Study Guide: Security Models and Policies
Quiz
1. What is the primary purpose of a security model?
A security model is a specification of a security policy. It describes the
entities governed by the policy and states the rules that constitute the
policy.
1. What are the three main goals of security that security models aim to
maintain?
Security models are used for maintaining confidentiality, integrity, and
availability.
1. Which classic security model is primarily focused on confidentiality?
The Bell-LaPadula (BLP) model is primarily focused on addressing
confidentiality.
1. Explain the "Simple Security Property" in the Bell-LaPadula model.
The Simple Security Property, also known as "No read up," means a
subject cannot read data from a security level higher than their own
security level.
1. What security goal does the Biba model primarily address?
The Biba model primarily addresses integrity.
1. What is the key difference in the focus between the Bell-LaPadula
model and the Biba model?
The Bell-LaPadula model focuses on confidentiality ("No read up, no
write down"), while the Biba model focuses on integrity ("No read
down, no write up").
1. What was the main motivation for developing the Clark-Wilson model,
and what aspects does it emphasize?
The Clark-Wilson model was developed for commercial activities and
emphasizes the separation of duties, required use of applications for
data access, and auditing.
1. What conflict of interest problem does the Brewer-Nash model aim to
prevent?
The Brewer-Nash model, or Chinese Wall model, aims to prevent
conflict of interest problems by preventing individuals from accessing
data related to competing entities they have previously worked with.
1. According to the source, what is the difference between a security
policy and a standard?
A policy is a high-level statement from senior management, driven by
laws or business objectives, while a standard defines the specifics of
that policy.
1. What are two key factors to consider when developing a security
policy, besides cost?
Two key factors to consider when developing a security policy are the
value of the assets being protected and the vulnerabilities of the
system.
Answer Key
1. A security model is a specification of a security policy that describe the
entities governed by the policy and states the rules that constitutes
the policy.
2. Confidentiality, Integrity, and Availability.
3. Bell-LaPadula Model.
4. A subject cannot read data from a security level higher than subject’s
security level.
5. Integrity.
6. BLP addresses confidentiality (ensures that information do not flow to
those who are not cleared for that level). The Biba model has a similar
structure to the BLP model, but it addresses integrity rather than
confidentiality.
7. It was developed with the intention to be used for commercial
activities. Clark Wilson dictates that the separation of duties must be
enforced, subjects must access data through an application, and
auditing is required.
8. It was developed to prevent conflict of interest (COI) problems. It
prevents a worker consulting for one firm from accessing data
belonging to another, thereby preventing any COI.
9. Policy - High level statement from senior/executive management.
Standard - Define the specifics of policy.
10. The value of the assets being protected and the vulnerabilities of
the system. (Other acceptable answers include Potential threats and
the likelihood of attacks).
Essay Format Questions
1. Compare and contrast the Bell-LaPadula model and the Biba model,
discussing their primary security goals, rules, and typical applications.
2. Analyze the purpose and key features of the Clark-Wilson model,
explaining how it differs from earlier security models and its relevance
to commercial environments.
3. Discuss the concept of "need-to-know" and how it complements or
differs from the security levels defined in models like Bell-LaPadula.
Provide an example to illustrate your point.
4. Explain the importance of developing comprehensive information
security policies within an organization. Discuss at least three specific
types of policies mentioned in the source and their significance.
5. Describe the Brewer-Nash model and its application in preventing
conflicts of interest. Provide a hypothetical scenario where this model
would be particularly relevant and explain how its rules would be
applied.
Glossary of Key Terms
Security Model: A specification of a security policy that describes the
entities governed by the policy and states the rules that constitute the
policy.
Security Policy: A high-level statement from senior/executive
management, usually driven by laws, industry standards, liability
considerations, or other business objectives, outlining security
requirements.
Bell-LaPadula Model (BLP): A formal access control model primarily
focused on confidentiality, relying on security classes and rules like "No
read up" and "No write down."
Simple Security Property ("No read up"): A rule in the Bell-
LaPadula model stating that a subject cannot read data from a security
level higher than their own.
*** Property ("No write down"):** A rule in the Bell-LaPadula model
stating that a subject cannot write data to a security level lower than
their own.
Strong *** Property: A rule in the Bell-LaPadula model stating that a
subject with read/write privileges can perform these functions only at
their own security level.
Need-to-Know Principle: The principle that a user shall only have
access to the information required for their job function, regardless of
their security clearance level.
Biba Model: A security model with a similar structure to the BLP
model but primarily focused on integrity, using integrity levels and
rules like "No read down" and "No write up."
Simple Integrity Axiom ("No read down"): A rule in the Biba model
stating that a subject at a specific integrity level cannot read data at a
lower integrity level.
