際際滷

際際滷Share a Scribd company logo

Lecture two

Download as PPT, PDF
Ayebazibwe Kenneth
Ayebazibwe Kenneth

This document summarizes a lecture on the history of computer security and policy. It discusses how security evolved from protecting physical documents and media during batch computing to addressing networked systems and new threats. A key report by James Anderson identified emerging issues like time-sharing, communication, and networking. It also examines the development of security research and guidance from the Department of Defense in the 1970s and 1980s.

1 of 42
Download to read offline
CS 591: Introduction to Computer Security Lecture 3: History and Policy By Kenneth Ayebazibwe Saturday, February 09, 2013
Military Security Protection of information has been part of warfare throughout recoded history World War II and the Cold War led to a common protective marking scheme for documents [Ross Anderson; 7.3.1] Top Secret Secret Confidential Open 02/09/13 08:11
Batch Computing Early computers were simple, small machines, with little persistent state To run a job for a user, an operator would: Mount the removable media (disks and tapes) requested by the user Completely initialize the computer by pressing an Initial Program Load button that read the boot loader from the card deck supplied by the user Execute the operating system loaded by the boot loader, found on the removable media 02/09/13 08:11
Secure batch computing To make this style of batch computing secure it was only necessary to focus on the physical security of the room, insure that the state was initialized, and handle all removable media according to the rules for handling classified documents 02/09/13 08:11
Cold War Computing The cold war relied on aircraft capable of dropping nuclear bombs Aircraft need to know about weather Global weather prediction was one of the most important computational tasks in the cold war 02/09/13 08:11
Computer Communicate Weather prediction needs input from weather stations The batch model of military computing had to be abandoned The security perimeter of the weather prediction system was no longer the computer room 02/09/13 08:11
Practice beyond Policy The weather system evolved to collect data from around the globe and give reports to pilots at Strategic Air Command centers Recognizing that this practice was outside of policy doctrine, the Air Force commissioned a study on Computer Security James P. Anderson wrote the report: Computer Security Technology Planning Study (1972) 02/09/13 08:11
Andersons study Forward looking study focused on driving forces: Time shared computing Communication and Networking 02/09/13 08:11
Andersons study QuickTime and a decompressor are needed to see this picture. QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
Anderson on networks QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
The Insider Threat QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
The Handbook QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
DoD Security Research With publication of Andersons report significant research funds were allocated to Computer Security Two goals: Solve aspects of the Security Problem as articulated by Anderson Give guidance to military procurement officers on how to acquire secure computing systems 02/09/13 08:11
DoD Research dominates 70s Although not all security challenges were related to defense, defense sponsored research dominates publications in 70s and 80s In that period Confidentiality was stressed The neglect of Availability would bite on September 11, 2001 02/09/13 08:11
Policy 02/09/13 08:11
Objectives Explore what a security policy is; develop a vocabulary to discuss policies Examine the role of trust in policy 02/09/13 08:11
What is a Security Policy? Statement that articulates the security goal In the state machine model it identifies the authorized or secure states (which are distinct from the unauthorized or nonsecure states) A secure system is one in which the system can only enter authorized states Note: The policy doesnt make the system secure; it defines what secure is 02/09/13 08:11
Confidentiality X: set of entities I: some information I has the property of confidentiality with respect to X if no member of X can obtain information about I What is information? 02/09/13 08:11
Confidentiality Scenario If an instructor wishes to keep class grades confidential from the students which of the following can the instructor do? Email the grade file to the class mailing list Email an encrypted grade file to the class mailing list Email summary statistics (mean, median, max, and min) to the class mailing list What is information? What is data? 02/09/13 08:11
Integrity Bishop: X, I as before I has the property of integrity with respect to X if all members of X trust I Dictionary (http://www.m-w.com/dictionary/integrity) 1 : firm adherence to a code of especially moral or artistic values : INCORRUPTIBILITY 2 : an unimpaired condition : SOUNDNESS 3 : the quality or state of being complete or undivided : COMPLETENESS 02/09/13 08:11
Integrity If Alice and Bob trust their horoscopes do horoscopes have integrity? If the users of a system trust the file system does it have integrity? Is it reasonable for integrity to be based on user perception? If the public loses confidence in voting machines can even a perfect DRE machine have integrity? 02/09/13 08:11
