February 2, 2022 Outline

Reading: text, §20.4, 6.1, 6.3
Assignments: Homework #2, due February 4

Module 26

1. Techniques to support implementation assurance
   1. Implementation considerations
   2. Implementation management
   3. Testing
2. Operation and Maintenance Assurance

Module 27

3. Integrity policy requirements
4. Biba model
   1. Low-water-mark policy
   2. Ring policy
   3. Strict integrity
   4. LOCUS

Module 28

5. Clark-Wilson Model
   1. Theme: military model does not provide enough controls for commercial fraud, etc. because it does not cover the right aspects of integrity
   2. Data items: “Constrained Data Items” (CDI) to which the model applies, “Unconstrained Data Items” (UDIs) to which no integrity checks are applied, “Integrity Verification Procedures” (IVP) that verify conformance to the integrity specification when IVP is run, “Transaction Procedures” (TP) takes system from one well-formed state to another

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 235B, Foundations of Computer and Information Security Version of February 3, 2022 at 11:03PM

You can also obtain a PDF version of this.