U4. Summary

U4. Summary

1. Security Policy

   • is a set of security requirements, formulated to express an organisation’s security aims

2. Security model

   • formal description of the security policy
     • the model is a 'half-way house' between the policy and the actual implementation of that policy.
       • security model must describe an organisation’s security policy
         • The more complex the model, the more difficult it is to check the security of that model
           • orst case it may be an undecidable
   • Perfect example of the Third Fundamental Design Decision.
     • Complexity or assurance
       • If you want verifiable security properties, you are better off when the complexity of the security model is limited

3. BLP

   • Limitations
     • primarily concerned with Confidentiality
     • Assumes static security levels and access rights

4. Harrison-Ruzzo-Ullman, Chinese Wall and Biba

   • Designed to address situations that are not covered by the BLP

5. Clark Wilson

   • More a security framework than a model
     • mainly concerned with integrity in commercial systems