Homework 1

Due: October 5, 2022
Points: 100

1. (25 points) An organization makes each lead system administrator responsible for the security of the system he or she runs. However, the management determines what programs are to be on the system and how they are to be configured.
   1. Describe the security problem(s) that this division of power would create.
   2. How would you fix them?

2. (25 points) A program called lsu gives access to role accounts. The user’s access rights are checked, and the user is required to enter her password. If access rules allow the change and the user’s password is correct, lsu allows the change. Given that Mary uses lsu from her account, why does lsu require her to enter her password? Name the principles involved, and why they require this.

3. (25 points) Given the security levels TOP SECRET, SECRET, CONFIDENTIAL, and UNCLASSIFIED (ordered from highest to lowest), and the categories A, B, and C, specify what type of access (read, write, both, or neither) is allowed in each of the following situations. Assume that discretionary access controls allow anyone access unless otherwise specified.
   1. Paul, cleared for ( SECRET, { B, C } ), wants to access a document classified ( TOP SECRET, { A, C } ).
   2. Anna, cleared for ( CONFIDENTIAL, { B } ), wants to access a document classified ( CONFIDENTIAL, { C } ).
   3. Jesse, cleared for ( CONFIDENTIAL, { C } ), wants to access a document classified ( SECRET, { C } ).
   4. Sammi, cleared for ( CONFIDENTIAL, { A } ), wants to access a document classified ( TOP SECRET, { A, C } ).
   5. Robin, who has no clearances (and so works at the UNCLASSIFIED level), wants to access a document classified ( SECRET, { A } ).

4. (25 points) In the Clark-Wilson model, must the TPs be executed serially, or can they be executed in parallel? If the former, why? If the latter, what constraints must be placed on their execution?

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 235A, Computer and Information Security Version of September 19, 2022 at 9:21PM

You can also obtain a PDF version of this.