Thursday, September 20. 2007
NOTABLE THREATS TO SECURITY MODELS AND ARCHITECTURES
COVERT CHANNELS
• A way for an entity to receive information in an unauthorized manner
• Information flow that is not controlled by a security mechanism
• Two types:
o Covert Timing Channel
One process relay information to another by modulating its use of system resources
Modulation of system resources can be accessing he hard drive, using excessive CPU cycles or head placement on a hard drive track
o Covert Storage Channel
When a process writes data to a storage location and another process directly, or indirectly, reads it
Occurs when the processes are at different security levels and therefore not supposed to be sharing sensitive data
• Countermeasures: Auditing and IDS
Continue reading "NOTABLE THREATS"
Thursday, September 20. 2007
OPEN SYSTEMS
• Systems that have architecture that has published specifications, which enable third party vendors to develop add-on components and devices
• Provides interoperability between products by different vendors of different operating systems, applications and hardware devices
Continue reading "OPEN VERSUS CLOSED SYSTEMS"
Thursday, September 20. 2007
CERTIFICATION
• The technical evaluation of the security components and their compliance for the purpose of accreditation
• Will indicate the good, the bad, and he ugly about the security protection level and the mechanisms that support it within these systems and how hey work within the given environment
• The process of assessing he security mechanisms and controls and evaluating their effectiveness
Continue reading "CERTIFICATION VERSUS ACCREDITATION"
Thursday, September 20. 2007
• Developed to address the need for an international standard evaluation criteria to be used globally
• Several organizations came together to combine and align existing and emerging evaluation criteria (TCSEC, ITSEC, Canadian Trusted Computer Product Evaluation Criteria (CTCPEC) and the Federal Criteria)
• Helps consumers by reducing the complexity of the ratings and eliminating the need to understand the definition and meaning of different ratings within different evaluation schemes
• Helps manufacturers because they can now build to one specific set of requirements if they want to sell their products internationally
• Provides more flexibility by evaluating a product against a protection profile, which is structured to address specific security problems
• Developed to stick to evaluation classes, but also to retain some degree of flexibility
• Works to answer two basic and general questions about products being evaluated:
o What does it do? (Functionality)
o How sure are you of that functionality? (Assurance)
Continue reading "COMMON CRITERIA"
Thursday, September 20. 2007
INFORMATION TECHNOLOGY SECURITY EVALUATION CRITERIA (ITSEC)
• The first attempt of establishing a single standard for evaluating security attributes of computer systems by many European countries
Continue reading "ITSEC"
Thursday, September 20. 2007
• Books that were written to extend the coverage of the Orange Book into other areas of security
• Provide detailed information and interpretations of certain Orange Book requirements and describe the evaluation processes
• Books are collectively called the “Rainbow Series” because each book has a different color cover
Continue reading "RAINBOW SERIES"
Thursday, September 20. 2007
• Officially known as the TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA (TCSEC)
• Used to evaluate operating systems, applications, and systems
• Was published in a book with an orange cover and hence the Orange Book moniker
• Evaluates products to assess if they contain the security properties they claim and evaluate if the product is appropriate for a specific application or function
• Looks at the functionality, effectiveness, and assurance of a system during its evaluation and I uses classes that were devised to address typical patterns of security requirements
Continue reading "THE ORANGE BOOK"
Thursday, September 20. 2007
• Describes the security conditions under which he system actually functions
• Four modes:
o Dedicated security mode
o System-high security mode
o Compartmented security mode
o Multilevel security mode
Continue reading "SECURITY MODES OF OPERATION"
Thursday, September 20. 2007
• Important concept in the design and analysis of secure systems
• Incorporates the security policy that should be enforced in the system
• A symbolic representation of a policy
• Maps the desires of the policy makers into a set of rules that are o be followed by a computer system
• Maps the abstract goals of the policy to information systems terms by specifying explicit data structures and techniques necessary to enforce the security policy
• Usually represented in mathematics and analytical ideas, which is then mapped to system specifications, and then developed by programmers through programming code
• Some security models enforce rules to protect confidentiality, Bell-LaPadulla
• Some models enforce rules to protect integrity, Biba
• Formal security models, such as Bell-LaPadula, are used to provide high assurance in security
• Informal security models, such as Clark-Wilson, are used more as a framework to describe how security policies should be expressed and executed
Continue reading "SECURITY MODELS"
Thursday, September 20. 2007
TRUSTED COMPUTING BASE (TCB)
• The total combination of protection mechanisms within a computer system
• Includes hardware, software and firmware – the system trusts that these components will enforce the security policy and not violate it
• Components that do not fall under the TCB needs to be identified and their accepted capabilities defined
• The term originated from he Orange Book and does not address the level of security a system provides, but the level of trust
• Does not just address operating systems, also addresses hardware, software, components and firmware
Continue reading "SYSTEM ARCHITECTURE"
Thursday, September 20. 2007
• Encompasses all the parts of a computer system necessary for it to function, including the operating system, memory chips, circuits, hard drive, security components, buses and networking components
Continue reading "COMPUTER ARCHITECTURE"
Thursday, September 20. 2007
• Fundamental concepts in computer and information security
o SECURITY MODEL – outlines how security is to be implemented
o SECURITY ARCHITECTURE – the framework and structure of a system
Continue reading "SECURITY MODELS AND ARCHITECTURE"
Thursday, September 20. 2007
by: Don Clariza
“The Menace in Your Midst” is a series of Blog Entries wherein I will talk about the threat of insiders within organizations, wherein they can become knowing or unknowing accomplices or liability to the confidentiality, integrity and availability on information within an organization. We will also look at possible solutions in addressing this serious issue.
PART IV - DISHONESTY
It is about trust
UBS Paine-Webber realized the value what is at stake in trusting their employees. Roger Duronio, who worked as a systems administrator for UBS Paine-Webber, was sentenced last year to spend up to eight years in prison for planting a logic bomb intended to sabotage the company’s information technology infrastructure. After planting the malicious software that disabled much of UBS’ network, Duronio then made financial bets that will pay off if the company’s stock goes down as a result of the attack. The sentence pretty much will more than likely make the then 63 year old Duronio spend the rest of his life in jail.
Continue reading "The Menace in Your Midst - Part IV"
Thursday, September 6. 2007
In August of 2005, the Federal Government's Office of Management & Budget released OMB Memorandum 05-22, which mandates that the networks of all government agencies be transitioned from IPv4 to IPv6 by June 30, 2008. With the deadline looming, the industry is abuzz with the potential boost to this protocol and its acceptance within the private sector.
Continue reading "Federal Mandate to Transition to IPv6 Has Broad Implications"
TREHB101
