# Chapter 8 – Principles of Security Models, Design and Capabilities



### Objects and Subjects
A Subject is the user or process that makes a request to access a resource (the object).
**Transitive trust** is the concept that if A trusts B and B trusts C, then A inherits the trust of C. It is a serious security concern, because of possible bypassing of restrictions between A and C.

A **closed system** is designed to work well with a narrow range of other systems, usually from the same manufacturer. An **open system** uses industry standards and integrates more easily.
A closed system is harder to attack because there is less public knowledge about it.
Because Microsoft, Apple et al support industry standards they are considered ‘open systems’.

## Techniques for Ensuring Confidentiality, Integrity and Availability
The three terms, isolation, bounds and confinement are inter-related. **Confinement** basically means ensuring that the process only reads and writes to specific resources (such as memory), whereas **bounds** refer to the authority level attached to the process which defines the specific resources it can access such as memory locations. **Isolation** means confining a process by implementing bounds.

### Access Controls
Mandatory Access Controls (MAC) use static attributes of subjects and objects, and depend on labeling them with clearance or authority levels (for subjects) and classification (for objects).
Discretionary Access Control (DAC) allows the owner of an object to determine the rules for access.

### Trust and Assurance
A system is Trusted when all protection mechanisms work together to maintain stability and security while processing data for different users.
Assurance is the degree of confidence in the security of a system.

## Fundamental Concepts of Security Models
...

### Take-Grant Model
The Take-Grant model dictates how rights can be transferred among subjects. A subject with a Grant right can grant *another subject or object* any right they possess (except the grant right itself).
A subject with the Take right can take a right from any other subject.
The Create rule allows a subject to create new rights, the Remove rule allows a subject to remove rights (but only the rights it has itself).

### Access Control Matrix
Column headers represent Objects, Row label represent Subjects.
Capability Lists is associated with subjects (or rows).
Access Control Lists are associated with objects (or columns).
“Using only capability lists is a management nightmare”, because every change in an object has to be implemented on each user account.

### Bell-LaPadula Model
The Bell-LaPadula model is an information flow model, based on a state machine concept. It employs mandatory access control (MAC) and is lattice-based.
Bell-LaPadula is focused on confidentiality.

Access to an object is granted to subjects with classified levels. Properties of the Bell-Lapadula state machine:
* ~no read-up~ (simple security property):  you can’t see what you’re not classified for.
* ~no write-down~ (star security property): don’t share classified information below your rank. Also known as the confinement property.
* The system uses an access matrix for discretionary access control: Need-to-Know.
* Read-down and write-up are allowed (but you can’t look into the object you’re writing to).

### Biba Model
The Biba model is an information flow model aimed at nonmilitary organizations and focuses on ~integrity~. It is the inverse of the Bell-LP model. Properties of the Biba state machine:
* ~no read-down~ (simple integrity property):  because you would be using less reliable data.
* ~no write-up~ (star security property): because you would be polluting more reliable data.

Biba focuses on protection from external threats only (i.e. from outside the system). It doesn’t address access control management.

Note: *simple* is always about reading, *star* is always about writing.

### Clark-Wilson Model
The Clark-Wilson model also focuses on integrity for commercial organizations.
CW ~allows modifications of data items only through a small set of programs~.
It does not use a lattice, but *access control triples* of subject-program-object (or subject-transaction-object).
CW uses two principles: well-formed transactions and separation fo duties.
Well-formed transactions are enforced through programs. Each program is limited in what it can do to an object. This effectively limits the subject’s capabilities and is known as a constrained interface.

Clark-Wilson defines the following:
* A constrained data item (CDI) is a data item whose integrity is protected by the model.
* Only Transformation procedures (TP) are allowed to modify a CDI.
* There is an Integrity verification procedure (IVP) to confirm the integrity of objects.
* An unconstrained data item (UDI) is a data item that is not controlled by the model and has unknown integrity.

Access to information, as well as functions, is based on classification of the subject. The Clark-Wilson model enforces ~separation of duties~.

### Brewer and Nash model (aka Chinese Wall)
The Brewer and Nash model permits access controls to change based on a user’s previous activity (so it’s a kind of state machine model).
It defines which security domains are potentially in conflict, and prevents subjects with access to one domain from accessing conflicting domains.
This keeps users out of ~conflict-of-interest~ situations.

If an action is taken on a data item, the access to any conflicting item is temporarily blocked, until the task is completed.

### Goguen-Meseguer model
The Goguen-Meseguer model is an integrity, ~noninterference~ model. Users are grouped and have only access to a list of objects, but can not interfere with members of another domain.

### Sutherland model
The Sutherland model is an integrity model, based on a state machine / information flow model. It defines a set of system states, initial states and state transitions to maintain integrity and prohibit interference.
A common use is to ~prevent covert channels~ to influence processes.

### Graham-Denning model
The Graham-Denning model focuses on creation and deletion of subjects and objects. It has eight primary protection rules: securely create or delete objects or subjects, and securely provide read, grant, delete and transfer rights.
It uses an access control matrix to define the specific permissions of each subject.

## Select Controls based on Systems Security Requirements
...
