Showing posts with label Integrity Model. Show all posts
Showing posts with label Integrity Model. Show all posts
Saturday, January 11, 2014
Comparison
With Requirements
•
Users can’t certify TPs, so CR5
and ER4 enforce this
•
Procedural, so model doesn’t
directly cover it; but special process corresponds to using TP
•
No technical controls can prevent
programmer from developing program on production system; usual control is to
delete software tools
•
New program UDI before
certification, CDI (and TP) after
•
Log is CDI, so appropriate TP can
provide managers, auditors access
•
Access to state handled similarly
Comparison to
Biba
• Biba
– No
notion of certification rules; trusted subjects ensure actions obey rules
– Untrusted
data examined before being made trusted
• Clark-Wilson
– Explicit
requirements that actions must meet
– Trusted
entity must certify method to upgrade untrusted data (and not certify
the data itself)
Key Points
• Integrity
policies deal with trust
– As
trust is hard to quantify, these policies are hard to evaluate completely
– Look
for assumptions and trusted users to find possible weak points in their
implementation
• Biba
based on multilevel integrity
• Clark-Wilson
focuses on separation of duty and transactions
Users and
Rules
CR3 The allowed relations must meet the
requirements imposed by the principle of separation of duty.
ER3 The system must authenticate each user
attempting to execute a TP
– Type
of authentication undefined, and depends on the instantiation
– Authentication
not required before use of the system, but is required before
manipulation of CDIs (requires using TPs)
Logging
CR4 All TPs must append enough information to
reconstruct the operation to an append-only CDI.
– This
CDI is the log
– Auditor
needs to be able to determine what happened during reviews of transactions
Handling
Untrusted Input
CR5 Any TP that takes as input a UDI may
perform only valid transformations, or no transformations, for all possible
values of the UDI. The transformation either rejects the UDI or transforms it
into a CDI.
– In
bank, numbers entered at keyboard are UDIs, so cannot be input to TPs. TPs must
validate numbers (to make them a CDI) before using them; if validation fails,
TP rejects UDI
Separation of
Duty In Model
ER4 Only the certifier of a TP may change the
list of entities associated with that TP. No certifier of a TP, or of an entity
associated with that TP, may ever have execute permission with respect to that
entity.
Enforces separation of duty with respect to
certified and allowed relations
Subscribe to:
Posts (Atom)