CYBR 3300 - Chapter 8

Four processes of access controls

1. Obtaining the identity of the entity request access to a logical or physical area (identification) 2. Confirming the identity of the entity seeking access to a logical or physical area (authentication) 3. Determining which actions an authenticated entity can perform in that physical or logical area (authorization) 4. Documenting the activities of the authorized individual and systems (accountability)

timing channels

A TCSEC-defined covert channel that communicates by managing the relative timing of events.

security clearance

A personnel security structure in which each user of an information asset is assigned an authorization level that identifies the level of classified information he or she is "cleared" to access.

mandatory access control (MAC)

A required, structured data classification scheme that rates each collection of information as well as each user. These ratings are often referred to as sensitivity or classification levels.

lattice-based access control

A variation on the MAC form of access control, which assigns users a matrix of authorizations for particular areas of access, incorporating the information assets of subjects such as users and objects.

discretionary access controls (DACs)

Access controls that are implemented at the discretion or option of the data user.

nondiscretionary controls

Access controls that are implemented by a central authority.

dumpster diving

An information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

Information Technology System Evaluation Criteria (ITSEC)

An international set of criteria for evaluating computer systems, very similar to TCSEC Targets of Evaluation (ToE) are compared to detailed security function specifications, resulting in an assessment of systems functionality and comprehensive penetration testing was, for the most part, functionally replaced by the Common Criteria rates products on a scale of E1 (lowest) to E6 (highest)

Common Criteria for Information Technology Security Evaluation

An international standard (ISO/IEC 15408) for computer security certification that is considered the successor to TCSEC and ITSEC reconciles some of the differences between the various other standards This and CEM are the technical basis for CCRA Seeks the widest possible mutual recognition of secure IT products process assures that the specification, implementation, and evaluation of computer security products are performed in a rigorous and standard manner

Security Clearances

Another component of a data classification scheme each user of an information asset is assigned an authorization level that identifies the level of information classification he or she can access Accomplished by assigning each employee to a names role Most organizations have developed roles and corresponding _________ so individuals are assigned into authorization levels correlating with the classifications of the information assets

ISO/IEC 27001's primary purpose

Be used as a standard so organizations can adopt it to obtain certification and build an info sec program Serves better as an assessment tool than as an implementation framework

ISO/IEC 27000:2013

Broad overview of the various areas of security Provides information on 14 security control clauses and addresses 35 control objectives and more than 110 individual controls

Security functional requirements (SFRs)

Catalog of a product's sec functions

Clean desk policy

Control that managers can use to maintain the confidentiality of classified documents Risk management control Requires each employee to secure all information in its appropriate storage container at the end of every business day

Managerial

Controls that cover security processes designed by strategic planners, integrated into the organization's management practices, and routinely used by security administrators to design, implement, and monitor other control systems

Operation (or administrative)

Controls that deal with the operational functions of security that have been integrated into the repeatable processes of the organization

EAL Scale

EAL1: Functionally tested EAL2: Structurally tested EAL3: Methodically tested and checked EAL$: Methodically designed, tested, and reviewed EAL5: Semiformally designed and tested EAL6: Semiformally verified design and tested EAL7: Formally verified design and tested

Directive

Employs administrative controls such as policy and training designed to proscribe certain user behavior in the organization

Non-NSi Government classification

For Official Use Only (FOUO) Sensitive but Unclassified (SBU) Law Enforcement Sensitive (LES)

Preventative

Helps an organization avoid an incident

Dumpster bins

If located on public property, individuals may not be violating the law to search through them If located on private property, individuals may be charged with trespassing

blueprint

In Information security, a framework or security model customized to an organization, including implementation details includes information on how to get to the end product

capabilities table

In a lattice-based access control, the row of attributes associated with a particular subject (such as a user).

framework

In infosec, a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including infoSec policies, security education and training programs, and technological controls. AKA security model

Temporal (time-based) isolation

In some cases, access to information is limited by a time-of-day constraint Physical example: time-release safe

Internal benchmarking

Known as baselining Involves comparing organizational performance at some defined state against current or expected performance

Key principles of access control

Least privilege Need-to-know Separation of duties

Organizational classification scheme

Most orgs working outside of national security don't need the detailed level of classification Confidential, internal, and external •Data owners must classify the information assets for which they are responsible and review the classifications periodically •Public - for general public dissemination •For official (or internal) use only - not for public release but not sensitive •Confidential (or Sensitive) - essential and protected information, could severely damage the finances or reputation

