ICS 355 Resource Security

What is a resource?

A resource is whatever we (humans, animals, organisms) compete for.

Is a resource easy to use but hard to come by

True

What is an asset?

a resource that can be secured

What do privately owned assets require?

authorization

What do publicly owned assets require?

availability

What makes a protection effective

If it is cost effective

How is static access control enforced

preventing accesses in access matrix that are not permitted in permission matrix

What is a permission matrix

All of the actions that a subject is permitted to execute on an object

What is an access matrix?

All of the actions the subject attempts to execute on an object

What do unix like OSes use for access controls?

ACLs (Access control lists)

What is an access control list (ACL)?

actions permitted on an object based on groups

What do androids use for access control?

capabilities list

what is a capabilities list?

Subject based permissions

What does a clearance structure consist of

1. list of clearances

2. list of subject locations

3. list of object locations

What is the history of Multi level security

Security tokens → Money → Numeral Systems → alphabets

What does a security model consist of?

permission matrix, access matrix, clearance map, and location map

What are the four requirements for a state to be secure?

authorization, clearance, no read up, no write down

what is discretionary access control (DAC)?

where the authorizations can be delegated

what is mandatory access control (MAC)

where the authorizations are centrally managed

Are AC and MLS static models?

True

What is AC more convenient for? What is MLS more convenient for?

AC is convenient for local security. MLS is more convenient for distributed systems

What are the similarities between AC and MLS

They both allow declaring security requirements and do not allow validating when the requirements are satisfied