Outline for January 29, 2003

Discussion Problem

A company by the fictitious but real-sounding name of PC Surveys sent me a program that collects statistical information about the programs I use, the frequency with which I use them, the commands I execute within them, and the size of the documents I use them on. When enough data is collected, the program will connect to the PC Surveys web site, and download the data using an enciphered link. The program would continue collecting and transmitting this data for a year. In exchange, each month I would receive a gift worth $10, and after 1 year they would give me a game of my choice (list price not to exceed $39.95).

Two of my children think this is a great idea. My spouse, and my other child, think it isn't.

1. What do you think?
2. If it's a bad idea for me to install this program, what could the company do to convince me it's okay?

Outline for the Day

1. Access Control Matrix
   1. Copy flag
   2. Attenuation of privileges
2. HRU Result
   1. Notion of leakage in terms of ACM
   2. Determining security of a generic system with generic rights is undecidable
   3. Meaning: can't derive a generic algorithm; must look at (sets of) individual cases
3. Policy
   1. Sets of authorized, unauthorized states
   2. Secure systems in terms of states
   3. Mechanism vs. policy
4. Types of Policies
   1. Military/government vs. confidentiality
   2. Commercial vs. integrity
5. Types of Access Control
   1. Mandatory access control
   2. Discretionary access control
   3. Originator-controlled access control
6. High-Level Policy Languages
   1. Characterization
   2. Example: DTEL
7. Low-Level Policy Languages
   1. Characterization
   2. Example: Tripwire configuration file