cse.psu.edu Pennsylvania State University University Park, PA 16802 Reiner Sailer sailer@us.ibm.com IBM T. J. Watson Research
Access control models and policies
Access control models and policies Tuomas Aura T-110.4206 Information security technology Aalto University, autumn 2011 1. Access control 2. Discretionary AC 3. Mandatory AC 4. Other AC models Outline
Access Control. Discretionary Access Control
Access Control Discretionary Access Control 1 Outlines Access Control Discretionary Access Control (DAC) Mandatory Access Control (MAC) Role-Based Access Control (RBAC) 2 Access Control Access control
Discretionary Vs. Mandatory
Discretionary Vs. Mandatory Discretionary access controls (DAC) Privilege propagated from one subject to another Possession of an access right is sufficient to access the object Mandatory access controls
Transforming Commodity Security Policies to Enforce Clark-Wilson Integrity
Transforming Commodity Security Policies to Enforce Clark-Wilson Integrity Divya Muthukumaran Pennsylvania State University muthukum@cse.psu.edu Hayawardh Vijayakumar Pennsylvania State University hvijay@cse.psu.edu
Wrapup. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger.
Wrapup CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ Final 2 The final is on Tuesday, May 8, 8:00 in 160 Willard (here) Be late
Security Models Trusted Zones SPRING 2018: GANG WANG
Security Models Trusted Zones SPRING 2018: GANG WANG Access Control Slides credit to Ethan L. Miller and Scott A. Brandt Protection Domains Three protection domains Each lists objects with permitted operations
Policy, Models, and Trust
Policy, Models, and Trust 1 Security Policy A security policy is a well-defined set of rules that include the following: Subjects: the agents who interact with the system, Objects:the informational and
Last time. Security Policies and Models. Trusted Operating System Design. Bell La-Padula and Biba Security Models Information Flow Control
Last time Security Policies and Models Bell La-Padula and Biba Security Models Information Flow Control Trusted Operating System Design Design Elements Security Features 10-1 This time Trusted Operating
CSCI 420: Mobile Application Security. Lecture 7. Prof. Adwait Nadkarni. Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger
CSCI 420: Mobile Application Security Lecture 7 Prof. Adwait Nadkarni Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger 1 cryptography < security Cryptography isn't the solution to
Module: Operating System Security. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Operating System Security Professor Trent Jaeger 1 OS Security So, you have built an operating system that enables user-space processes to
Lecture 5: Integrity Models
CS 591: Introduction to Computer Security Lecture 5: Integrity Models James Hook (Some materials from Bishop, copyright 2004) Last lecture Discussion? Last Lecture Bell LaPadula Confidentiality Lattice
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
CPSC 481/681 SPRING 2006 QUIZ #1 7 MAR 2006 NAME:
CPSC 481/681 SPRING 2006 QUIZ #1 7 MAR 2006 NAME: There are 6 questions on this quiz. Each question is individually weighted. If you do not understand the question, please ask for clarification. 1 I. (24
System design issues
System design issues Systems often have many goals: - Performance, reliability, availability, consistency, scalability, security, versatility, modularity/simplicity Designers face trade-offs: - Availability
Virtual Machine Security
Virtual Machine Security CSE443 - Spring 2012 Introduction to Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ 1 Operating System Quandary Q: What is the primary goal
Towards Formal Evaluation of a High-Assurance Guard
Towards Formal Evaluation of a High-Assurance Guard Mark R. Heckman Roger R. Schell Edwards E. Reed 2012 Layered Assurance Workshop,
Complex Access Control. Steven M. Bellovin September 10,
Complex Access Control Steven M. Bellovin September 10, 2013 1 Access Control Matrix List all proceses and files in a matrix Each row is a process ( subject ) Each column is a file ( object ) Each matrix
Inevitable Failure: The Flawed Trust Assumption in the Cloud
Inevitable Failure: The Flawed Trust Assumption in the Cloud Yuqiong Sun Department of Computer Science and Engineering Pennsylvania State University yus138@cse.psu.edu Giuseppe Petracca Department of
Test Conditions. Closed book, closed notes, no calculator, no laptop just brains 75 minutes. Steven M. Bellovin October 19,
Test Conditions Closed book, closed notes, no calculator, no laptop just brains 75 minutes Steven M. Bellovin October 19, 2005 1 Form 8 questions I m not asking you to write programs or even pseudo-code
Computer Security. Access control. 5 October 2017
Computer Security Access control 5 October 2017 Policy and mechanism A security policy is a statement of what is, and what is not, allowed. A security mechanism is a method, tool or procedure for enforcing
Access Control. CMPSC Spring 2012 Introduction Computer and Network Security Professor Jaeger.
