Information Systems Security

1. Information Systems Security Security Architecture Domain #5

2. Hardware Components • CPU • Primary Storage • Control Unit • Coordinates activities during instruction execution • Does not process data • Arithmetic Logic Unit (ALU) • Perform mathematical functions on data

3. Memory Types • Primary Memory (RAM/ROM/EPROM/EE) • Real Memory • Available to users • Cache Memory • Buffers used to increase performance • Holds data that is accessed often • Virtual Memory • Combination of real and secondary storage

4. Memory Management • Keep track of used memory segments • Assign memory to processes • Manage swapping • Memory protection • Access control • Control virtual memory addressing

5. Protection Rings • Organize Code and components in an operating system into concentric rings • Modern OS’s use a 4-ring model • Ring 0 – highest privilege – kernel • Ring 1 – remainder of the OS • Ring 2 – drivers and utilities • Ring 3 – applications and programs – user mode

6. Hardware Bus • Data Bus • Transfers instructions and data • Differs based on architectures • EISA – 8/16 • MCA – 16/32 • VLB – 32 • PCI – 32/64 • AGP - 32

7. Process and Threads • Process • Application and users run as processes in OS • Process can contain several threads of code • Thread are individual instruction sets

8. Threads • Advantages • Much quicker to create than a process • Much quicker to switch between threads • Share data easier • Used in browsers and windowing systems • Disadvantages • No security between threads • If one user thread blocks, all are blocked

9. Process States • Stopped – not running • Waiting – waiting for interrupt • Running – being executed by the CPU • Ready – available and waiting for instruction

10. System Functionality • Multithreading • Several threads processing at one time • Multitasking • Several processes at one time • Multiprocessing • Multiple CPU available

11. System Security Modes • Dedicated Security Mode • All users have clearance and need-to-know to access all information on the system • Does not require complex methods of controlling access between different levels • Multilevel Security Mode • All users have clearance but not need-to-know • Two of more levels of classification • Data is compartmentalized in containers

12. Security Modes • Dedicated Mode • Single state system • All have need to know and clearance • System High Mode • All have need-to-know for ‘some’ material • Compartmented Mode • Not all have access for all information • Multilevel Mode • Not all have clearance or need-to-know

13. Levels of System Trust • Processes with higher trust can access more system instructions • CPU architecture dictates the levels of trust available and the rights of access • CPU executes instructions in different states depending upon the process trust level • User mode – less trusted • Privilege mode – most trusted

14. Trusted Computing Base • All mechanisms that provide protection for the system • Software, firmware, hardware • Made up of processes that executed in privileged mode • Term originated from the Orange Book

15. System Protection • Reference Monitor • Access control concept that is referred to as an abstract machine that mediates all accesses • Controls relationship between subjects and objects • Security Kernel • Enforces the reference monitors rules • Physical implementation of reference monitor • Part of TCB concerned with access control

16. Access Control Models • Provides rules and structures used to control access and shows how decisions are made • Main components are subjects, objects, operations, and their relationships • Goal is to control how objects are accessed and ensure a security principle • Confidentiality, integrity

17. Finite State Machine • Execution sequence for each possible state transformation • Mappings for each state change • Does not specify protection mechanisms or means of enforcing model • If system comes up in a secure state and shuts down in a secure state, the system is secure

18. Information Flow • Information must flow securely through the system • Bell – Lapadula • Biba • Clark-Wilson • Take-Grant • Access Control Matrix • Noninterference

19. Bell LaPadula • Confidentiality Model • Information cannot flow to an object of lesser classification • Mathematical model uses a set theory to define access rights • Maps a subject’s clearance and an object’s classification and creates a relationship

20. Rules • Subjects cannot read data from an object in a higher security level • “No Read Up” – simple security property • “No Write Up” – star property • “No Write Up and No Read Down” – strong star

