1 / 48

CSC 482/582: Computer Security

CSC 482/582: Computer Security. Security Policies. Topics. What is a security policy? Types of Policies Trust Types of Access Control Discretionary (DAC) Mandatory (MAC) Originator-based (ORBAC) Policy Expression Languages. Security Policy.

anchoret
Download Presentation

CSC 482/582: Computer Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CSC 482/582: Computer Security Security Policies CSC 482/582: Computer Security

  2. Topics • What is a security policy? • Types of Policies • Trust • Types of Access Control • Discretionary (DAC) • Mandatory (MAC) • Originator-based (ORBAC) • Policy Expression Languages CSC 482/582: Computer Security

  3. Security Policy Security policy partitions system states into: • Authorized (secure) • These are states the system is allowed to enter. • Unauthorized (nonsecure) • If the system enters any of these states, it’s a security violation. Secure system • Starts in authorized state. • Never enters unauthorized state. CSC 482/582: Computer Security

  4. Confidentiality • X set of entities, I information. • I has confidentiality property with respect to X if no x in X can obtain information from I. • I can be disclosed to others. • Example: • X is the set of students. • I is the final exam answer key. • I is confidential with respect to X if students cannot obtain final exam answer key. CSC 482/582: Computer Security

  5. Integrity • X set of entities, I information. • I has integrity property with respect to X if all x in X trust information in I. • Types of integrity: • trust I, its conveyance and protection (data integrity) • I information about origin of something or an identity (origin integrity, authentication) • I resource: means resource functions as it should (assurance) CSC 482/582: Computer Security

  6. Availability • X set of entities, I resource. • I has availability property with respect to X if all x in X can access I. • Types of availability: • traditional: x gets access or not • quality of service: promise specific level of access (e.g., a specific level of bandwidth) CSC 482/582: Computer Security

  7. Discussion Question • Academic policy disallows cheating. • Includes copying homework, with or without permission. • CS students work on networked systems. • Anne forgets to read-protect her files. • Bill copies Anne’s homework file. • Who cheated? • Anne, Bill, or both? CSC 482/582: Computer Security

  8. NKU AUP Discussion • What are the integrity aspects of the policy regarding user data? What are the availability aspects? • Which of the following is a violation? Support your answer with quotes from the policy. • One student copies another student’s homework. • One student shares his password with another student who forgot his own; no homework or other data is available on the shared account. • A student uses the campus network to sell items over e-bay. • A staff member copies a file of student grades onto an unencrypted USB drive and takes it home. • A system administrator reads student e-mail messages. CSC 482/582: Computer Security

  9. Policy vs. Mechanism Security Policy • Statement that divides system into authorized and unauthorized states. Mechanism • Entity or procedure that enforces some part of a security policy. CSC 482/582: Computer Security

  10. Dirty Politics Republican Senate staffers gained access to Democrat computer files 2002-2003. • Both parties share computer server. • 2001 misconfiguration allowed access w/o pw. • Defence: "The bottom line here is that the technology staff of the Democrats was negligent. They put these memos in a shared hard drive. It was like putting the memos on our desk.” – Manuel Miranda CSC 482/582: Computer Security

  11. Trust Administrator installs patch: • Trusts patch came from vendor, not tampered with in transit. • Trusts vendor tested patch thoroughly. • Trusts vendor’s test environment corresponds to local environment. • Trusts patch is installed correctly. CSC 482/582: Computer Security

  12. How much do you trust? Ken Thompson’s compiler hack from “Reflections on Trusting Trust.” • Modified C compiler does two things: • If compiling a compiler, inserts the self-replicating code into the executable of the new compiler. • If compiling login, inserts code to allow a backdoor password. • After recompiling and installing old C compiler: • Source code for Trojan horse does not appear anywhere in login or C compiler. • Only method of finding Trojan is analyzing binary. CSC 482/582: Computer Security

  13. Trust in Formal Verification • Gives formal mathematical proof that given input i, program P produces output o as specified. • Suppose a security-related program S formally verified to work with operating system O. • What are the assumptions? CSC 482/582: Computer Security