Integrity Axiom ("No write up"): A rule in the Biba model stating
that a subject at a specific integrity level cannot write data to a higher
integrity level.
Invocation: A property in the Biba model where a subject at one
integrity level is prohibited from invoking a subject at a higher integrity
level.
Clark-Wilson Model: A security model developed for commercial
activities, emphasizing integrity through the separation of duties, the
use of transformation procedures, and auditing.
Access Control Triple (Clark-Wilson): Composed of the user,
transformational procedure, and the constrained data item, used in the
Clark-Wilson model to control access and maintain integrity.
Brewer-Nash Model (Chinese Wall Model): A security model
designed to prevent conflicts of interest by separating individuals from
accessing data related to competing entities.
Take-Grant Model: A confidentiality-based security model that
supports four basic operations: take, grant, create, and revoke rights.
Standard: Defines the specifics of a security policy.
Procedure: Step-by-step instructions for implementing aspects of a
security policy.
Guideline: Suggested best practices related to security policies.
Confidentiality: The security goal of ensuring that information is not
disclosed to unauthorized individuals or systems.
Integrity: The security goal of ensuring that information is accurate,
complete, and has not been improperly modified.
Availability: The security goal of ensuring that information and
systems are accessible and usable when needed by authorized
individuals.
Questions
What is a security model and why are they important?
A security model is a formal specification of a security policy. It describes the
entities involved (like subjects and objects) and defines the rules that
constitute the policy. Security models are crucial for testing policies for
completeness and consistency, and they help in the conceptualization,
design, and implementation of secure systems. They are used to maintain
the goals of security: Confidentiality, Integrity, and Availability.
What is the primary focus of the Bell-LaPadula Model and what are its key
rules?
The Bell-LaPadula (BLP) model, developed in the 1970s, is a formal access
control model primarily focused on confidentiality. It assigns a security class
or level to each subject and object. The key rules to prevent unauthorized
information flow to lower security levels are:
Simple Security Property ("No read up"): A subject at a given
security level cannot read data from a higher security level.
*** Security Property ("No write down"):** A subject at a given security
level cannot write data to a lower security level.
Strong * Property ("no read/write up or down"): A subject with
read/write privilege can only perform read/write functions at their own
security level.
How does the Biba Model differ from the Bell-LaPadula Model?
While the Biba model shares a similar structure with the Bell-LaPadula model,
its primary focus is on integrity rather than confidentiality. Objects and
users are assigned integrity levels, which indicate trustworthiness or
accuracy. The Biba model's rules aim to prevent the flow of information from
lower integrity levels to higher ones:
Simple Integrity Axiom ("No read down"): A subject at a specific
integrity level cannot read data at a lower classification.
Integrity Axiom ("No write up"): A subject at a specific integrity
level cannot write data to a higher classification.
Invocation: A subject at one integrity level is prohibited from invoking
a subject at a higher level of integrity.
What is the Clark-Wilson Model and what are its main features?
The Clark-Wilson model, created in 1987, was designed for commercial
activities and addresses all the goals of integrity. It emphasizes the
separation of duties, requiring subjects to access data through specific
applications and mandating auditing. Its key features include:
Preventing unauthorized changes by unauthorized subjects.
Preventing unauthorized changes by authorized subjects.
Maintaining internal and external consistency.
Utilizing an access control triple consisting of the user, a
transformational procedure, and a constrained data item to protect
integrity and prevent fraud.
What is the purpose of the Brewer-Nash Model?
The Brewer-Nash model, also known as the Chinese Wall model, was
developed to prevent conflict of interest (COI) problems. It is more
context-oriented, preventing an individual who is consulting for one firm from
accessing data belonging to a competing firm, thereby avoiding potential
conflicts of interest.
What is the Take-Grant Model?
The Take-Grant model is a confidentiality-based security model that defines
four basic operations: take, grant, create, and revoke. These operations
govern how subjects can gain or relinquish rights to other subjects or objects
within the system. For example, a subject with the "take" right can remove
"take" rights from others, and a subject with the "grant" right can give that
right to others.
What are the different levels of security documentation?
Security documentation typically exists at different levels of detail:
Policy: A high-level statement from senior management, driven by
factors like laws, standards, and business objectives.
Standard: Defines the specifics required by the policy.
Procedures: Provide step-by-step instructions on "how to" implement
the standards.
Guidelines: Offer suggested best practices.
Why are information security policies important for an organization?
Information security policies are essential for several reasons:
They define the security expectations for an organization's employees.
They reflect the management's risk appetite and mindset regarding
security.
They provide direction for building a control framework to protect
against threats.
They support the organization's legal and ethical responsibilities.
They are a mechanism to hold individuals accountable for their
adherence to security behaviors. Key issues addressed in policies often
include password management, remote access, BYOD, data backups,
disaster recovery, and access control.