CYS401 · Chapter 7 · Annotated SlidesSecurity Design Models and Capabilities
Original
Overview

Security Design Models and Capabilities

Security architecture principles (security by design, least privilege, default deny, separation of duties, zero trust, micro-segmentation…), architecture flaws (covert channels, maintenance hooks), process isolation and protection rings, and the security models: TCB, access control matrix, take-grant, Bell-LaPadula, Biba. Both Final 221 papers asked about least privilege, isolation, take-grant and Bell-LaPadula.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 31 slides
  1. 1 Security Design Models and Capabilities
  2. 2 Slide 2
  3. 3 Security Architecture principles
  4. 4 Why Security Design Matters
  5. 5 • Core Security Architecture principles, which are considered fundamental within the information security community are:
  6. 6 Security Architecture principles
  7. 7 Security Architecture principles
  8. 8 Security Architecture principles
  9. 9 Security Architecture principles
  10. 10 Security Architecture principles
  11. 11 Security Architecture principles
  12. 12 Security Architecture principles
  13. 13 Security Architecture principles
  14. 14 Security Architecture principles
  15. 15 Security Architecture principles
  16. 16 Security Architecture principles
  17. 17 Common Architecture Flaws and Security Issues 1/2
  18. 18 Common Architecture Flaws and Security Issues 1/2
  19. 19 Techniques for Ensuring Confidentiality, Integrity, and Availability
  20. 20 Techniques for Ensuring Confidentiality, Integrity, and Availability
  21. 21 Techniques for Ensuring Confidentiality, Integrity, and Availability
  22. 22 Techniques for Ensuring Confidentiality, Integrity, and Availability
  23. 23 Techniques for Ensuring Confidentiality, Integrity, and Availability
  24. 24 Security Models
  25. 25 Security Models
  26. 26 Security Models
  27. 27 Access Control Matrix
  28. 28 Take-Grant Model
  29. 29 Bell-LaPadula Confidential Model
  30. 30 Biba Integrity Model
  31. 31 Slide 31
Slide 1 / 31

Security Design Models and Capabilities

Slide 1: Security Design Models and Capabilities

Notes

  1. Tip Bell-LaPadula (CONFIDENTIALITY): no read up (simple), no write down (*-property). Biba (INTEGRITY): no read down, no write up. Mnemonic: BLP protects secrets from leaking down; Biba stops dirt flowing up.

Slide 2 / 31

Slide 2

Slide 2: Slide 2

Notes

  1. Learning objectives.

Slide 3 / 31

Security Architecture principles

Slide 3: Security Architecture principles
Slide 4 / 31

Why Security Design Matters

Slide 4: Why Security Design Matters
Slide 5 / 31

• Core Security Architecture principles, which are considered fundamental within the information security community are:

Slide 5: • Core Security Architecture principles, which are considered fundamental within the information security community are:
Slide 6 / 31

Security Architecture principles

Slide 6: Security Architecture principles
Slide 7 / 31

Security Architecture principles

Slide 7: Security Architecture principles

Notes

  1. Seen again Ch 1, slide 9: Defence in depth

Slide 8 / 31

Security Architecture principles

Slide 8: Security Architecture principles

Exam angle

Past exam · Final 221 · A

MCQ · exact privileges, no additions = least privilege

PredictionQ1

Granting users exactly the privileges they need for a task, nothing more, is:

Slide 9 / 31

Security Architecture principles

Slide 9: Security Architecture principles

Notes

  1. #5 Default deny: access is denied unless explicitly granted. #6 Fail securely.

Slide 10 / 31

Security Architecture principles

Slide 10: Security Architecture principles

Notes

  1. #7 Separation of duties: no single person controls a whole transaction (cashier needs a supervisor to refund).

Exam angle

Past exam · Final 221 · A

Related question: match · supervisor approval for refunds

PredictionQ1

A cashier needs a supervisor’s approval to cancel a bill and refund. This applies:

Slide 11 / 31

Security Architecture principles

Slide 11: Security Architecture principles

Exam angle

PredictionQ1

Which model assumes no user or device is trusted, even inside the network?