  14. Trust in Formal Methods • Proof has no errors. Bugs in automated theorem provers • Preconditions hold in environment in which S is to be used. • S transformed into executable S’ whose actions follow source code. Compiler bugs, linker/loader/library problems • Hardware executes S’ as intended. Hardware bugs (Pentium f00fbug, for example) CSC 482/582: Computer Security

  15. Types of Access Control Discretionary Access Control (DAC, IBAC) • Individual user sets access control mechanism to allow or deny access to an object. UNIX and NT ACLs. Mandatory Access Control (MAC) • System mechanism controls access to object, and individual cannot alter that access. Originator Controlled Access Control (ORCON) • Originator (creator, not current owner of file) of information controls who can access information. DRM-controlled files. CSC 482/582: Computer Security

  16. SELinux: MAC for Linux What is SELinux? • Linux kernel modifications to provide MAC. What’s the problem with DAC? • TCB large: Security depends on kernel, all privileged aplications, and their configurations. • Coarse-grained: Applications run with all user privileges, even for root user. Security of MAC depends on: • kernel • SElinux security policy configuration CSC 482/582: Computer Security

  17. SELinux Advantages and Issues Advantages • Fine-grained control by program, not by user. • Protects system from flawed or malicious code. Security policy configuration is complex. • Policy language resembles DTEL. • Fine-grained: can control program accesses to individual files, signals, etc. Difficult to find security policies that work for all. • Fedora Core 2’s strict policy caused many problems. • Fedora Core 3 applies policies to known server and system process, lets other programs run w/o restriction. CSC 482/582: Computer Security

  18. SELinux Command Extensions > id -Z user_u:system_r:unconfined_t > ps -eZ |head LABEL PID TTY TIME CMD user_u:system_r:unconfined_t 1 ? 00:00:00 init user_u:system_r:unconfined_t 21 ? 00:00:00 kacpid user_u:system_r:syslogd_t 3826 ? 00:00:00 syslogd user_u:system_r:unconfined_t 3841 ? 00:00:00 irqbalance user_u:system_r:portmap_t 3852 ? 00:00:00 portmap user_u:system_r:ypbind_t 4024 ? 00:00:00 ypbind > ls -lZ /boot/vmlinuz-2.6.10-1.741_FC3smp -rw-r--r-- root root system_u:object_r:boot_t /boot/vmlinuz-2.6.10-1.741_FC3smp CSC 482/582: Computer Security

  19. Policy Languages Express security policies in a precise way. High-level languages • Policy constraints expressed abstractly. Low-level languages • Policy constraints expressed in terms of program options, input, or specific characteristics of entities on system. CSC 482/582: Computer Security

  20. High-Level Policy Languages • Constraints expressed independent of enforcement mechanism. • Constraints restrict entities, actions. • Constraints expressed unambiguously • Requires a precise language, usually a mathematical, logical, or programming-like language. CSC 482/582: Computer Security

  21. Example: Web Browser Goal: restrict actions of Java programs that are downloaded and executed under control of web browser. Policy language specific to Java programs. Expresses constraints as conditions restricting invocation of entities. CSC 482/582: Computer Security

  22. Expressing Constraints Entities are classes, methods • Class: set of objects that an access constraint constrains. • Method: set of ways an operation can be invoked. Operations • Instantiation: s creates instance of class c: s-|c • Invocation: s1 executes object s2: s1 |-> s2 Access constraints • deny(sopx) whenb • While b is true, subject s cannot perform op on (subject or class) x; empty s means all subjects. CSC 482/582: Computer Security

  23. Sample Constraints Downloaded program cannot access password database file on UNIX system Program’s class and methods for files: class File { public file(String name); public String getfilename(); public char read(); Constraint: deny( |-> file.read) when (file.getfilename() == /etc/passwd) CSC 482/582: Computer Security

  24. Another Sample Constraint At most 100 network connections open. Socket class defines network interface • Network.numconns method giving number of active network connections. Constraint deny( -| Socket) when (Network.numconns >= 100) CSC 482/582: Computer Security

  25. DTEL • Domain Type Enforcement Language. • Basis: access can be constrained by types. • Combines elements of low-level, high-level policy languages. • Implementation-level constructs express constraints in terms of language types. • Constructs do not express arguments or inputs to specific system commands. CSC 482/582: Computer Security