21. Biba • Integrity Model • No subject can depend on an object of lesser integrity • Based on hierarchical lattice • Prevents modification of objects by unauthorized subjects • Prevents unauthorized modification by authorized users

22. Rules of Biba • “No Write Up” – integrity axiom • No writing data at a higher integrity level • “No Read Down” – simple axiom • No reading data from a lower integrity level • Disadvantages • Does not address confidentiality • Does not address control management nor provide a way to change classification levels

23. Clark - Wilson • Integrity Model • Model for commercial integrity • Requires well formed transactions and separation of duties • Does not use lattice approach, partitions objects into programs and data • Access triple – subject must go through a program to access and modify data • Separation of duties with auditing required

24. Non-Interference • Based on theory where users are separated into different domains • An output stream remains unchanged when inputs come from levels that are less dominant • Subject cannot be influenced by the behavior of other subjects at higher security levels

25. Lattice Based • Every subject and object relationship has a partially ordered set with a lower and upper bounds • Rules are set that dictate how information can flow from one class to another • Confidential can flow to secret but secret cannot flow to confidential

26. Access Control • Relational table • Specifies the operations and rights allowed for each subject • Access Control Lists – DACL, trustees

27. Brewer - Nash • Also known as “Chinese Wall” • Mathematical theory used to implement dynamically changing access permissions • Defines a wall and develops a set of rules that ensures no subject accesses objects on the other side • Enforces “no conflict of interest” rules • Allows separation of competitors’ data

28. Take Grant • Mathematical framework for granting and revoking access authorization • Analytical tool for auditors to test software security • Rules for how users transfer their permissions to others

29. Trusted Computer System Evaluation Criteria (TCSEC) • Developed by National Security Computer Center • Based on the Bell-LaPadula model • Uses a series of evaluation classes • “Orange Book”

30. Requirements of TCSEC • Security Policy • Marking – labels associated with objects • Identification – individual ID of subjects • Accountability – audit data collected • Assurance – each mechanism evaluated • Continuous protection – mechanisms always protected against unauthorized changes

31. TCSEC Ratings • A1 – Verified Protection • B3,B2,B1 – Mandatory Protection • C2,C1 – Discretionary Protection • D – Minimal Security • Red Book – Trusted Network Interpretation

32. Layers of TCSEC • C1 – Discretionary Security Protection • C2 – Controlled Access Protection • B1 – Labeled Security • B2 – Structured Security (covert channels) • B3 – Security Domains (covert timing) • A1 – Verified Protection

33. Information Technology Security Evaluation Criteria (ITSEC) • Evaluates functionality and assurance separately • F1 to F10 for functionality • E0 to E6 for assurance • E0 = D • F1+E1 = C1 • F2+E2 = C2 • F3+E3 = B1 • etc

34. ITSEC • Advantages • More granular approach • Goes beyond the Orange Book • Disadvantages • Increased amount of rating combinations • Still does not provide all the answers

35. Common Criteria • ISO created in 1993 • TCSEC was too rigid • ITSEC added too much complexity • Target of Evaluation (TOE) • Security Target (ST) • EALs – E1 (functionally tested only) – E7(formally verified, designed, and tested)

36. Covert Channels • Timing Channels – conveys information by altering the performance of a system component in a predictable manner • Storage Channels – conveys information by writing data to a common storage area where another process can read it. • Level B2 address covert channels • Level B3 address covert timing

37. Certification and Authentication • Certification • 1st phase – comprehensive evaluation of the security features of an IT system • Accreditation • Management decides the certification of the system satisfies their needs • Definition, Verification, Validation, Post Accreditation

38. Other Threats • Back Doors • Maintenance Hooks • Asynchronous Attack – TOC/TOU • Race Attacks • Data Validation (Unicode attack) • Buffer Overflow (Use input controls) • SYN Flood • Ping of Death

39. More Attacks • TCP Session Hijacking • Web Spoofing • DNS Poisoning