Part 4 - Security Models and Access Control Models
Video Activity
This lesson covers security models and access control models. A security model dictates how a system will explore security policy. Three common security models covered in this unit include: • Bell-LaPadula: designed for US Government Systems that protect state secrets; it is designed to protect CONFIDENTIALITY. • Biba: designed to protect the INTEG...
Time
5 hours 54 minutes
Difficulty
Intermediate
CEU/CPE
6
Video Description
This lesson covers security models and access control models. A security model dictates how a system will explore security policy. Three common security models covered in this unit include: • Bell-LaPadula: designed for US Government Systems that protect state secrets; it is designed to protect CONFIDENTIALITY. • Biba: designed to protect the INTEGRITY of the knowledge base. • Clark-Wilson: Don't allow untrusted users to directly access your trusted resource of they'll break them. Instead, form them to access resources through a trusted interface. Access Control models covered in this unit are: • Discretionary access control (DAC): security of an object is at the owner's discretion. • Mandatory Access control (MAC): More secure than DAC as data owners cannot grant access • Role based access control (RBAC): The owner of an object does not control access. Each role has a set of fights and permission which cannot be changed unless a security administrator is involved.
Video Transcription
00:03
So we've arrived at the security models and there are many different security models that provide for us an architecture in which to design our systems so we could base our architecture on the security models dependent on what type of security mechanisms were trying to
00:23
implement into
00:24
the system that we're building. These are just a couple of them. And honestly, I really don't anticipate questions on the exam on these. Having taken the C. I. S s P exam, he will have seen these models. But if you haven't taken that exam, you may not have heard of them.
00:41
The bottom line is they're models out there that provide us a structure for implementing certain elements of security
00:49
into a system. One of the better known ones is called the Bel Lapa Djula model. And each of these models were made up of a series of rules. Now, the bell, a popular model, is all about confidentiality, and most people find that Bella Padula makes the most sense
01:07
now. This was designed for the US government in order to protect state
01:11
secrets. So obviously confidentiality is gonna be the main purpose of Bella Podgy.
01:19
There are three basic rules of Delta Padula, and there are some other rules as well. There's a lot of, um,
01:26
there's a lot of periphery information to Bella postulate that we're not going to go over. We're just gonna kind of hit the heart and so love it. But again, for test prep, I wouldn't spend a lot of time here. But having heard of Bella pasta and knowing its essence, I think is always beneficial. So basically, Bell apostles about
01:46
protecting confidentiality.
01:48
So the first rule is called the Simple Security Property
01:52
and the simple security property says no read up,
01:56
meaning. If I've got secret clearance, I can't read top secret information
02:00
Now that's very much what we would expect, right? You wouldn't expect to be able to read above your boundaries. And that's what the simple security property says Now, The reason that we excuse me, I'm going back out there. The reason we expect that is because we're used to working environments than enforced confidentiality, and we'll see that their other environments
02:21
that may not do the same thing.
02:23
All right, the star security property that could also be used is basically says no right down.
02:32
Okay, No right down. And what that does is that keeps me at top secret from writing top secret files down to a secret folder. So no right down. That's way of preventing someone in upper level from leaking secrets down below.
02:49
All right now, um, the final property or room is called the Strong Star Property, and the strong Star Property says, Stay where you are
03:00
no read or right up or down
03:05
now. Like I said, Bella popular tends to make sense the most people, because we're used to working in confidential environments. Now Bella popular makes sense. Great. Let's take it and flip it on its head. And that's where we get Deva. And usually Debra doesn't make a lot of sense to people. And yet, unless you have a little more explanation,
03:23
the big thing about Biber is that its goal is totally different than Bella, Pa. Jules,
03:29
it's goal is integrity.
03:31
We're gonna enforce the integrity of the system rather than the confidentiality. We're worried about the integrity of our death. So there are three words that kind of sum up with the FIBA integrity model states, and it's something up by down Dabbas, Dirty
03:51
down Dad is dirty.
03:53
So when you look at the rules of Tiba down, that is dirty. The first rule, this simple integrity acts him, says no Reed down.
04:04
Why no read down? Because reading down is untrusted. Information at a lower level is not as trustworthy is information at a higher level.
