ECS 153A

Security is always relative to a policy. Without a precise policy, there is no standard to evaluate the system against.

You cannot determine whether the system is behaving correctly, detect violations, or verify that mechanisms enforce the intended rules.

They lead to implementation ambiguity, where different developers may interpret requirements differently, creating gaps.

A system is 'secure' iff it cannot transition from an authorized state to an unauthorized state.

Disclosure, Deception, Disruption, Usurpation.

Confidentiality.

Integrity (of belief or decisions).

Availability and Integrity of operation.

Integrity of control.

Each plays a critical role in security; relying solely on prevention is a single point of failure.

Stopping attacks before they cause harm, e.g., firewalls blocking unauthorized connections.

Identifying that an attack has occurred or is in progress, e.g., IDS alerts on anomalous traffic.

Restoring the system to a correct, secure state after an incident, e.g., restoring from a clean backup.

No prevention mechanism is perfect; detection provides the fallback that triggers recovery.

Secure cannot be bypassed, precise enforces exactly the policy, and broad is more restrictive than the policy.

A mechanism that cannot be bypassed regardless of usage, e.g., Hardware Security Module (HSM).

A mechanism that enforces exactly the policy with no authorized access denied and no unauthorized access permitted.

A mechanism that is more restrictive than the policy, blocking some authorized accesses, e.g., a firewall that blocks all outbound traffic.

Specification, Design, Implementation, Maintenance & Operation.

Flaws propagate through all phases, and a flaw means the system is built to do the wrong thing.

Organizational problems and People problems.

A manager disables mandatory access controls to meet a deployment deadline.

An employee clicks a phishing email and enters credentials on a spoofed login page.

Identity is the set of attributes that uniquely identify an entity; Principal is an entity whose identity can be authenticated.

Different contexts require different identities, such as personal, service, and root accounts.

Path names can refer to different files over time and allow multiple paths to refer to the same or different files.

File descriptors, which are OS-level integer handles returned by open().

A structured identifier in X.509 certificates using hierarchical attributes.

Issues and digitally signs certificates, holding the signing key.

Performs identity verification on behalf of the CA before forwarding the request for signing.

The CA's signing key remains in a secure, offline system.

It separates the high-risk signing operation from the high-volume verification process.

Small key-value data items stored by the browser and sent automatically with HTTP requests to the issuing domain.

Session hijacking: If an attacker steals a session cookie, they can impersonate the user.

Using Secure and HttpOnly flags, and HTTPS.

Cross-Site Request Forgery (CSRF): A malicious site tricks the browser into sending a request to another site, including that site's cookies.

Using CSRF tokens and the SameSite cookie attribute.

An attacker injects false DNS records into a resolver's cache, redirecting traffic to a malicious server.

DNSSEC adds cryptographic signatures to DNS records, ensuring authenticity and integrity.

Confidentiality protects data from unauthorized access, while privacy ensures data is used appropriately.

A hospital encrypts patient records but sells de-identified records without consent.

A company promises to use data appropriately but stores it in an unencrypted database.

Every programser should have only the minimum privileges necessary to complete their task.

The Linux root account has unrestricted access, which can lead to total system control if compromised.

Access is denied unless explicitly permitted; the default posture is 'deny.'

Default-allow permits access unless explicitly denied, while Fail-Safe Defaults deny access by default.

Misconfiguration causes restriction, not exposure.

Security must not depend on the secrecy of the design or algorithm.

A cryptographic system should be secure even if everything about it is public knowledge except the key.

Every access to every object must be checked against the current policy on every access attempt.

Alice reads a file after her permission is revoked because the OS does not re-check permissions on each read.

Security mechanisms should not make the system harder to use than if the protections were absent.

Requiring complex password changes every 30 days leads users to create predictable passwords.

Fail-Safe Defaults.

Maximum privacy protection should be built in as the default; users should not have to take action to protect themselves.

Fail-Safe Defaults.

The default posture should be maximally protective.

Economy of Mechanism (simplicity enables privacy).

Complete Mediation (protect data at every stage).

Open Design.

S&S principles focus on system correctness and access control, while PbD principles extend this to data governance, user control, and lifecycle management.

It demonstrates integrated understanding that protection should be the default, not an option.