  26. Example Goal: users cannot write to system binaries. Subjects in administrative domain can User must authenticate to enter that domain. Subjects belong to domains: d_user ordinary users d_admin administrative users d_login for login d_daemon system daemons CSC 482/582: Computer Security

  27. Types Object types: t_sysbin executable system files t_readable readable files t_writable writable files t_dte data used by enforcement mechanisms t_generic data generated from user processes Treat these types as distinct partitions for example. In practice, files can be readable and writable; ignore this for the example. CSC 482/582: Computer Security

  28. Domain Representation Represent domain as a sequence: • List of programs that start in the domain. • Subsequent items describe rights subject in domain has over objects of a type(crwd->t_writable) means subject can create, read, write, and list (search) any object of type t_writable • The optional last element in the sequence specifies a transition from the current domain to another if such a transition exists. CSC 482/582: Computer Security

  29. d_daemon Domain domain d_daemon = (/sbin/init), (crwd->t_writable), (rd->t_generic, t_readable, t_dte), (rxd->t_sysbin), (auto->d_login); c=create, r=read, w=write, d=dir search Compromising subject in d_daemon domain does not enable attacker to alter system files. Subjects here have no write access. When /sbin/init invokes login program, login program transitions into d_login domain. CSC 482/582: Computer Security

  30. d_admin Domain domain d_admin = (/bin/sh, /bin/csh, /bin/ksh), (crwxd->t_generic), (crwxd->t_readable, t_writable, t_dte, t_sysbin), (sigtstp->d_daemon); sigtstpallows subjects to suspend processes in d_daemon domain Admin users use a standard command interpreter. Only Admin users can writet_sysbin. CSC 482/582: Computer Security

  31. d_user Domain domain d_user = (/bin/sh, /bin/csh, /bin/ksh), (crwxd->t_generic), (rxd->t_sysbin), (crwd->t_writable), (rd->t_readable, t_dte); • Users cannot write to system binaries. • No final transition component as no user commands transition out of this domain. CSC 482/582: Computer Security

  32. d_login Domain domain d_login = (/usr/bin/login), (crwd->t_writable), (rd->t_readable, t_generic, t_dte), setauth, (exec->d_user, d_admin); Cannot execute other programs. Only /usr/bin/login in this domain. setauth right enables subject to change UID. exec access to d_user, d_admin domains. CSC 482/582: Computer Security

  33. Set Up initial_domain = d_daemon; System starts in d_daemon domain assign –r t_generic /; assign –r t_writable /usr/var, /dev, /tmp; assign –r t_readable /etc; assign –r –s dte_t /dte; assign –r –s t_sysbin /sbin, /bin, /usr/bin, /usr/sbin; These assign initial types to objects: –r recursively assigns type –s binds type to name of object (delete object, create new object with same name - new object has same type as old) CSC 482/582: Computer Security

  34. Add Log Type Goal: users can’t modify system logs; only subjects in d_admin, new d_log domains can type t_readable, t_writable, t_sysbin, t_dte, t_generic, t_log; New type t_log domain d_log = (/usr/sbin/syslogd), (crwd->t_log), (rwd->t_writable), (rd->t_generic, t_readable); New domain d_log CSC 482/582: Computer Security

  35. Fix Domain and Set-Up domain d_daemon = (/sbin/init), (crwd->t_writable), (rxd->t_readable), (rd->t_generic, t_dte, t_sysbin), (auto->d_login, d_log); Subject in d_daemon can invoke log process Can log, but not execute anything assign -r t_log /var/log; assign t_writable /var/log/wtmp, /var/log/utmp; Set type of logs CSC 482/582: Computer Security

  36. Discussion Question The 4th Amendment to the US Constitution “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” ILLINOIS v. CABALLES Decision 1/24/2005 • Roy Caballes pulled over by IL Police for speeding. • While one officer was writing him a ticket, another officer in another patrol car came by with a drug sniffing dog. • Dog “sniff” considered probable cause to search trunk. CSC 482/582: Computer Security

  37. Discussion Question • ILLINOIS v. CABALLES Decision • SCOTUS ruled search constitutional. • Search did not “compromise any legitimate interest in privacy” because search could only reveal contraband, the concealment of which “compromises no legitimate privacy interest.” • Questions: • Does this argument that a search cannot violate privacy if it can only reveal crime make sense? • What are the implications of this ruling for computerized law enforcement surveillance? CSC 482/582: Computer Security