Assurance Assurance aims to provide intrinsic evidence of integrity We trust the integrity of the bank because we intrinsically trust the accounting practices used by banks We also trust the bank because The bank is audited for compliance with these trusted practices The banks data is scrutinized for signatures of fraud 02/09/13 08:11
Integrity Although we may desire an intrinsic notion of integrity we must accept the perception of trust in the general case If we do not have intrinsic assurance the best we can demand is that no agent can refute integrity 02/09/13 08:11
Availability Let X be a set of entities, I a resource I has the property of availability with respect to X if all members of X can access I What is access? Quality of service is not always binary 02/09/13 08:11
Setting the bar on access Organizational context is critical For a person, access sufficient to perform their job function Avionics system: micro-/milli second (some military airframes are aerodynamically unstable; avionics system is required to keep them in the air) Air Traffic control: 100s of milliseconds Airline reservations: 10s of seconds [These numbers are notional] 02/09/13 08:11
Access and Quality of Service Behavior of service under load may be important Graceful degradation QoS threshold When is it better to do a few things quickly than all things slowly? 02/09/13 08:11
Dimensions of Policy Policy defines security objective: Confidentiality: Protect Information and Resources I from X Integrity: in a manner trusted by Y Availability: to be accessible to Z Mechanisms can be evaluated to determine if they help meet the objective 02/09/13 08:11
Does this model match reality? Recall PSU AUP What facets focus on Confidentiality: what is I? who/what is X? Integrity: I? X? Availability: I? X? What facets are outside of this model? 02/09/13 08:11
PSU Computer & Network Acceptable Use Policy This acceptable use policy governs the use of computers and networks at Portland State University (PSU). As a user of these resources, you are responsible for reading and understanding this document. Portland State University encourages the use and application of information technologies to support the research, instruction, and public service mission of the institution. PSU computers and networks can provide access to resources on and off campus, as well as the ability to communicate with other users worldwide. Such open access is a privilege and requires that individual users act responsibly. Users must respect the rights of other users, respect the integrity of systems and related physical resources, and observe all relevant laws, regulations, and contractual obligations. 02/09/13 08:11
PSU AUP (cont) Acceptable use terms and conditions: The primary purpose of electronic systems and communications resources is for University-related activities only. Users do not own accounts on University computers, but are granted the privilege of exclusive use. Users may not share their accounts with others, and must keep account passwords confidential. Each account granted on a University system is the responsibility of the individual who applies for the account. Groups seeking accounts must select an individual with responsibility for accounts that represent groups. The University cannot guarantee that messages or files are private or secure. The University may monitor and record usage to enforce its policies and may use information gained in this way in disciplinary and criminal proceedings. Users must adhere strictly to licensing agreements and copyright laws that govern all material accessed or stored using PSU computers and networks. When accessing remote systems from PSU systems, users are responsible for obeying the policies set forth herein as well as the policies of other organizations. Misuse of University computing, networking, or information resources may result in the immediate loss of computing and/or network access. Any violation of this policy or local, state, or federal laws may be referred to appropriate University offices and/or, as appropriate, law enforcement authorities. 02/09/13 08:11
PSU AUP (cont) Conduct which violates this policy includes, but is not limited to the following: Unauthorized attempts to view and/or use another persons accounts, computer files, programs, or data. Using PSU computers, accounts, and/or networks to gain unauthorized access to University systems or other systems. Using PSU computers, accounts, and/or networks for: threat of imminent physical harm, sexual or other harassment, stalking, forgery, fraud, generally offensive conduct, or any criminal activity. Attempting to degrade performance of University computers and/or networks. Attempting to deprive other users of University technology resources or access to systems/networks. Using University resources for commercial activity such as creating products or services for sale. Copying, storing, sharing, installing or distributing software, movies, music, and other materials currently protected by copyright, except as permitted by licensing agreements or fair use laws. Unauthorized mass e-mailings to newsgroups, mailing lists, or individuals, i.e. spamming or propagating electronic chain letters. Unauthorized broadcasting of unsolicited mail, material, or information using University computers/networks. 02/09/13 08:11