Role-based controls

Nondiscretionary controls that are based on a role are tied to the role that a particular user performs in an organization, whereas task-based controls are tied to a particular assignment or responsibility

Task-based controls

Nondiscretionary controls that are based on a specified set of tasks Can be based on lists maintained on subjects or objects Tied to a particular assignment, project, or responsibility

Rule-based access control

One discretionary model access is granted based on a set of rules specified by the central authority The individual user is the one who creates the rule

ISO/IEC 27001:2013

Provides information for how to implement ISO/IEC 27002 and set up an ISMS

Corrective

Remedies a circumstance or mitigates damage done during an incident

Compensating

Resolves shortcomings

Recovery

Restores operating conditions back to normal

Constrained user interfaces

Some systems are designed specifically to restrict what information an individual user can access The most common example: ATMs

TCSEC defined two types of channels

Storage channels Timing channels

Categories of Access Conrols

Table 8-6, pg. 441

Access control list (ACL)

The column of attributes associated with a particular object within lattice-based access control

Benchmarking

The comparison of two related measures Describes both internal and external comparisons Can provide details on how controls are working or which new controls should be considered, but it does not provide implementation details that explain how controls should be put into action

least privilege

The data access principle that ensures no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation needed. Least privilege implies a need to know. The principle by which members of the organization can access the min amount of info for the min amount of time necessary Presumes a need to know and implies restricted access to the level required

separation of duties

The information security principle that requires significant tasks to be split up so that more than one individual is required to complete them Reduces the chance of an individual violating InfoSec policy and breaching the confidentiality, integrity, and availability of the information

need-to-know

The principle of limiting users' access privileges to only the specific information required to perform their assigned tasks. This principle limits a user's access to only the specific information required to perform the currently assigned task

Evaluation assurance lev

The rating or grading of a ToE after evaluation

access control

The selective method by which systems specify who may use a particular resource and how they may use it. regulate the admission of users into trusted areas of the organization—both the logical access to the information systems, or the physical access to the organization's facilities maintained by means of a collection of policies, programs to carry out those policies, and technologies that enforce policies enables the organization to restrict access to information, information assets, and other tangible assets to those with a bona fide business need

Target of Evaluation (TOE)

The system being evaluated

Compartmentalization

The use of specialty classification schemes The restriction of information to the very fewest people possible to prevent compromise or disclosure to unauthorized people

Protection Profile (PP)

User-generated specification for sec reqs

ISO/IEC 27002 is focused on

a broad overview of the various areas of security, providing information on 127 controls over 10 areas,

A collection of users with access to the same data typically has

a centralized access control authority

Methodology

a formal way of accomplishing a task Usually recommended or endorsed by an organization or group of experts in a particular field

state machine model

a model in which the design follows a conceptual approach in which the state of the content of the system being modeled is always in a known secure condition, in other words, this kind of model is provably secure Provably secure

Lattice-Based Access Controls

a variation on the MAC form of access control •assigns users a matrix of authorizations for particular areas of access contains subjects and objects, and the boundaries associated with each subject/object pair are clearly demarcated Then specifies the level of access each subject has to each object, if any

Content-dependent access controls

access to a specific set of information may be dependent on its content

One way to select a methodology is to

adapt or adopt an existing security management model or set of practices •Because each InfoSec environment is unique, you may need to modify or adapt portions of several frameworks; what works well for one organization may not precisely fit another

Simple security

also called the read property •prohibits a subject of lower clearance from reading an object of higher classification, but allows a subject with a higher clearance level to read an object at a lower level (read down)

Nondiscretionary Controls

are determined by a central authority in the organization and can be based on roles—called role-based access controls or RBAC—or on a specified set of tasks—called task-based controls Make it easier to maintain controls and restrictions

Classified documents must be accessible only to

authorized individuals, which usually requires locking file cabinets, safes, or other such protective devices for hard copies ad physical systems

An information asset that has a classification designation other than unclassified or public must

be clearly marked as such - with a cover page and headers & footers

Clark-Wilson Integrity Model

built upon principles of change control rather than integrity levels was designed for the commercial environment

When copies of classified information are no longer valuable or too many copies exist

care should be taken to destroy them properly to discourage dumpster diving

Brewer-Nash Model (Chinese Wall)

commonly known as a Chinese Wall designed to prevent a conflict of interest between two parties requires users to select one of two conflicting sets of data, after which they cannot access the conflicting data

A system that serves as a reference monitor

compares the level of classification of the data with the clearance of the entity requesting access; it allows access only if the clearance is equal to or higher than the classification

