U4. Biba

1. Concerned with integrity
   1. Models integrity policy
2. modifications of objects can only flow downwards

1. The basic idea of Biba is that a 'dirty' subject should not be allowed to contaminate (modify) a clean object.

1. Static Mode - Similar to BLP
   1. 2 Security policies
      1. Simple integrity property - No write up
      2. Integrity *-property
         1. If subject s can read (observe) object o, then s can have write access to some other object o’
         2. You are not permitted to 'contaminate' a high-level object with low-level data

            Annotations:

            • he Marketing Director of a company reads unsubstantiated information about market share from a public document obtained from the Internet. He then writes this information into the company’s strategic marketing plan for next year. The effect is that the company’s marketing strategy is based on low-grade (and possibly incorrect) data. he Biba integrity *-property prevents this situation from occurring
2. Dynamic Mode
   1. Integrity levels change
      1. a 'clean' subject may read a 'dirty' object, but the result is that the subject is then re-classified as 'dirty'
      2. a low-level subject is permitted to write to a high-level object, but the object is then re-classified as low-level
   2. Policy enforces automatic adjustment of security levels

Annotations:

• In other words, the combination of BLP and Biba, with the same security labels, means that a subject may only access objects at exactly the same security level. If this is the intention of the policy, then that’s fine, but as we have seen there are some obvious situations where this can lead to problems (remember the manager sending a memo to his staff!).

1. Subject may invoke another subject (such as a software tool) to access an object
   1. Subjects are only allowed to invoke tools at a lower level. Otherwise, indirect contamination may occur.

1. A 'dirty' subject s1 may only invoke a 'clean' tool s2 to touch a 'clean' object.