Cissp: Security Models

Front 1

state machine

Back 1

This model describes the subjects, objects, and sequences in a system. The focus of this model is to capture the system's state and ensure its security.

Front 2

Bell-LaPadula

Back 2

Is a formal security model, is the mathematical model of a multilevel security policy. This model uses a lattice of security levels to determine whether a subject can access an object, based on the security clearance of the subject.
The goal of the security model is to prevent unauthorized access to information.

Front 3

simple security rule

Back 3

also known as the no read up rule – states that a subject can't read data from a security level higher than the subject's security level

Front 4

*-property

Back 4

the no write down rule – states that a subject can't write data to a security level lower than the subject's security level

Front 5

strong star property

Back 5

rule states that a subject with read/write capabilities can perform read/write functions only at the subject's security level

Front 6

Harrison-Ruzzo-Ullman

Back 6

This model is similar to the Graham-Denning model and is made up of generic rights and a small set of commands.
Where it is different from the Graham-Denning model is in its concern with situations where subjects have to be prevented from gaining specific privileges.

Front 7

Biba

Back 7

formal security model, uses a lattice of integrity levels. It's used most by commercial organizations for which the integrity of data is more important than data confidentiality.
The goal of this security model is to ensure that data doesn't flow from any integrity level to a higher integrity level. This is to prevent the corruption of data at the higher integrity levels.

Front 8

*-integrity axiom

Back 8

, or no write up rule, specifies that a subject or process can't write data to an object at a higher integrity level

Front 9

simple integrity axiom

Back 9

, or no read down rule, specifies that a subject or process can't read data from a lower integrity level, and

Front 10

invocation

Back 10

this property specifies that a subject can't invoke another subject at a higher integrity level

Front 11

Clark-Wilson

Back 11

is an informal security model that separates data into high protection data called constrained data items, or CDIs, and low protection data called unconstrained data items, or UDIs.
To modify a CDI, the user has to execute a transformation procedure, or TP. To do this, the user requires authentication.

No TP or authentication is required for modifying a UDI.

Front 12

Lipner

Back 12

This model ensures both confidentiality and integrity by combining aspects of the Bell-LaPadula and Biba models with job functions.
It does this in one of two ways – using the confidentiality model of Bell-LaPadula, or using the Biba integrity model and Bell-LaPadula.

Front 13

access control matrix

Back 13

security model. It consists of a matrix, with subjects in rows, objects in columns, and the access right of each subject recorded as an entry within the resulting grid.

Front 14

Brewer & Nash

Back 14

– also known as the Chinese Wall security model – provides access controls that change dynamically according to the user's previous actions, access requests, and authorizations.

The goal of this model is to prevent conflicts of interest from occurring because of a user's access attempts. To achieve this, it allows a subject to write to an object only if the subject can't read another object in another dataset.

Front 15

Graham-Denning

Back 15

In this model, each subject is composed of a process and a domain, which is the set of rights, or constraints, controlling how the subject may access and manipulate objects. Subjects may also be objects at specific times. This model defines the commands that a subject can execute to securely create and delete an object, create and delete a subject, and provide read, grant, delete, and transfer access rights.

This model offers advantages over the Bell-LaPadula and Biba models by defining and modifying security and integrity ratings, and by protecting the transfer of the access rights process.

Front 16

information flow

Back 16

This security model compartmentalizes data based on classification and the need to know. To access an object, a subject's clearance should dominate the object's classification and specify the need to know.

The goal of this model is to prevent the existence of covert channels in a system and so to secure the flow of information. The model also ensures that information always flows from a low security level to a high security level, and from a high integrity level to a low integrity level. A disadvantage is that controlling and securing the flow of information within a system is a complex task.

Front 17

Lattice

Back 17

This security model consists of a set of objects constrained between the least upper bound and greatest lower bound values. The least upper bound is the value that defines the lowest level of object access rights granted to a subject. The greatest lower bound is the value that defines the maximum level of object access rights granted to a subject.

The goal of this model is to protect the confidentiality of an object and to allow access to it only by an authorized subject.

Front 18

Noninterference

Back 18

This security model ensures that actions at higher security levels don't interfere with the actions at lower security levels. This helps ensure that data doesn't pass through covert or timing channels.

This model prevents covert channel and interference attacks. Interference attacks occur when the security level of data changes to a higher security level after a person has accessed data while the data was at the lower security level. A disadvantage of the model is that it's complex and difficult to design.