Outline for February 5, 2003

Discussion Problem

We discussed the Bell-LaPadula Model, and noted that subjects could read and write objects only if the subjects were in the same compartment as objects. This leads to a notion of confinement, and raises the issue of leaking information among compartments. Such leakage led one security expert to speculate that, as the need for secure computing continued to climb, people would gradually shift from multi-user computing systems to single-user computer systems, because then information could not leak among compartments (as there are no other processes on the system to leak information to).

1. How do single-user systems connected by a network (such as the Internet) differ from multi-user systems?
2. Do you agree or disagree with the expert?

Outline for the Day

1. DG/UX B2 UNIX System
   1. Hierarchy of levels
   2. Labels, explicit and implicit
   3. MAC tuples
2. Tranquility
   1. Strong tranquility
   2. Weak tranquility
3. Integrity models
   1. Requirements
      1. Users won't write their own programs, but will use existing programs, databases, etc.
      2. Programmers develop and test programs on non-production systems
      3. Installing a program from the development system requires a special process
      4. This process must be controlled and auditable
      5. System managers must be able to access the system state and the system logs
   2. Separation of duty
   3. Separation of function
   4. Auditing
4. Biba: mathematical dual of BLP
   1. P may read O if L(P) ≤ L(O) and C(P) ⊆ C(O)
   2. P may write O if L(O) ≤ L(P) and C(O) ⊆ C(P)
   3. Combined with BLP: continue example