Slide 12 / 31

Security Architecture principles

Slide 12: Security Architecture principles
Slide 13 / 31

Security Architecture principles

Slide 13: Security Architecture principles
Slide 14 / 31

Security Architecture principles

Slide 14: Security Architecture principles
Slide 15 / 31

Security Architecture principles

Slide 15: Security Architecture principles
Slide 16 / 31

Security Architecture principles

Slide 16: Security Architecture principles
Slide 17 / 31

Common Architecture Flaws and Security Issues 1/2

Slide 17: Common Architecture Flaws and Security Issues 1/2

Notes

  1. Covert channel: transferring information secretly through an unintended path (timing, storage).

Exam angle

PredictionQ1

Transferring information through an unintended, secret path is a:

Slide 18 / 31

Common Architecture Flaws and Security Issues 1/2

Slide 18: Common Architecture Flaws and Security Issues 1/2

Notes

  1. Maintenance hook (backdoor/trapdoor): a hidden entry point left by developers; also TOCTOU, buffer overflows.

Exam angle

PredictionQ1

A hidden entry point left in software for easy maintenance is a:

Slide 19 / 31

Techniques for Ensuring Confidentiality, Integrity, and Availability

Slide 19: Techniques for Ensuring Confidentiality, Integrity, and Availability
Slide 20 / 31

Techniques for Ensuring Confidentiality, Integrity, and Availability

Slide 20: Techniques for Ensuring Confidentiality, Integrity, and Availability
Slide 21 / 31

Techniques for Ensuring Confidentiality, Integrity, and Availability

Slide 21: Techniques for Ensuring Confidentiality, Integrity, and Availability

Notes

  1. Concepts: confinement, bounds, isolation, controls, trust and assurance.

Slide 22 / 31

Techniques for Ensuring Confidentiality, Integrity, and Availability

Slide 22: Techniques for Ensuring Confidentiality, Integrity, and Availability

Notes

  1. Process isolation: a process may only read and write its own memory locations and resources.

Exam angle

Past exam · Final 221 · A

MCQ · process restricted to certain memory locations

PredictionQ1

Allowing a process to read and write only certain memory locations and resources is:

Slide 23 / 31

Techniques for Ensuring Confidentiality, Integrity, and Availability

Slide 23: Techniques for Ensuring Confidentiality, Integrity, and Availability

Notes

  1. Each process gets an authority level (protection rings): ring 0 = kernel (most privileged); user processes run in outer rings.

Exam angle

PredictionQ1

Processes in _ can access more resources and interact with the OS more directly than processes in _.

PredictionQ2

Operating in the “problem state” means running in:

Slide 24 / 31

Security Models

Slide 24: Security Models
Slide 25 / 31

Security Models

Slide 25: Security Models
Slide 26 / 31

Security Models

Slide 26: Security Models

Exam angle

Past exam · Final 221 · B

Related question: MCQ · conflict-of-interest model = Brewer-Nash

PredictionQ1

Which model prevents conflicts of interest (e.g., a consultant serving two competitors)?

Slide 27 / 31

Access Control Matrix

Slide 27: Access Control Matrix

Exam angle

PredictionQ1

In an access control matrix, a column tied to an object is a(n):

Slide 28 / 31

Take-Grant Model

Slide 28: Take-Grant Model

Notes

  1. Take-Grant: how rights pass between subjects (take, grant, create, remove); lets you find where rights can leak.

Exam angle

Past exam · Final 221 · A

MCQ · model to find leakage of rights = take-grant

PredictionQ1

Which access-control model lets you reason about rights and find whether a leakage of rights can occur?

Slide 29 / 31

Bell-LaPadula Confidential Model

Slide 29: Bell-LaPadula Confidential Model

Notes

  1. Tip Bell-LaPadula (CONFIDENTIALITY): no read up (simple), no write down (*-property). Biba (INTEGRITY): no read down, no write up. Mnemonic: BLP protects secrets from leaking down; Biba stops dirt flowing up.

Exam angle

PredictionQ1

Under Bell-LaPadula, a SECRET user may NOT:

PredictionQ2

Bell-LaPadula’s *-property forbids:

Slide 30 / 31

Biba Integrity Model

Slide 30: Biba Integrity Model

Notes

  1. Tip Bell-LaPadula (CONFIDENTIALITY): no read up (simple), no write down (*-property). Biba (INTEGRITY): no read down, no write up. Mnemonic: BLP protects secrets from leaking down; Biba stops dirt flowing up.

Exam angle

PredictionQ1

The Biba model protects:

Slide 31 / 31

Slide 31

Slide 31: Slide 31

Notes

  1. End.