Policies and the world What about Obey the law Organizational consequences 02/09/13 08:11
Policy model vs reality Consider password policies (e.g. Sans model policy http://www.sans.org/resources/policies/) What dimension of security do password polices primarily address? 02/09/13 08:11
Policy informed by experience Most organizations have a policy that has evolved Reflects understanding of threat environment (or at least threat history) Can reveal critical assumptions 02/09/13 08:11
Policy vs. Mechanism Policy says what is allowed and what isnt Mechanism is an entity or procedure that enforces some part of the policy Discuss List some mechanisms Facets of policy for which mechanisms are appropriate Facets of policy for which mechanisms are unlikely to be appropriate 02/09/13 08:11
Security Model A security model is a model that represents a particular policy or set of policies Abstracts from the policy We will see various security models: Bell LaPadula for Confidentiality Clark-Willson Integrity Chinese Wall Model 02/09/13 08:11
Families of Policies Military Security Policy (Governmental) Primary goal: confidentiality Commercial Security Policy Primary goal: integrity Common mechanism: transactions; transaction- oriented integrity security policies When you buy a book from Amazon you want to get exactly what you ordered and pay for it exactly once 02/09/13 08:11
Assumptions and Trust All policies have assumptions Typically something is trusted: Hardware will faithfully execute the program Patch is uncorrupted from vendor Vendor tested patch appropriately Vendors environment similar to system being patched Patch is installed correctly 02/09/13 08:11
Trust What are some assumptions of the PSU AUP? The sans password policy? 02/09/13 08:11
Access Control Policies Discretionary Access Control (DAC) An individual user can set allow or deny access to an object Mandatory Access Control (MAC) System mechanism controls access User cannot alter that access Originator Controlled Access Control (ORCON) Access control set by creator of information Owner (if different) cant alter AC Like copyright 02/09/13 08:11
Conclusions Policy declares security goal Policy can be understood in terms of security components: Confidentiality Integrity Availability Policy is based on assumptions about the environment It is critical to understand what entitie the policy trusts 02/09/13 08:11
Looking Forward Bell-LaPadula Model Military style classification of information Confidentiality Reading: Bell retrospective Bishop: Chapter 5 (start 6 as well) RA: Chapter 7 Background What is a lattice? Reading: Chapter 27 02/09/13 08:11

More Related Content

Lecture two

  • 1. CS 591: Introduction to Computer Security Lecture 3: History and Policy By Kenneth Ayebazibwe Saturday, February 09, 2013
  • 2. Military Security Protection of information has been part of warfare throughout recoded history World War II and the Cold War led to a common protective marking scheme for documents [Ross Anderson; 7.3.1] Top Secret Secret Confidential Open 02/09/13 08:11
  • 3. Batch Computing Early computers were simple, small machines, with little persistent state To run a job for a user, an operator would: Mount the removable media (disks and tapes) requested by the user Completely initialize the computer by pressing an Initial Program Load button that read the boot loader from the card deck supplied by the user Execute the operating system loaded by the boot loader, found on the removable media 02/09/13 08:11
  • 4. Secure batch computing To make this style of batch computing secure it was only necessary to focus on the physical security of the room, insure that the state was initialized, and handle all removable media according to the rules for handling classified documents 02/09/13 08:11
  • 5. Cold War Computing The cold war relied on aircraft capable of dropping nuclear bombs Aircraft need to know about weather Global weather prediction was one of the most important computational tasks in the cold war 02/09/13 08:11
  • 6. Computer Communicate Weather prediction needs input from weather stations The batch model of military computing had to be abandoned The security perimeter of the weather prediction system was no longer the computer room 02/09/13 08:11
  • 7. Practice beyond Policy The weather system evolved to collect data from around the globe and give reports to pilots at Strategic Air Command centers Recognizing that this practice was outside of policy doctrine, the Air Force commissioned a study on Computer Security James P. Anderson wrote the report: Computer Security Technology Planning Study (1972) 02/09/13 08:11
  • 8. Andersons study Forward looking study focused on driving forces: Time shared computing Communication and Networking 02/09/13 08:11
  • 9. Andersons study QuickTime and a decompressor are needed to see this picture. QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
  • 10. Anderson on networks QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
  • 11. The Insider Threat QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
  • 12. The Handbook QuickTime and a decompressor are needed to see this picture. 02/09/13 08:11