When someone carries a classified report, it should be

concealed, kept in a locked briefcase or portfolio and in compliance with appropriate policies

The less critical the protected information, the more

controls tend to be decentralized

Harrison-Ruzzo-Ullman (HRU) model

defines a method to allow changes to access rights and the addition and removal of subjects and objects, a process that the Bell-LaPadula model does not •Since systems change over time, their protective states need to change built on an access control matrix and includes a set of generic rights and a specific set of commands By implementing this set of rights and commands and restricting the commands to a single operation each, it is possible to determine if and when a specific subject can obtain a particular right to an object

The communities of interest accountable for the security of an organization's information assets must

design a working security plan and then implement a management model to execute and maintain that plan •This may begin with the creation or validation of a security framework, followed by an InfoSec blueprint that describes existing controls and identifies other necessary security controls Framework > blueprint

To generate a usable security blueprint, most organizations

draw on established security frameworks, models, and practices The model you choose must be flexible, scalable, robust, and sufficiently detailed

U.S. government's three-level classification scheme

for information deemed to be National Security Information (NSI), Executive Order 13526 •Top Secret - could be expected to cause exceptionally grave damage to the national security •Secret - could be expected to cause serious damage to the national security •Confidential - could be expected to cause damage to the national security

aspects of information asset life cycle

from specification to design, acquisition, implementation, use, storage, distribution, backup, recovery, retirement, and destruction

Discretionary Access Controls (DACs)

implemented at the discretion or option of the data user The ability to share resource in a peer-to-peer configuration allows users to control and possible provide access to information or resources at their disposal Users can allow general, unrestricted access, or they can allow specific individuals or sets of individuals to access these resources Most personal computer operating systems are designed bsed on this model

The original purpose of ISO/IEC 27002

offer guidance for the management of InfoSec to individuals responsible for their organization's security programs the standard was "intended to provide a common basis for developing organizational security standards and effective security management practice and to provide confidence in inter-organizational dealings"

The level of centralization appropriate to a given situation varies by

organization and the type of information protected

simple integrity property

permits a subject to have read access to an object only if the security level of the subject is either lower or equal to the level of the object

Every classified document should also contain the appropriate

security designation in its headers at the top of each page and at the bottom of each page

ISO 27002 is for organizations

that want information about implementing sec controls Not a standard used for certification

elements of the Clark-Wilson model

•Constrained data item (CDI)—Data item with protected integrity •Unconstrained data item—Data not controlled by Clark-Wilson; nonvalidated input or any output •Integrity verification procedure (IVP)—Procedure that scans data and confirms its integrity •Transformation procedure (TP)—Procedure that only allows changes to a constrained data item. All subjects and objects are labelled with TPs. Operate as the intermediate layer between subjects and objects

eight primitive protection rights

•Create object •Create subject •Delete object •Delete subject •Read access right • Grant access right •Delete access right Transfer access right

One of the most widely referenced and often discussed security models is

•Information Technology - Code of Practice for Information Security Management, originally published as British Standard BS 7799 - later published as ISO/IEC 17799, then as ISO/IEC 27002

Three approaches to categorize access controls

1. Inherent characteristics - directive, deterrent, preventative, detective, etc. 2. Operational impact - managerial, operational, technical 3. Degree of authority - mandatory, nondiscretionary, or discretionary

storage channels

A TCSEC-defined covert channel that communicates by modifying a stored object, such as in steganography.

Technical

Controls that support the tactical portion of a sec program and that have been implemented as reactive mechanisms to deal with the immediate needs of the organizations as it responds to the realities of the technical environment

TCSEC Levels of Protection

D: Minimal protection - Default evaluation when a product fails to meet any of the other requirements C: Discretionary protection B: Mandatory protection A: Verified protection pg. 436

Detective

Detects or identifies an incident or threat when it occurs

Deterrent

Discourages or deters an incipient incident

Security Target (ST)

Document describing the ToE's sec properties

External benchmarking

Involves comparing one's organizational results against other similar organizations

The states purpose of ISO/IEC 27002, as derived from its ISO/IEC 17799 origins

Offer guidelines and voluntary directions for information security management Meant to provide a high level, general descriptiong of the areas currently considered important when initiating, implementing, or maintaining information security Specifically identifis itself as a starting point for developing organization specific guidance Not all guidance control in it may be applicable Not intended to give definitive how-tos.

