Notes for February 7, 1997

1. Hello
   1. Homework grades will be mailed back as soon as we're done ... programs are the bottleneck. Sorry!
2. Puzzle of the day
   1. Key point: make sure anyone who needs to know is told, especially those in charge of security across the network and in systems
3. Bell-LaPadula Model
   1. Simple Security Property: no reads up
   2. Star Property: no writes down
   3. Discretionary Security Property: if mandatory controls say it's okay, check discretionary controls.
   4. Then add categories:
      simple security property is S cannot read O if L(S) < L(O) or C(O) not subset of C(S);
      star property is S cannot write O if L(O) < L(S) or C(S) not subset of C(O)
   5. Basic Security Theorem: A system is secure if its initial state is secure and no action violates the above rules.
4. ORCON (Originator Controlled; Graubert)
   1. Document/information can be passed on with approval of originator; real world justification is that originator of document trusts recipients not to release documents which they should not.
   2. Untrusted subject x marks object O ORCON on behalf of organization X and indicates it is releasable to subjects acting on behalf of organization Y.
      not releasable to subjects acting on behalf of other organizations without X's permission
      any copies made have the same restriction
   3. DAC: can't do this as the restriction would not copy over (y reads O into C, puts its own ACL on C)
   4. MAC: separate category with O, x, y. y wants to read O, copy to C; MAC means C has same category as O, x, y, so can't give z access to C.
      Say a new organization w wants to provide data in B to y but not to be shared with x or z. Can't use O's category. Hence you get explosion of categories.
      Real world parallel: individuals are "briefed" into a category and those represent a formal "need to know" policy that is standard across the entity; ORCON has no central clearinghouse to categorize data; originator makes rules.
5. Solution?
   1. owner of object can't change ACL's relationship with object (MAC characteristic)
   2. on copy, ACL is copied as well (MAC characteristic)
   3. access control restrictions can be tailored on a per-subject/object basis (DAC characteristic)