Biba’s Model

•      Similar to Bell-LaPadula model

–           s Î S can read o Î O iff i(s) ¡Â i(o)

–           s Î S can write to o Î O iff i(o) ¡Â i(s)

–           s₁ Î S can execute s₂ Î S iff i(s₂) ¡Â i(s₁)

•      Add compartments and discretionary controls to get full dual of Bell-LaPadula model

•      Information flow result holds

–          Different proof, though

•      Actually the “strict integrity model” of Biba’s set of models

LOCUS and Biba

•      Goal: prevent untrusted software from altering data or other software

•      Approach: make levels of trust explicit

–    credibility rating based on estimate of software’s trustworthiness (0 untrusted, n highly trusted)

–    trusted file systems contain software with a single credibility level

–    Process has risk level or highest credibility level at which process can execute

–    Must use run-untrusted command to run software at lower credibility level

Chapter 6: Integrity Policies

•      Overview

•      Requirements

•      Biba’s models

•      Clark-Wilson model

Overview

•      Requirements

–   Very different than confidentiality policies

•      Biba’s model

•      Clark-Wilson model

Requirements of Policies

•              Users will not write their own programs, but will use existing production programs and databases.

•              Programmers will develop and test programs on a non-production system; if they need access to actual data, they will be given production data via a special process, but will use it on their development system.

•              A special process must be followed to install a program from the development system onto the production system.

•              The special process in requirement 3 must be controlled and audited.

•              The managers and auditors must have access to both the system state and the system logs that are generated.