Access Control CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Access Control Describe the permissions available to computing processes
IBM Research Report. PRIMA: Policy-Reduced Integrity Measurement Architecture. Trent Jaeger Pennsylvania State University
RC23898 (W0603-030) March 3, 2006 Computer Science IBM Research Report PRIMA: Policy-Reduced Integrity Measurement Architecture Trent Jaeger Pennsylvania State University Reiner Sailer IBM Research Division
CSE 544 Advanced Systems Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CSE 544 Advanced Systems
Key Management. Digital signatures: classical and public key Classic and Public Key exchange. Handwritten Signature
Key Management Digital signatures: classical and public key Classic and Public Key exchange 1 Handwritten Signature Used everyday in a letter, on a check, sign a contract A signature on a signed paper
The Evolution of Secure Operating Systems
The Evolution of Secure Operating Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Operating Systems
CSE543 - Introduction to Computer and Network Security. Module: Operating System Security
CSE543 - Introduction to Computer and Network Security Module: Operating System Security Professor Trent Jaeger 1 OS Security An secure OS should provide (at least) the following mechanisms Memory protection
DAC vs. MAC. Bell-Lapadula model. Security levels. Security properties. The lattice model top-secret, {Nuclear, Crypto} Straw man MAC implementation
DAC vs. MAC Most people familiar with discretionary access control (DAC) - Unix permission bits are an example - Might set a fileprivate so only groupfriends can read it Discretionary means anyone with
Module: Future of Secure Programming
Module: Future of Secure Programming Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Programmer s Little Survey Problem What does program for
Trusted OS Design CS461/ECE422
Trusted OS Design CS461/ECE422 1 Reading Material Section 5.4 of Security in Computing 2 Design Principles Security Features Kernelized Design Virtualization Overview 3 Design Principles Simplicity Less
Operating System Security: Building Secure Distributed Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Operating System Security:
Module: Future of Secure Programming
Module: Future of Secure Programming Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Programmer s Little Survey Problem What does program for
Summary. Final Week. CNT-4403: 21.April
Summary Final Week CNT-4403: 21.April.2015 1 List of Final Topics User Authentication Protocols Key Distribution and Public Key Certificates Symmetric Key Crypto Access Control Public Key Crypto Cryptographic
CMPSC 497 Attack Surface
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Attack Surface
Lecture Embedded System Security Introduction to Trusted Computing
1 Lecture Embedded System Security Prof. Dr.-Ing. Ahmad-Reza Sadeghi System Security Lab Technische Universität Darmstadt (CASED) Summer Term 2015 Roadmap: Trusted Computing Motivation Notion of trust
SELinux Protected Paths Revisited
SELinux Protected Paths Revisited Trent Jaeger Department of Computer Science and Engineering Pennsylvania State University March 1, 2006 1 Talk Topics Mechanism for MAC enforcement between 2 machines
Access Control Mechanisms
Access Control Mechanisms Week 11 P&P: Ch 4.5, 5.2, 5.3 CNT-4403: 26.March.2015 1 In this lecture Access matrix model Access control lists versus Capabilities Role Based Access Control File Protection
Protection. CSE473 - Spring Professor Jaeger. CSE473 Operating Systems - Spring Professor Jaeger
Protection CSE473 - Spring 2008 Professor Jaeger www.cse.psu.edu/~tjaeger/cse473-s08/ Protection Protect yourself from untrustworthy users in a common space They may try to access your resources Or modify
Advanced Systems Security: Future
Advanced Systems Security: Future Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Penn State University 1 Privilege Separation Has been promoted for some time Software-Fault Isolation
A Survey of Access Control Policies. Amanda Crowell
A Survey of Access Control Policies Amanda Crowell What is Access Control? Policies and mechanisms that determine how data and resources can be accessed on a system. The Players Subjects Objects Semi-objects
Access Control Models
Access Control Models Dr. Natarajan Meghanathan Associate Professor of Computer Science Jackson State University E-mail: natarajan.meghanathan@jsums.edu Access Control Models Access Control to regulate
Chapter 7: Hybrid Policies
Chapter 7: Hybrid Policies Overview Chinese Wall Model Clinical Information Systems Security Policy ORCON RBAC Slide #7-1 Overview Chinese Wall Model Focuses on conflict of interest CISS Policy Combines
Last time. User Authentication. Security Policies and Models. Beyond passwords Biometrics
Last time User Authentication Beyond passwords Biometrics Security Policies and Models Trusted Operating Systems and Software Military and Commercial Security Policies 9-1 This time Security Policies and
STING: Finding Name Resolution Vulnerabilities in Programs
STING: Finding Name Resolution ulnerabilities in Programs Hayawardh ijayakumar, Joshua Schiffman, Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department
