CIA Triad

The 3 basic actions of a person on an item of data: viewing (confidentiality), modifying (integrity), using (availability).

Threat modeling maps threats to these 3 security properties during system design.

Confidentiality

Ensuring confidentiality raises several open questions:

• Who determines which people or systems are authorized to access a system.
• Whether authorized access covers part or all of a data collection.
• Whether an authorized party can access pieces of data out of context.
• Whether an authorized party can disclose data they access to other parties.
• Who owns data generated indirectly, e.g. the fact that a user clicked a link on a web page.

Modeling Confidentiality

A general statement on confidentiality: a person, process, or program is (or is not) authorized to access a data item in a particular way.

The security model consists of:

• Subject
  The person, process, or program.
• Object
  The data item.
• Access mode
  The kind of access, such as read, write, or execute.
• Policy
  The authorization.

Confidentiality Violations

Examples:

• An unauthorized person, process or program accesses a data item.
• An authorized person accesses data they are not authorized to access, a privilege violation.
• A person accesses data in a manner allowing inference of data whose access is unauthorized, e.g. a medical condition inferred through pharmaceutical purchases.
• An unauthorized person learns of the existence of a piece of data, e.g. a company takeover inferred through updates to financial reports.

Integrity

Interpretations of an item’s integrity:

• Precise.
• Accurate.
• Unmodified.
• Modified only in acceptable ways.
• Modified only by authorized people.
• Modified only by authorized processes.
• Consistent, internally consistent.
• Meaningful and usable.

Availability

Availability applies to both data (information) and services (information processing).

An item of data or a specific service is available iff:

• It is present in a usable form.
• It has enough capacity to meet the service’s needs.
• It is making clear progress, and if in wait mode, has a bounded waiting time.
• The service completes in an acceptable period of time.

Availability overlaps with related non-functional requirements: capacity, performance, fault tolerance, usability.

Access Control

Builds on the paradigm, reference monitor, and matrix/ACL/capability/RBAC mechanisms covered in Access Control. The models below extend that base for specific computer security objectives.

BLP Model

Enforces data confidentiality in multi-level systems. By David Bell and Leonard La Padula.

Every subject has a clearance level. Every object has a classification level. Levels form a lattice.

A class is a pair $\langle \text{rank}, \text{compartment} \rangle$ assigned to both subjects and objects.

• Rank
  A sensitivity level, e.g. top secret, secret, confidential, restricted, unclassified.
• Compartment
  A category grouping related information, e.g. a project name or region.

Class $D_1 \le D_2$ iff $\text{rank}_1 \le \text{rank}_2$ and $\text{compartment}_1 \subseteq \text{compartment}_2$. This dominance relation applies to subjects (clearance) and objects (classification) alike.

Rules:

• Simple security property, no read up
  A subject can read an object only when the subject clearance dominates the object classification.
• Star property, no write down
  A subject can write an object only when the object classification dominates the subject clearance.

Information flows only upward. A discretionary access matrix applies on top. Declassification needs a trusted subject outside the rules. Says nothing about integrity.

Examples:

• An analyst has Secret clearance and Nuclear access.
• A Secret Nuclear report is readable by that analyst.
• A Top Secret Nuclear report is not readable.
• The analyst cannot copy the Secret report into an Unclassified briefing.

Biba Model

Enforces data integrity. By Kenneth Biba. The dual of the BLP model, with integrity levels replacing secrecy levels.

Rules:

• Simple integrity property, no read down
  A subject can read an object only when the object integrity level is at least as high as the subject integrity level.
• Star integrity property, no write up
  A subject can write an object only when the subject integrity level is at least as high as the object integrity level.

Information flows only downward in integrity. Untrusted data cannot reach a high-integrity subject.

Examples:

• The build system signs a release artifact.
• The production deployment service accepts the signed artifact.
• It rejects a deployment script from an employee’s email.
• A clerk can submit an expense claim. The clerk cannot change the approved ledger.

Separation of Duty

Separation of duty requires that a sensitive action need approval from 2 or more distinct authorized people, so no single person can act alone.

This policy cannot be represented using an access control matrix, since the matrix has no notion of a relationship between 2 permissions.

Chinese Wall Model

Prevents conflict of interests in shared information systems. By David Brewer and Michael Nash.

Objects are grouped into company datasets. Company datasets are grouped into conflict-of-interest classes.

Access is history-based, so the accessible set differs per subject and shrinks over time.

Rules:

• Read
  A subject can read an object only when the object is in a company dataset the subject already accessed, or in a conflict class the subject has not yet touched.
• Write
  A subject can write an object only when the subject cannot read any object in a different company dataset.

Effect: no fixed lattice. The policy is dynamic and per-subject.

Examples:

• An investment-bank analyst first reads company $C_1$‘s records.
• Company $C_1$ competes with company $C_2$.
• The analyst cannot then read company $C_2$‘s records.
• Another analyst can work for company $C_2$.

Examples

Capabilities in Amoeba

Amoeba is a distributed operating system. It uses capabilities across networked machines.

• A file server stores a report.
• A capability identifies the server and the report.
• Its rights field might grant read access only.
• The server verifies the capability’s check field before returning the report.
• An owner can give another user a reduced capability. For example, read access without write access.

Revocation uses indirection. A capability points to a pointer. The pointer points to the resource. The server revokes access by setting the pointer to $0$.

Unix File Security

Unix gives every file an owner and a group. It stores read, write, and execute permissions for the owner, group, and others.

• Alice owns budget.txt.
• She grants her Finance group read access.
• She denies other users all access.
• Only Alice or root can change these permissions.
• A process’s effective user ID determines its permissions.
• A setuid program runs with the file owner’s effective user ID.

Setuid scripts are unsafe. An attacker can replace the script between execution and loading.

Windows Access Control

Windows NTFS attaches a security descriptor to every object. It records an owner, a group, and a discretionary access control list (DACL).

• An HR folder allows the HR group to read and edit files.
• It explicitly denies an intern access to the folder.
• Windows checks explicit deny before explicit allow.
• A security identifier (SID) identifies a user or group.
• An impersonation token lets a thread use another user’s security context.