04:16
All right, so no reed down
04:18
thes star integrity Axiom says no right up
04:23
again. You shouldn't be colluding the knowledge base. So if I have a lower level of intelligence, I shouldn't be writing to files that are top secret or secret design. We not have the legitimate information there. So it's all about protecting the integrity of the data, keeping the data for staying, keeping it
04:43
accurate,
04:44
ensuring its integrity. Remember, the phrase down data is dirty. Now the invocation property is pretty close to what the strong star property waas with Bella popular then vacation property, says no read or right up or down. So essentially,
05:01
and actually let me back up on that. It's really no reader right
05:05
up. It does not enforce what you could do down lives. So I misspoke. No reader right up.
05:14
Okay, So those air two models for use in very specific environments for use in the government. Bella, Pa. Chose about protecting government secrets. Bimba is about protecting the integrity and the sanctity of the death.
05:29
Now the first commercial model. Ah, and one of the most important ones. And you'll see Clark Wilson all over the place in the world and systems in life. Whatever.
05:41
Now I'm gonna give you just a cheapie definition for Clark Wilson. Then I will say it more eloquently. Ah, the cheapie definition for Clark Wilson is. Keep users out of your stuff or they'll break it.
05:57
Keep users out of your stuff or they'll break it.
06:00
I think about when I get to make a purchase on Amazon. For instance, when I go and purchase, uh, you know, I go and purchase a book. That book needs to come out of Amazon's inventory. They're sending me that book.
06:14
The same was on. Give me the password to log into their database so that I can remove that book from their inventory. Of course not. You know why I'll mess it up.
06:24
So what does Amos on do they give me a front end application that I can use? I interface? I I used the interface. The interface access is the back end database. So basically a better way or more eloquent way of describing Clark Wilson
06:43
is that Clark Wilson
06:45
enforces well formed transactions
06:48
through the use of the Access Triple
06:53
Clark Wilson and forces well formed transactions through the use of the access triple
06:58
and the access triple. Is the user
07:01
the interface in the back end database or data item that we want to protect? Okay, those three elements or Clark Wilson?
07:11
Long story short. What Clark Wilson says is Keep what you want to protect. Your trusted resource is away from untrusted elements. Cheap applications away from directly accessing memory.
07:26
But applications need access. Memory. That's fine fortune through an interface. If you're familiar with something called an AP on an application programming interface, that's exactly the purpose is to provide that safe. You know, middle man, if you will, from the untrusted apt to the trusted,
07:45
uh, resource of memory.
07:46
But you'll see this in the world is well, you know, if I'm a brand new bank teller and I just get a deposit for $10,000 well, that money needs to go in the safe. It shouldn't be sitting here in my drawer, but as a brand new bank teller, I don't have a key
08:03
to get into the safe. So what do I do? I take this money and give it to my, uh, bank manager.
08:09
The bank manager accesses the safe.
08:11
The bank manager is our trusted into
08:16
eyes, the teller among trusted.
08:18
Okay, So keep an untrusted teller out of your safe,
08:24
forced all interaction with the safe to go through an interface, the bank teller
08:28
and you can see how that separation of duties it's about preventing conflict of interest. It's about preventing any sort of abuse of power. That's what the Clark Wilson model does for it. It's very, very helpful
08:43
now. There are many other security models on which systems can be designed, but I just wanted to mention those three because those are three of the most commonly used Bella popular, which address his confidentiality ***, which is all about integrity, and then Clark Wilson, which creates well formed transactions
09:03
now our access control models. This is another element of system design, and we have to think about the degree of security. We want our system to provide
09:13
some systems are designed to be more user friendly and to promote sharing other systems or more designed to protect confidentiality of information. Um, S O, the first system that will look at is called a dak system. A discretionary access control system. This is what your Windows system would be.
09:31
Excuse me there. This is what your Windows systems would be and really, any client based operating systems would be Dax Systems. And when we say dak discretionary access control
09:45
and the reason it's called, that is the security of the object is based on the discretion of the objects owner.
09:52
So any time you talk about discretionary security, that could be a little concerning.
