1.2 Security Policy Models

Different Frameworks and Theoretical Models for Security Policies

• Security policies are crucial to protect information systems from unauthorized access or misuse, thereby maintaining the confidentiality, integrity, and availability of data.

• Different frameworks or theoretical models offer structured approaches to developing and implementing these security policies.

• Common security policy models include:

  • Bell-LaPadula Model: Focuses on data confidentiality.

  • Biba Model: Stresses data integrity.

  • Clark-Wilson Model: Emphasizes both integrity and access control mechanisms.

• Importance of security policy models:

  • They serve as blueprints for comprehensive security policies tailored to protect sensitive data and ensure compliance with regulatory standards.

  • Each model addresses key security objectives: confidentiality, integrity, and access control.

  • Understanding these models is essential for effective security measures and risk mitigation associated with data breaches and cyber threats.

Why Access Control Matters

• Most security violations manifest as breaches of access control policies.

• According to the 2025 Verizon Data Breach Investigations Report:

  • Stolen credentials accounted for roughly 22% of confirmed breaches.

  • 20% of breaches exploited known vulnerabilities.

  • More than half (54%) of edge devices remained unpatched for over 32 days.

• The expansion of hybrid work and cloud adoption complicates identity management, thus necessitating robust access control policies.

• Effective enforcement of access control mechanisms is essential to reduce opportunities for breaches and contain them when they occur.

Access Control Mechanisms

• Multiple types of access control mechanisms used in information security:

  • Discretionary Access Control (DAC):

    • Users set their own access permissions for resources.

    • Also known as identity-based access control; based on the identity of the user.

  • Mandatory Access Control (MAC):

    • Dictated access permissions; individual users cannot alter them.

    • Known as rule-based access control, enforcing strict policies defined by the system.

  • Originator-Controlled Access Control:

    • Access permissions are determined by the creator of the object.

    • Emphasizes the creator's intent in access management.

Security Policy Models Overview

• Security models represent sets of policies designed to abstract and simplify complex details relevant to analysis.

• They allow focused examination of characteristics, improving understanding and evaluation of policy effectiveness.

Bell-LaPadula Model

• A foundational model for maintaining information confidentiality.

• Confidentiality Policy (or information flow policy) prevents unauthorized disclosure of information.

• Primarily used in military and governmental contexts, it uses:

  • Security Classifications for information (objects).

  • Security Clearances for individuals (subjects).

• Objective:

  • Restrict access so subjects cannot read information classified at a higher level than their clearance allows.

Security Levels in Bell-LaPadula

• Security levels consist of a clearance level $L$ and a set of categories $C$.

• The Rule of Dominance states that security level $(L, C)$ dominates $(L', C')$ if:

  • The clearance level of the dominated security level ($L'$) must be less than or equal to the clearance level of the dominating security level ($L$).

  • The set of categories of the dominated security level ($C'$) must be a subset of the categories of the dominating security level ($C$).

• This structure ensures sensitive information is accessed only by those with necessary clearance.

Basic Security Theorem

• Essential for understanding access control in secure systems:

  • Simple Security Condition (or “no read up”): A subject can read an object only if the subject's security level is higher or equal to that of the object.

  • Star Property (or “no write down”): A subject can write to an object only if the object's level is higher.

• The theorem asserts:

  • If a system starts in a secure state, and transitions comply with these conditions, it remains secure.

Example: Bell-LaPadula Model

• Clearance levels from highest to lowest:

  • Top Secret, Secret, Confidential, Unclassified.

• Bell-LaPadula rule: Subjects can only read down and write up, ensuring data confidentiality and preventing unauthorized disclosures.

Biba Integrity Model

• Focused on preserving data integrity in access control systems.

• Subjects and objects are associated with integrity levels.

• Integrity labels aim to prevent unauthorized modification of information.

• Information transfer paths are critical to maintain integrity across transactions, controlling how data is accessed and altered.