Several countries refused to adoppt it, claiming that it had the following fundamental problems

The global information sec community had not defined any justification for a code of practice identified in ISO/IEC 17799 The standard lacked the measurement precision associated with a technical standard There was no reason to believe that ISO/IEC 17799 was more useful than any other approach It was not as complete as other frameworks The standard was hurriedly prepared given the tremendous impact its adoption could have on industry information security controls

security model

see framework standards that are used for reference or comparison and often serve as the stepping-off point for emulation and adoption

Documents should be destroyed by means of

shredding, burning, or transfer to a service offering authorized document destruction policy should ensure that no classified information is inappropriately disposed of in trash

One way to determine how closely an organization is complying with ISO 27002 is to use

the SANS SCORE (Security Consensus Operational Readiness Evaluation) Audit Checklist, which is based on 17799:2005

California v. Greenwood

the Supreme Court ruled that there is no expectation of privacy for items thrown away in trash or refuse containers 1998

The level of authorization may vary depending on

the classification authorizations that individuals possess for each group of information assets or resources

We distinguish between framework, security model, and blueprint predominantly on

the level of detail provided

A framework or security model

the outline of the more thorough and organization-specific blueprint form the basis for the design, selection, and initial and ongoing implementation of all subsequent security controls, including policy, SETA and technologies describes what the end product should look like

Another way to create a blueprint is to look at

the paths taken by other organizations •In this kind of benchmarking, you follow the recommended practices or industry standards

capabilities table

the row of attributes associated with a particular subject (such as a user) in lattice-based access control.

The * property

the write property prohibits a high-level subject from sending messages to a lower-level object

Graham-Denning Access Control Model

three parts: a set of objects, a set of subjects, and a set of rights subjects are composed of two things: a process and a domain

ISO 27000 Series current and planned (Table 8-3, pg. 419)

•27000:2016 Series Overview and Terminology •27001:2013 InfoSec Mgmt System Specification •27002:2013 Code of Practice for InfoSec Mgmt •27003:2017 InfoSec Mgmt Systems Implementation Guidance •27004:2016 InfoSec Measurements •27005:2011 ISMS Risk Management •27006:2015 Requirements for Bodies Providing Audit and Certification of an ISMS •27007:2011 Guidelines for ISMS Auditing •27008:2011 Guidelines for InfoSec Auditing •27010:2015 Guidelines for Inter-sector and Inter-organizational Communications •27011:2016 Guidelines for Telecomm orgs •27013:2015 Guideline on the Integrated Implementation of ISO/IEC 20000-1 and ISO/IEC 27001 •27014:2013 InfoSec Governance Framework •27015:2012 InfoSec Mgmt Guidelines for Financial Services •27016: 2014 InfoSec and Organizational Economics •27017:2015 Code of practice for InfoSec controls for cloud computing services based on ISO/IEC 27002 •27018:2014 Code of practice for PII protection in public clouds acting as PII processors •27019:2013 InfoSec Mgmt guidelines for process control systems specific to the energy industry •27023:2015 Mapping the revised editions of ISO/IEC 27001 and 27002 •27031:2012 Guidelines for information and communication technology readiness for business continuity •27032:2012 Guidelines for cybersecurity

Clark-Wilson Integrity Model change control principles

•No changes by unauthorized subjects •No unauthorized changes by authorized subjects •The maintenance of internal and external consistency

Clark-Wilson Integrity Model controls

•Subject authentication and identification •Access to objects by means of well-formed transactions •Execution by subjects on a restricted set of programs

Bell-LaPadula Confidentiality Model

•a state machine reference model that helps ensure the confidentiality of an information system by means of mandatory access controls (MACs), data classification, and security clearances Its security rules prevent infromation from being moved from a level of higher security to a level of lower security the principle is "no read up, no write down"

ISO/IEC 27001 provides information on

•how to implement ISO/IEC 27002 and how to set up an information security management system (ISMS)

integrity * property

•permits a subject to have write access to an object only if the security level of the subject is equal to or higher than that of the object

Mandatory Access Control (MAC)

•required and is structured and coordinated within a data classification scheme that rates each collection of information as well as each user •These ratings are often referred to as sensitivity levels or classification levels users and data owners have limited control over access to information resources

Biba Integrity Model

•similar to BLP based on the premise that higher levels of integrity are more worthy of trust than lower levels •The intent is to provide access controls to ensure that objects or subjects cannot have less integrity as a result of read/write operations Assigns integrity levels to subjects and objects using the simple integrity property (read) and the integrity (*) property (write) •ensures that no information from a subject can be passed on to an object in a higher security level •This prevents contaminating data of higher integrity with data of lower integrity •In short "no write up, no read down"