Design Principles CS461/ECE422 Computer Security I Fall 2010 Based - - PowerPoint PPT Presentation

design principles
SMART_READER_LITE
LIVE PREVIEW

Design Principles CS461/ECE422 Computer Security I Fall 2010 Based - - PowerPoint PPT Presentation

Design Principles CS461/ECE422 Computer Security I Fall 2010 Based on slides provided by Matt Bishop for use with Computer Slide #13-1 Security: Art and Science Reading Material Chapter 13 Computer Security: Art and Science Slide #13-2


slide-1
SLIDE 1

Slide #13-1

Design Principles

CS461/ECE422 Computer Security I Fall 2010

Based on slides provided by Matt Bishop for use with Computer Security: Art and Science

slide-2
SLIDE 2

Slide #13-2

Reading Material

  • Chapter 13 Computer Security: Art and

Science

slide-3
SLIDE 3

Slide #13-3

Overview

  • Simplicity

– Less to go wrong – Fewer possible inconsistencies – Easy to understand

  • Restriction

– Minimize access – Inhibit communication

Saltzer and Schroeder 75

slide-4
SLIDE 4

Slide #13-4

Summary of Principles

  • Economy of mechanism
  • Fail-safe defaults
  • Complete mediation
  • Open design
  • Separation of Privilege
  • Least Privilege
  • Least Common Mechanisms
  • Psychological Acceptability
slide-5
SLIDE 5

Slide #13-5

Economy of Mechanism

  • Keep the design as simple and small as

possible

  • Simpler means less can go wrong

– And when errors occur, they are easier to understand and fix

  • Interfaces and interactions
slide-6
SLIDE 6

Slide #13-6

Fail-Safe Defaults

  • Base access decisions on permission rather

than exclusion

  • Burden of proof is on the principal seeking

permission

  • If the protection system fails, then

legitimate access is denied but illegitimate access is also denied

slide-7
SLIDE 7

Slide #13-7

Complete Mediation

  • Every access to every object must be checked for

authority

  • Usually done once, on first action

– UNIX: access checked on open, not checked thereafter

  • If permissions change after, may get unauthorized

access

  • Proposals to gain performance by remembering

the result of an authority check should be examined skeptically

slide-8
SLIDE 8

Slide #13-8

Open Design

  • The design should not be secret
  • Do not depend on secrecy of design or

implementation

– Popularly misunderstood to mean that source code should be public – “Security through obscurity” – Does not apply to information such as passwords or cryptographic keys

slide-9
SLIDE 9

Slide #13-9

Separation of Privilege

  • Where feasible, a protection mechanism

that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key.

  • Require multiple conditions to grant

privilege

– Separation of duty – Defense in depth

slide-10
SLIDE 10

Slide #13-10

Least Privilege

  • Every program and every user of the system

should operate using the least set of privileges necessary to complete the job

  • A subject should be given only those

privileges necessary to complete its task

– Function, not identity, controls – Rights added as needed, discarded after use – Minimal protection domain

slide-11
SLIDE 11

Slide #13-11

Least Common Mechanism

  • Minimize the amount of mechanism common to

more than one user and depended on by all users

  • Mechanisms should not be shared

– Information can flow along shared channels – Covert channels

  • Isolation

– Virtual machines – Sandboxes

slide-12
SLIDE 12

Slide #13-12

Psychological Acceptability

  • It is essential that the human interface be designed

for ease of use so that users routinely and automatically accept the protection mechanisms correctly

  • Security mechanisms should not add to difficulty
  • f accessing resource

– Hide complexity introduced by security mechanisms – Ease of installation, configuration, use – Human factors critical here

slide-13
SLIDE 13

Slide #13-13

Examine Scenarios

  • Paper overhead
slide-14
SLIDE 14

Slide #13-14

Key Points

  • Principles of secure design underlie all

security-related mechanisms

  • Require:

– Good understanding of goal of mechanism and environment in which it is to be used – Careful analysis and design – Careful implementation