A matrix A[S, O] where S = subjects (active entities), O = objects (passive resources), and A[s, o] = the set of rights subject s holds over object o.

1. enter(r, s, o) -- add right. 2. delete(r, s, o) -- remove right. 3. create subject(s) -- add new row. 4. create object(o) -- add new column. 5. destroy subject(s) -- remove row. 6. destroy object(o) -- remove column.

If subject s has right r* (r with copy flag) on object o, s can exercise r AND can grant r (without the copy flag) to other subjects.

You can only grant rights you currently hold; if Alice has only {r} (no copy flag), she cannot grant {r} to Bob.

It prevents privilege escalation; a less-privileged user cannot bootstrap their way to more rights than they were given.

For access control systems with generic rights and general commands, the safety problem is UNDECIDABLE.

Decidable case: Mono-operational commands; Undecidable case: Multi-operation commands with generic rights.

NO. Bob cannot grant read to Carol because he has {r} on File1 without the copy flag.

There is no general algorithm to formally verify that an arbitrary access control policy prevents all rights leakage.

Discretionary Access Control.

Mandatory Access Control.

Transitivity/propagation; MAC prevents unauthorized redistribution of rights.

The information originator retains control over who can access their information, even after it has been shared.

It prevents recipients from re-sharing data without the originator's approval.

Each role contains only the permissions needed for that specific function.

A 'payroll_reader' role can view but not modify payroll.

Each role contains only the permissions needed for that specific function.

View but not modify payroll.

Modify but not approve payroll.

Mutually exclusive roles are defined, preventing a user from being assigned to both roles simultaneously.

It ensures that the person who processes a transaction is not the same person who audits it.

Initiate transfers up to \$1000.

Approve transfers over \$1000.

Two separate individuals must be involved.

The minimal set of hardware, firmware, and software components that must function correctly for the security policy to be enforced.

Fewer components to verify, fewer potential failure points, and easier to formally verify.

A hypervisor-based security system.

Policy in abstract, human-readable terms.

Ponder.

Policy in terms directly enforced by system mechanisms.

Tripwire.

The translation from high-level intent to low-level enforcement introduces errors.

Military focuses on preventing unauthorized disclosure, while commercial focuses on preventing fraud and ensuring integrity.

Bell-LaPadula (BLP).

Clark-Wilson.

No Read Up: A subject can read an object only if the subject's label dominates the object's label.

No Write Down: A subject can write to an object only if the object's label dominates the subject's label.

A system is secure if the initial state is secure and every state transition preserves security.

It transforms the global problem of system security into two local, verifiable conditions.

Security labels must not change in ways that circumvent the BLP rules during system operation.

Labels never change at all during operation.

Labels may change but never in a policy-violating direction.

It is the system-design equivalent of Economy of Mechanism.

It shows why security is hard even when policies seem clear.

Military focuses on who sees what (confidentiality), while commercial focuses on who does what (integrity + accountability).

BLP does NOT protect integrity or availability.

The *-property ('No Write Down') prevents subjects from writing to lower-classification objects, which can lead to integrity issues.

The BST (Bell-LaPadula Security Theorem) reduces a global safety property to local checks.

Simple Integrity Property: Subject s can READ object o iff I(s) dom I(o). Integrity Property: Subject s can WRITE to object o iff I(s) dom I(o).

It prevents high-integrity subjects from reading low-integrity data, which could corrupt their internal state.

C4 requires all TPs to write to an append-only log to create an auditable trail.

E4 ensures that only the authorized certifier may modify the certification list, enforcing separation of duty.

Clark-Wilson requires the system to authenticate the identity of each user attempting to execute a TP.

UDIs are untrusted input that can violate integrity if not properly validated.

C5 states that any TP accepting a UDI must be certified to produce valid CDI transformations or reject invalid UDIs.

BLP is focused on confidentiality and does not protect integrity, while Clark-Wilson is designed for commercial integrity.

Ciphers offer flexibility, depend only on the key for security, and are easier to distribute securely.

The Kasiski method is a technique for breaking ciphers by analyzing repeated sequences of letters.

Ciphers are more flexible and follow the Open Design principle: the algorithm is public, the key is secret.

It finds repeated sequences in ciphertext to determine key length by computing the GCD of distances between repetitions.