Low-Water-Mark Policy

• Governs interactions between subjects and objects based on their integrity levels:

  1. Subjects can write to objects only if the object's integrity level is less than or equal to the subject's integrity level.

  2. Reading from an object updates the subject's integrity level to the minimum of the current and object's integrity levels.

  3. A subject can execute another only if the executed subject's integrity level is less than or equal to their own.

Ring Policy

• Access governs interactions between subjects and objects:

  1. Any subject can read any object, regardless of integrity.

  2. Subjects can write to objects only if the object's integrity level is less than or equal to the subject's integrity.

  3. Execution of another subject's process requires the integrity level of the process to be less than or equal to that of the executing subject.

Chinese Wall Model

• Addresses both confidentiality and integrity, especially where conflicts of interest arise.

• Key concepts include:

  • Objects: information related to companies.

  • Company Dataset (CD): a collection of information pertaining to a single company.

  • Conflict of Interest (COI) Class: categorizes datasets from competing companies.

• Notations:

  • $CD(O)$: the company dataset containing object O.

  • $COI(O)$: the conflict of interest class containing object O.

Role-Based Access Control (RBAC)

• Simplifies authorization by assigning permissions to roles, which are then mapped to users.

• Core Rules:

  • Role Assignment: Users must assume roles before exercising permissions.

  • Role Authorization: Users can assume only authorized roles.

  • Permission Authorization: Permissions must align with the active role.

• Supports separation of duties and scales effectively.

Other Access Control Models

• Attribute-Based Access Control (ABAC): Evaluates attributes dynamically at runtime, reflecting context-aware policies.

• Take-Grant Model: Utilizes directed graphs to represent rights propagation; theoretical in nature.

• Graham-Denning Model: Defines primitive operations for secure management of subjects and objects.

Zero Trust Architecture

• Assumes no implicit trust, necessitating authentication and authorization for every connection.

• Enforces policies via a central engine, with micro-segmentation applying least-privilege rules.

• Continuous monitoring specifies adaptive responses to evolving threats, ideal for remote work and cloud.

Privacy and Compliance – GDPR

• Enforced May 2018; the toughest privacy law globally; applies if dealing with EU resident data.

• Key principles:

  • Purpose limitation

  • Data minimization

  • Accuracy and integrity

  • Confidentiality and accountability.

• Compliance failure consequences: fines of up to €20 million or 4% of annual global turnover, whichever is higher.

Information Flow Control

• Foundation for reasoning about confidentiality and integrity in systems.

• Covert channels leverage shared resources to transmit data unnoticed, while side-channel attacks infer secrets using observable emissions.

Noninterference and Policy Composition

• Noninterference ensures actions in one domain do not impact another; crucial for preventing covert channels.

• Key principles:

  1. Autonomy Principle: Component policies must allow access permitted in isolation.

  2. Security Principle: Access prohibited by individual policies must remain denied in composition.

Covert and Side Channels

• Covert channels manipulate shared states or timing to discreetly transmit information.

• Side-channel attacks exploit unintended emissions from devices, including timing variations and power analysis.

Case Study: Spectre and Meltdown

• Speculative execution vulnerabilities may lead to significant data leaks across privilege barriers.

• Meltdown: Breaks user-kernel isolation, permitting unauthorized memory reads.

• Spectre: Mis-trains branch predictors to access sensitive data using timing/cache side effects.

• Mitigations incur performance trade-offs and emphasize severe impacts on computing environments.

Defenses Against Covert and Side-Channel Attacks

• Hardware Measures: Cache partitioning, DRAM protections, and microarchitectural randomization.

• Software Measures: Noise injection, memory layout randomization, and speculation barriers.

• Cryptographic Countermeasures: Constant-time implementations to obscure observable behavior.

SELinux and Layered Defense

• SELinux implements mandatory access control within Linux through labeled contexts for objects and processes, combining DAC and policy enforcement.

• Organizations should integrate multiple access control models for comprehensive security, prioritizing key frameworks like Bell-LaPadula and Biba.