09:58
But the idea is it's designed for an environment to promote sharing in these of use. So think about a window's environment when I create a folder and I'll call that folder Mine.
10:09
Who's Folder? Is it me
10:11
who does it belong to me
10:13
who could do whatever they want with it? Meat. I am the owner.
10:16
Well, could I give permission to that folder to somebody that shouldn't have access to what's in the folder? Sure, it's at my discretion
10:24
and through the use of access control lists are how we control access in Adak model. So the heart and soul of Adak environment is the access control list, which is why sometimes you'll hear them referred to as Dacca. Lt's discretionary access control list.
10:41
Because these air primarily used in dak environments.
10:46
Now this is an identity. Excuse me, an identity based system. So you're given a user account based on your identity, who you are. You know you can account Kelly H. Or K Hander Hand or John Smith or whatever that might be, and the user account is bound to you and your identity.
11:05
Now, that being said, um, you know, again think about how Windows is established and created, how you get your account. Ah, how we control access to resource is, but it's not just Windows. You know. Most versions of Lynn Nix and UNIX and any of the other operating systems that are out there
11:24
primarily used dec environment.
11:28
However, if you want a more secure environment, you have a mandatory access control model, a Mac, and just listening to the names mandatory security versus discretionary security night and day, right mandatory sounds much more secure
11:45
now. You would see this on systems for use in the government or systems that need to enforce. Ah, higher level of confidentiality, the heart and soul of a Mac environment, the heart and soul here labels.
11:58
So when I create a user object in a Mac environment, they get a label.
12:03
And so I'll create Bob Smith and his label is secret because he has secret clearance.
12:09
Then I'll create a folder, and the label for that folder is top secret.
12:15
So we don't expect somebody that has secret clearance to access a top secret folder.
12:20
So the decision as to access in a mandatory access control environment is made based on, um, evaluating the labels and the objects label. Or let me say this. The subject's label must dominate the objects like
12:39
so I can't access anything above my level. I can access at my level and below. I have to dominate.
12:45
But the big difference here is this is all decided by the data owner. You know what type of classification the data is, and it's enforced by the data custodian or the Security Department.
12:58
So ultimately, these labels are written in stone, so to speak, they can't be changed. without a very formalized, very stringent process. And it's the operating system that compares the labels and makes the decision. So this is much more secure.
13:13
So ah, secure Lennox, Or you might see Solaris with trusted extensions. Those would be Mac environments.
13:20
Now, another environment that tends to be a very good environment to, um, uh, enforce rights and permissions role based access control. You might see this is our back, because in an organization, one of the problems we can have something called Privilege Creeps.
13:41
So, for instance, if I'm a custodian and I work in building A I get a key to building a,
13:46
then I go to building B. I get a key to building B.
13:50
I start work in building C. I get a key to building C.
13:54
But what piece have we missed along the lines? We've missed getting those keys to building A and B back
14:01
same thing when you have users in an environment. So I'm the database administrator of database A. When they move me to a different role, we need to make sure that my credentials get revoked. Well, instead of doing that, one of the things that we can do is use role based access control
14:18
as opposed to identity based access control, which DAK is
14:22
in a role based system. The accounts are based on function within the organization.
14:28
So with that function come a set of privileges and permissions, and they can't be changed.
14:35
This is a good way to prevent a problem called Authorization Creek,
14:41
because your account is based on your role within the organization and the account doesn't change. Permissions and privileges don't get added removed.
14:50
You might be given a new role in the organization, therefore a new role account, but you wouldn't have rights and permissions heaped on the user based accounts. So those are the three main security models, DAK, which the securities at the discretion of the owner
15:05
Mac Ah, higher level of security, where security decisions are made based on labels and then our back, which is based on the role of a user within an organization. And this is a good means to provide high end tight security as well as preventing authorization creep. So those were the security models
15:24
that I would consider when I'm designing a system
Up Next
ISC2 Certified Secure Software Life-cycle Professional (CSSLP)
This course helps professionals in the industry build their credentials to advance within their organization, allowing them to learn valuable managerial skills as well as how to apply the best practices to keep organizations systems running well.
Instructed By
Similar Content