  • 13. DoD Security Research With publication of Andersons report significant research funds were allocated to Computer Security Two goals: Solve aspects of the Security Problem as articulated by Anderson Give guidance to military procurement officers on how to acquire secure computing systems 02/09/13 08:11
  • 14. DoD Research dominates 70s Although not all security challenges were related to defense, defense sponsored research dominates publications in 70s and 80s In that period Confidentiality was stressed The neglect of Availability would bite on September 11, 2001 02/09/13 08:11
  • 16. Objectives Explore what a security policy is; develop a vocabulary to discuss policies Examine the role of trust in policy 02/09/13 08:11
  • 17. What is a Security Policy? Statement that articulates the security goal In the state machine model it identifies the authorized or secure states (which are distinct from the unauthorized or nonsecure states) A secure system is one in which the system can only enter authorized states Note: The policy doesnt make the system secure; it defines what secure is 02/09/13 08:11
  • 18. Confidentiality X: set of entities I: some information I has the property of confidentiality with respect to X if no member of X can obtain information about I What is information? 02/09/13 08:11
  • 19. Confidentiality Scenario If an instructor wishes to keep class grades confidential from the students which of the following can the instructor do? Email the grade file to the class mailing list Email an encrypted grade file to the class mailing list Email summary statistics (mean, median, max, and min) to the class mailing list What is information? What is data? 02/09/13 08:11
  • 20. Integrity Bishop: X, I as before I has the property of integrity with respect to X if all members of X trust I Dictionary (http://www.m-w.com/dictionary/integrity) 1 : firm adherence to a code of especially moral or artistic values : INCORRUPTIBILITY 2 : an unimpaired condition : SOUNDNESS 3 : the quality or state of being complete or undivided : COMPLETENESS 02/09/13 08:11
  • 21. Integrity If Alice and Bob trust their horoscopes do horoscopes have integrity? If the users of a system trust the file system does it have integrity? Is it reasonable for integrity to be based on user perception? If the public loses confidence in voting machines can even a perfect DRE machine have integrity? 02/09/13 08:11
  • 22. Assurance Assurance aims to provide intrinsic evidence of integrity We trust the integrity of the bank because we intrinsically trust the accounting practices used by banks We also trust the bank because The bank is audited for compliance with these trusted practices The banks data is scrutinized for signatures of fraud 02/09/13 08:11
  • 23. Integrity Although we may desire an intrinsic notion of integrity we must accept the perception of trust in the general case If we do not have intrinsic assurance the best we can demand is that no agent can refute integrity 02/09/13 08:11
  • 24. Availability Let X be a set of entities, I a resource I has the property of availability with respect to X if all members of X can access I What is access? Quality of service is not always binary 02/09/13 08:11
  • 25. Setting the bar on access Organizational context is critical For a person, access sufficient to perform their job function Avionics system: micro-/milli second (some military airframes are aerodynamically unstable; avionics system is required to keep them in the air) Air Traffic control: 100s of milliseconds Airline reservations: 10s of seconds [These numbers are notional] 02/09/13 08:11
  • 26. Access and Quality of Service Behavior of service under load may be important Graceful degradation QoS threshold When is it better to do a few things quickly than all things slowly? 02/09/13 08:11
  • 27. Dimensions of Policy Policy defines security objective: Confidentiality: Protect Information and Resources I from X Integrity: in a manner trusted by Y Availability: to be accessible to Z Mechanisms can be evaluated to determine if they help meet the objective 02/09/13 08:11
  • 28. Does this model match reality? Recall PSU AUP What facets focus on Confidentiality: what is I? who/what is X? Integrity: I? X? Availability: I? X? What facets are outside of this model? 02/09/13 08:11
  • 29. PSU Computer & Network Acceptable Use Policy This acceptable use policy governs the use of computers and networks at Portland State University (PSU). As a user of these resources, you are responsible for reading and understanding this document. Portland State University encourages the use and application of information technologies to support the research, instruction, and public service mission of the institution. PSU computers and networks can provide access to resources on and off campus, as well as the ability to communicate with other users worldwide. Such open access is a privilege and requires that individual users act responsibly. Users must respect the rights of other users, respect the integrity of systems and related physical resources, and observe all relevant laws, regulations, and contractual obligations. 02/09/13 08:11