It determines whether a cipher is monoalphabetic or polyalphabetic based on the frequency distribution of letters.

It reveals zero information about the plaintext; for any ciphertext, every possible plaintext is equally likely.

The key must be as long as the message, perfectly random, never reused, and secure key distribution is challenging.

RSA is based on factoring large composite numbers and provides both confidentiality and authentication. El Gamal is based on the discrete logarithm problem and primarily provides confidentiality.

Integrity and authentication, as only the keyholder can produce or verify the MAC.

Integrity only; anyone can compute the hash, but it does not provide authentication.

They involve computing a hash of the message, signing it with the sender's private key, and allowing verification with the sender's public key.

Integrity, authentication, and non-repudiation.

A trusted third party (KDC) for establishing trust without public key operations or a certificate authority.

It allows two parties to establish a shared secret over an insecure channel using public values.

It provides no authentication, allowing an attacker to intercept and manipulate the key exchange.

By authenticating the DH exchange, typically using certificates.

A binary tree where each leaf node is a hash of a data block, and the root hash summarizes all data.

CAs log every issued certificate to a public Merkle tree log, allowing verification of certificate authenticity.

1. Brute force - Defense: Strong passwords. 2. Man-in-the-middle - Defense: Authentication. 3. Replay - Defense: Nonces. 4. Denial of Service - Defense: Rate limiting.

An attacker precomputes hash-to-plaintext mappings. Defense: Salting - add a random per-user salt before hashing.

In block ciphers without integrity protection, reordering encrypted blocks changes plaintext in predictable ways. Defense: Use authenticated encryption modes (AES-GCM).

ECB mode encrypts identical plaintext blocks to identical ciphertext blocks, revealing data patterns. Defense: Use cipher block chaining (CBC) or other modes that mix blocks.

A message of type A is replayed as if it were type B in a protocol. Defense: Tag messages with their type.

Truly random is generated from physical entropy sources. CSPRNG is seeded with true randomness and expands it algorithmically.

Cryptographic keys are only as secret as the random numbers used to generate them. Poor RNG can lead to compromised keys.

Debian's OpenSSL bug (2008) reduced the PRNG to only 32,767 possible seeds, compromising all keys generated for two years.

Public key cryptosystems are slow; symmetric ciphers are fast but require a shared key. Hybrid encryption uses public key to exchange a session key, then AES for data encryption.

Use the public key system to securely exchange a random symmetric session key, then use the session key with AES for data encryption.

Encrypted between each adjacent pair of nodes, decrypted and re-encrypted at each intermediate node.

Encrypted at source, decrypted only at destination; intermediate nodes never see plaintext.

A VPN (link encryption) combined with TLS (end-to-end) to hide traffic patterns and ensure content confidentiality.

What you know, what you have, what you are, where you are.

Both parties authenticate each other, e.g., TLS with client certificates.

Exhaustive search, inspired guessing, random guessing, scavenging.

Salting defends against precomputation (rainbow table) attacks.

They make the search space large and distribution uniform, making them harder to crack.

Packet-filter examines each packet independently; stateful maintains a table of established connections.

It can distinguish unsolicited inbound packets from legitimate reply packets.

Confidentiality, Integrity, Authentication.

Fewer cipher suites, mandatory forward secrecy, faster handshake, encrypted handshake metadata.

It means past sessions cannot be decrypted even if the server's long-term key is later compromised.

Security means a system operates as intended, despite adversarial interference.

Confidentiality, Integrity, Availability.

Unauthorized access to information, violating Confidentiality.

Acceptance of false data as true, violating Integrity.

Interruption or prevention of correct operation, violating Availability/Integrity.

Unauthorized control of some part of the system, violating Integrity.

Prevention, Detection, Recovery.

A statement of what is and is not allowed.

Technical or procedural means to enforce a policy.

Policy = WHAT must be enforced; Mechanism = HOW it is enforced.

The confidence that a system meets its security requirements.

A flawed spec means all subsequent work is misdirected.

Risk = Threat × Vulnerability × Asset Value.

Annualized Loss Expectancy.

An entity whose identity can be authenticated.

The process of verifying a claimed identity.

Determining what an authenticated principal is permitted to do.

Linking actions to principals via audit logs.

Human-readable identifiers for files.