  38. Low-Level Policy Languages Set of inputs or arguments to commands. Check or set constraints on system. Low level of abstraction. Need details of system, commands. CSC 482/582: Computer Security

  39. Example: X Window System UNIX X11 Windowing System. Access to X11 display controlled by list List says what hosts allowed, disallowed access xhost +groucho -chico Connections from host groucho allowed. Connections from host chico not allowed. CSC 482/582: Computer Security

  40. Example: tripwire File scanner that reports changes to file system and file attributes tw.config describes what may change /usr/mab/tripwire +gimnpsu012345678-a Check everything but time of last access (“-a”) database holds previous values of attributes CSC 482/582: Computer Security

  41. Example Database Record /usr/mab/tripwire/README 0 ..../. 100600 45763 1 917 10 33242 .gtPvf .gtPvY .gtPvY 0 .ZD4cc0Wr8i21ZKaI..LUOr3 .0fwo5:hf4e4.8TAqd0V4ubv ?...... ...9b3 1M4GX01xbGIX0oVuGo1h15z3 ?:Y9jfa04rdzM1q:eqt1APgHk ?.Eb9yo.2zkEh1XKovX1:d0wF0kfAvC ?1M4GX01xbGIX2947jdyrior38h15z3 0 file name, version, bitmask for attributes, mode, inode number, number of links, UID, GID, size, times of creation, last modification, last access, cryptographic checksums CSC 482/582: Computer Security

  42. Comments System administrators not expected to edit database to set attributes properly. Checking for changes with tripwire is easy. Just run once to create the database, run again to check. Checking for conformance to policy is harder. Need to either edit database file, or (better) set system up to conform to policy, then run tripwire to construct database. CSC 482/582: Computer Security

  43. Example: PAM Pluggable Authentication Modules Config: /etc/pam.conf or /etc/pam.d/prog login auth required pam_unix.so login account required pam_unix.so login password required pam_unix.so login session required pam_unix.so Format: service modtypecontrolflag module CSC 482/582: Computer Security

  44. Example: PAM (cont.) Module Types: Auth: authenticates user Account: non-auth access control (time, place) Password: updates auth token Session: user setup (including logging) Control Flags: required: must succeed for access, all entries checked requisite: required, but returns immediately on failure sufficient: access granted if this condition true CSC 482/582: Computer Security

  45. Policy Models Abstract description of a policy or class of policies. Focus on points of interest in policies: Security levels in multilevel security models. Unclassified, Confidential, Secret, Top Secret Separation of duty in Clark-Wilson model. Conflict of interest in Chinese Wall model. CSC 482/582: Computer Security

  46. Types of Security Policies Military (governmental) security policy • Policy primarily protecting confidentiality. Commercial security policy • Policy primarily protecting integrity. Confidentiality policy • Policy protecting only confidentiality. Integrity policy • Policy protecting only integrity. CSC 482/582: Computer Security

  47. Key Points • Policies describe what is allowed. Policy languages like PAM, SELinux, describe policies. • Mechanisms control how policies are enforced. • Types of Access Control • Discretionary (DAC) • Mandatory (MAC) • Originator Based (ORBAC) • Trust underlies everything. CSC 482/582: Computer Security

  48. References • Anderson, Ross, Security Engineering, Wiley, 2001. • David E. Bell and Leonard J. LaPadula, Secure Computer System: Unified Exposition and MULTICS Interpretation, MTR-2997 Rev. 1, The MITRE Corporation, Bedford, MA 01730 (Mar. 1976) http://csrc.nist.gov/publications/history/bell76.pdf • Bishop, Matt, Introduction to Computer Security, Addison-Wesley, 2005. • Department of Defense, Trusted Computer System Evaluation Criteria, DoD 5200.28-STD (“Orange Book”), National Computer Security Center, Ft. Meade, MD 20755 (Dec. 1985) http://csrc.nist.gov/publications/history/dod85.pdf • Peter Loscocco and Stephen Smalley, “Integrating Flexible Support for Security Policies into the Linux Operating System,” Proceedings of the FREENIX Track of the 2001 USENIX Annual Technical Conference, 2001. CSC 482/582: Computer Security

More Related