  • 30. PSU AUP (cont) Acceptable use terms and conditions: The primary purpose of electronic systems and communications resources is for University-related activities only. Users do not own accounts on University computers, but are granted the privilege of exclusive use. Users may not share their accounts with others, and must keep account passwords confidential. Each account granted on a University system is the responsibility of the individual who applies for the account. Groups seeking accounts must select an individual with responsibility for accounts that represent groups. The University cannot guarantee that messages or files are private or secure. The University may monitor and record usage to enforce its policies and may use information gained in this way in disciplinary and criminal proceedings. Users must adhere strictly to licensing agreements and copyright laws that govern all material accessed or stored using PSU computers and networks. When accessing remote systems from PSU systems, users are responsible for obeying the policies set forth herein as well as the policies of other organizations. Misuse of University computing, networking, or information resources may result in the immediate loss of computing and/or network access. Any violation of this policy or local, state, or federal laws may be referred to appropriate University offices and/or, as appropriate, law enforcement authorities. 02/09/13 08:11
  • 31. PSU AUP (cont) Conduct which violates this policy includes, but is not limited to the following: Unauthorized attempts to view and/or use another persons accounts, computer files, programs, or data. Using PSU computers, accounts, and/or networks to gain unauthorized access to University systems or other systems. Using PSU computers, accounts, and/or networks for: threat of imminent physical harm, sexual or other harassment, stalking, forgery, fraud, generally offensive conduct, or any criminal activity. Attempting to degrade performance of University computers and/or networks. Attempting to deprive other users of University technology resources or access to systems/networks. Using University resources for commercial activity such as creating products or services for sale. Copying, storing, sharing, installing or distributing software, movies, music, and other materials currently protected by copyright, except as permitted by licensing agreements or fair use laws. Unauthorized mass e-mailings to newsgroups, mailing lists, or individuals, i.e. spamming or propagating electronic chain letters. Unauthorized broadcasting of unsolicited mail, material, or information using University computers/networks. 02/09/13 08:11
  • 32. Policies and the world What about Obey the law Organizational consequences 02/09/13 08:11
  • 33. Policy model vs reality Consider password policies (e.g. Sans model policy http://www.sans.org/resources/policies/) What dimension of security do password polices primarily address? 02/09/13 08:11
  • 34. Policy informed by experience Most organizations have a policy that has evolved Reflects understanding of threat environment (or at least threat history) Can reveal critical assumptions 02/09/13 08:11
  • 35. Policy vs. Mechanism Policy says what is allowed and what isnt Mechanism is an entity or procedure that enforces some part of the policy Discuss List some mechanisms Facets of policy for which mechanisms are appropriate Facets of policy for which mechanisms are unlikely to be appropriate 02/09/13 08:11
  • 36. Security Model A security model is a model that represents a particular policy or set of policies Abstracts from the policy We will see various security models: Bell LaPadula for Confidentiality Clark-Willson Integrity Chinese Wall Model 02/09/13 08:11
  • 37. Families of Policies Military Security Policy (Governmental) Primary goal: confidentiality Commercial Security Policy Primary goal: integrity Common mechanism: transactions; transaction- oriented integrity security policies When you buy a book from Amazon you want to get exactly what you ordered and pay for it exactly once 02/09/13 08:11
  • 38. Assumptions and Trust All policies have assumptions Typically something is trusted: Hardware will faithfully execute the program Patch is uncorrupted from vendor Vendor tested patch appropriately Vendors environment similar to system being patched Patch is installed correctly 02/09/13 08:11
  • 39. Trust What are some assumptions of the PSU AUP? The sans password policy? 02/09/13 08:11
  • 40. Access Control Policies Discretionary Access Control (DAC) An individual user can set allow or deny access to an object Mandatory Access Control (MAC) System mechanism controls access User cannot alter that access Originator Controlled Access Control (ORCON) Access control set by creator of information Owner (if different) cant alter AC Like copyright 02/09/13 08:11
  • 41. Conclusions Policy declares security goal Policy can be understood in terms of security components: Confidentiality Integrity Availability Policy is based on assumptions about the environment It is critical to understand what entitie the policy trusts 02/09/13 08:11
  • 42. Looking Forward Bell-LaPadula Model Military style classification of information Confidentiality Reading: Bell retrospective Bishop: Chapter 5 (start 6 as well) RA: Chapter 7 Background What is a lattice? Reading: Chapter 27 02/09/13 08:11