Lecture 12 Outline

Reading: text, §4, 5
Due: Homework 3, on May 12

  1. Greetings and felicitations!
    1. Announce change of due date to Homework 3
    2. Announce secure programming clinic
    3. Discussion question
  2. Low-level policy languages
    1. Characterization
    2. Example: tripwire configuration file
  3. Policies in natural language
  4. Goals of confidentiality policies
  5. Bell-LaPadula Model with levels only
    1. Security levels
    2. Simple security property
    3. *-property
    4. Discretionary security property
  6. Full Bell-LaPadula Model
    1. Add in compartments
    2. dom relation
    3. BLP as lattice structure
    4. Simple security property
    5. *-Property
    6. Discretionary security property
  7. Range of levels
  8. Basic Security Theorem
Discussion question. An eighth grade school student in Florida shoulder-surfed a teacher he didn’t like typing in a password. He used that password to log into the teacher’s account and changed the wallpaper. The password, like all passwords on the school network, was the last name of the teacher (user), and teachers had administrative privileges on the network.

The student was first suspended for 10 days. But on April 2, 2015, the Pasco County sheriff filed felony charges against the student. The sheriff stated that he filed the charges because the teacher’s computer had “encrypted 2014 FCAT [Florida Comprehensive Assessment Test] questions”, although he admitted the student “did not view or tamper with those files.” He added “Even though some might say this is just a teenage prank, who knows what this teenager might have done.”

Do you think the student should have been suspended? Should he have been charged with a felony?

UC Davis sigil
Matt Bishop
Office: 2209 Watershed Sciences
Phone: +1 (530) 752-8060
Email: mabishop@ucdavis.edu
ECS 153, Computer Security
Version of May 4, 2016 at 11:28PM

You can also obtain a PDF version of this.