Numeric identifiers assigned by the OS.

A digitally signed document binding a public key to an identity.

A trusted third party that issues and signs certificates.

A certificate that binds a key to a pseudonym or role rather than a real legal identity.

The right to control information about oneself.

Actions cannot be linked to any identity.

Actions are linked to a consistent pseudonym but not a real identity.

Collect only the data strictly necessary for the stated purpose.

Path names can be manipulated or guessed, leading to unauthorized access.

Using unique identifiers or handles that are not based on file paths.

A DN is a unique identifier for an entity in a certificate, consisting of attributes like common name, organization, and country.

The RA verifies identities before certificates are issued, while the CA issues and manages the certificates.

1. Cross-site scripting (XSS) attacks can steal cookies. 2. Session hijacking can occur if cookies are not secured.

DNS cache poisoning is an attack that corrupts the DNS cache, causing users to be redirected to malicious sites.

DNSSEC adds a layer of security by enabling DNS responses to be verified for authenticity.

A system that encrypts user data but tracks and logs user behavior without consent.

The principle of Least Privilege states that users and programs should operate with the minimum privileges necessary.

A system where all users have administrative rights, allowing them to access sensitive data unnecessarily.

Fail-Safe Defaults means that access is denied by default unless explicitly permitted.

A default-allow system grants access unless explicitly denied, which is less secure.

It relies on keeping the design secret, which can be compromised, whereas Open Design promotes transparency.

If a user accesses a file without checking permissions after the initial access, it violates Complete Mediation.

The Principle of Psychological Acceptability states that security measures should not hinder usability.

A system that requires complex passwords leading users to write them down, increasing the risk of theft.

The principle of Fail-Safe Defaults aligns with 'Privacy as the default setting'.

The access control matrix is a model that defines the access rights of subjects to objects.

Rows represent subjects (users/processes), columns represent objects (files/devices), and cells contain access rights.

1. enter(r, s, o) 2. delete(r, s, o) 3. create subject(s) 4. create object(o) 5. destroy subject(s) 6. destroy object(o)

The copy flag allows a subject to grant a right to other subjects.

It ensures that a subject can only grant rights it possesses, preventing privilege escalation.

For systems with generic rights and general commands, safety is undecidable.

Decidable systems have mono-operational commands, while undecidable systems have multi-operation commands.

Real systems cannot formally verify safety and often use restricted models or rely on auditing.

The 'own' right allows a subject to manage access rights for an object, enabling full administrative control.

It enables adding and deleting rights for any subject on that object.

The 'own' right includes administrative capabilities, while read+write access does not.

A security policy defines the set of authorized and unauthorized states.

A system is secure if it begins in an authorized state and cannot transition into an unauthorized state.

Owner controls access, rights can be delegated, flexible but weak.

System enforces access based on labels; users cannot override policy.

The original creator retains control over access, recipients cannot re-distribute without approval.

Permissions are assigned to roles, users are assigned to roles, supports least privilege and separation of duty.

Trust is a key policy concept; a trusted component's failure can violate the security policy.

The smaller the TCB, the easier it is to assure.

They express policy intent in human-readable, relatively abstract terms.

They express policy in terms of system-level rules directly enforceable by mechanisms.

The gap between high-level policy intent and low-level enforcement where many security failures occur.

Prevent unauthorized disclosure of classified information.

BLP model.

Prevent fraud and maintain integrity of commercial transactions.

Clark-Wilson model.

No Read Up: A subject can read an object if the subject label dominates the object label.

No Write Down: A subject can write to an object if the object label dominates the subject label.

A system is secure if every initial state is secure and every state transition preserves security.

(L1; C1) dominates (L2; C2) iff L1 >= L2 AND C2 is a subset of C1.

No.

Yes.

It states that security labels should not change during system operation to prevent circumvention of security properties.

It allows us to conclude that a BLP-based system is secure if it meets its conditions.

A subject can READ an object if the subject's integrity level dominates the object's integrity level.

A subject can WRITE to an object if the subject's integrity level dominates the object's integrity level.

Well-formed transactions and separation of duty.

High-integrity data, such as account balances.

Untrusted input, such as user-entered data.

It verifies that CDIs are in valid states.

The only operation allowed to modify CDIs.