Operating System Security. Access control for memory Access control for files, BLP model Access control in Linux file systems (read on your own)
Operating System Security Access control for memory Access control for files, BLP model Access control in Linux file systems (read on your own) Hw1 grades out this Friday Announcement Travel: out of town
Outline. V Computer Systems Organization II (Honors) (Introductory Operating Systems) Language-based Protection: Solution
Outline V22.0202-001 Computer Systems Organization II (Honors) (Introductory Operating Systems) Lecture 21 Language-Based Protection Security April 29, 2002 Announcements Lab 6 due back on May 6th Final
Multics C H A P T E R MULTICS HISTORY
C H A P T E R 3 Multics In this chapter, we examine the first modern operating system, the Multics system [62]. Multics was a large, long-term operating system project where many of our fundamental operating
Security Enhanced Linux
Security Enhanced Linux Security Group Meeting 29 November 2002 Steven J. Murdoch http://www.cl.cam.ac.uk/users/sjm217/ Computer Laboratory, University of Cambridge Copyright c Steven. J. Murdoch p.1 Summary
Justifying Integrity Using a Virtual Machine Verifier
Justifying Integrity Using a Virtual Machine Verifier Abstract Emerging distributing computing architectures, such as grid and cloud computing, depend on the high integrity execution of each system in
Multifactor authentication:
Multifactor authentication: Authenticating people can be based on 2 factors: Something the user KNOWS : e.g. a password or PIN Something the user HAS: e.g. An ATM card, smartcard or hardware token, or
P1L5 Access Control. Controlling Accesses to Resources
P1L5 Access Control Controlling Accesses to Resources TCB sees a request for a resource, how does it decide whether it should be granted? Authentication establishes the source of a request Authorization
Static Analysis. Systems and Internet Infrastructure Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Static Analysis Trent
Advanced Systems Security: Security-Enhanced Linux
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Introduction to Security and User Authentication
Introduction to Security and User Authentication Brad Karp UCL Computer Science CS GZ03 / M030 14 th November 2016 Topics We ll Cover User login authentication (local and remote) Cryptographic primitives,
Computer Security Operating System Security & Access Control. Dr Chris Willcocks
Computer Security Operating System Security & Access Control Dr Chris Willcocks Lecture Content Access Control ACMs ACLs Introduction to *NIX security - we ll cover this more due to server popularity -
DAC vs. MAC. Most people familiar with discretionary access control (DAC)
p. 1/1 DAC vs. MAC Most people familiar with discretionary access control (DAC) - Example: Unix user-group-other permission bits - Might set a fileprivate so only groupfriends can read it Discretionary
Identity, Authentication and Authorization. John Slankas
Identity, Authentication and Authorization John Slankas jbslanka@ncsu.edu Identity Who or what a person or thing is; a distinct impression of a single person or thing presented to or perceived by others;
Security and Privacy in Computer Systems. Lecture 7 The Kerberos authentication system. Security policy, security models, trust Access control models
CS 645 Security and Privacy in Computer Systems Lecture 7 The Kerberos authentication system Last Week Security policy, security models, trust Access control models The Bell-La Padula (BLP) model The Biba
Access Control CSC WAKE FOREST. U N I V E R S I T Y Department of Computer Science. Fall 2014
Access Control CSC 348 648 WAKE FOREST U N I V E R S I T Y Department of Computer Science Fall 2014 Attempted Topics Describe language/models for talking about security systems ACM, Capabilities and ACLs
Module: Cloud Computing Security
Module: Computing Security Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Computing Is Here Systems and Internet Infrastructure Security (SIIS)
SELinux. Don Porter CSE 506
SELinux Don Porter CSE 506 MAC vs. DAC By default, Unix/Linux provides Discretionary Access Control The user (subject) has discretion to set security policies (or not) Example: I may chmod o+a the file
Access Control (slides based Ch. 4 Gollmann)
Access Control (slides based Ch. 4 Gollmann) Preliminary Remarks Computer systems and their use have changed over the last three decades. Traditional multi-user systems provide generic services to their
Chapter 9: Key Management
Chapter 9: Key Management Session and Interchange Keys Key Exchange Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #9-1 Overview Key exchange Session vs. interchange
Access control. Frank Piessens KATHOLIEKE UNIVERSITEIT LEUVEN
Access control Frank Piessens (Frank.Piessens@cs.kuleuven.be) Secappdev 2013 1 Overview Introduction: Lampson s model for access control Classical User Access Control Models Discretionary Access Control
Computer Security 3e. Dieter Gollmann. Chapter 5: 1
Computer Security 3e Dieter Gollmann www.wiley.com/college/gollmann Chapter 5: 1 Chapter 5: Access Control Chapter 5: 2 Introduction Access control: who is allowed to do what? Traditionally, who is a person.