Rules applied by authorized certifiers to ensure integrity.

To enforce the system's integrity rules.

TP-CDI associations and ensure only those TPs manipulate those CDIs.

A list of (UserID, TP, CDIs) -- which user can run which TP on which CDIs.

The system must authenticate the identity of each user attempting to execute a TP.

Only certified agents may modify the (TP, CDI) certification list; certifiers cannot execute the TPs they certify.

(1) No Write Up: A subject at a lower integrity level cannot write to an object at a higher integrity level. (2) No Read Down: A subject at a higher integrity level cannot read an object at a lower integrity level.

It prevents lower integrity subjects from accessing higher integrity information, which could lead to integrity violations.

C1: Well-formed transactions, C2: Separation of duties, C3: Certification of TPs and CDIs, C4: Certification list modification, C5: Auditing.

C4 ensures that only certified agents can modify the certification list, maintaining system integrity.

E4 enforces that only certified agents can modify the certification list, which is critical to prevent unauthorized changes.

The system must authenticate the identity of each user attempting to execute a TP.

It emphasizes the importance of verifying user identities before allowing access to TPs.

C5 ensures that all transactions are audited to maintain accountability and integrity.

An example is a user inputting data into a form that is then validated and stored as a controlled record.

Clark-Wilson is designed for integrity, while BLP is designed for confidentiality.

BLP does not address integrity violations related to unauthorized modifications of data.

Codes replace semantic units (words/phrases) with code words, while ciphers transform charactersits algorithmically using a key.

Ciphers provide stronger security and flexibility compared to codes, which are limited by their codebook.

The Kasiski method involves finding repeated patterns in the ciphertext to determine the key length.

It is used to determine if a cipher is monoalphabetic or polyalphabetic.

Because its key is as long as the message, used only once, and perfectly random.

The key distribution problem, as securely sharing long random keys is difficult.

RSA is based on the difficulty of factoring large numbers, while El Gamal is based on the discrete logarithm problem.

Confidentiality through public key encryption.

Confidentiality, with a separate algorithm for authentication.

Keyed hashes use a secret key for verification, while keyless hashes do not.

Integrity checking.

Both integrity and authentication.

Sign the message, encipher the hash, then verify by decrypting with the sender's public key.

Integrity, authentication, and non-repudiation.

A long-term key used only to encrypt and distribute session keys.

A short-lived key used for one communication session, providing forward secrecy.

To securely exchange session keys, which are then used for fast symmetric encryption.

A theoretical key distribution protocol that requires a trusted third party (KDC).

Adds timestamps to prevent replay attacks and introduces Ticket Granting Tickets (TGT) for single sign-on.

A method that allows two parties to establish a shared secret over an insecure channel without a KDC.

The discrete logarithm problem.

It does not authenticate the parties involved, allowing an attacker to intercept and substitute values.

By authenticating the DH exchange using certificates, as in TLS.

1. Precomputation attack: Use rainbow tables; defense: salt hashes. 2. Misordered blocks: Reordering can alter plaintext; defense: integrity protection. 3. Statistical regularities: Cipher leaks patterns; defense: use secure modes. 4. Type flaw attack: Misinterpretation of messages; defense: strict protocol definitions.

Cryptographically random numbers are generated from true entropy sources, while pseudorandom numbers are generated from algorithms seeded with true random data.

It is essential for ensuring the security of cryptographic systems.

Encrypts data at each network node along the path, hiding traffic patterns.

Plaintext is visible at each intermediate node.

Headers must remain cleartext for routing.

Combine end-to-end encryption for content confidentiality with link encryption to hide traffic patterns.

A deprecated predecessor to TLS that should not be used.

The current standard for secure communication, providing confidentiality, integrity, and server authentication.

1. Client Hello, 2. Server Hello + Certificate, 3. Key Exchange, 4. Finished, 5. Data phase.

A stateless firewall that examines each packet's headers independently.

A firewall that tracks connection state and allows inbound packets matching established outbound connections.

A network segment between the internet and internal network that hosts public-facing servers.

1. What you know (password), 2. What you have (token), 3. What you are (biometric), 4. Where you are (geolocation).

Common passwords, password reuse, short passwords, and predictable patterns.

Use random generation, pronounceable passwords, or passphrases to maximize search space size.