Sicurezza Informatica Prof Stefano Bistarelli bistadipmat unipg it

Sicurezza Informatica Prof. Stefano Bistarelli bista@dipmat. unipg. it http: //www. sci. unich. it/~bista/ Prof. Stefano Bistarelli - Sicurezza Informatica

Chapter 4: security policies Prof. Stefano Bistarelli - Sicurezza Informatica 2

Security Policy n Policy partitions system states into: n Authorized (secure) n n Unauthorized (nonsecure) n n These are states the system can enter If the system enters any of these states, it’s a security violation Secure system n n Starts in authorized state Never enters unauthorized state Prof. Stefano Bistarelli - Sicurezza Informatica 3

Secure System - Example Unauthorized states A n B C D Authorized states Is this Finite State Machine Secure? n n n A is start state ? B is start state ? C is start state ? How can this be made secure if not? Suppose A, B, and C are authorized states ? Prof. Stefano Bistarelli - Sicurezza Informatica 4

Additional Definitions: n n Security breach: system enters an unauthorized state Let X be a set of entities, I be information. n I has confidentiality with respect to X if no member of X can obtain information on I n n I has integrity with respect to X if all members of X trust I n n N. B. policy have to take in account temporal information (ex: NDA have time limit) Trust I, its conveyance and storage (data integrity) I maybe origin information or an identity (authentication) I is a resource – its integrity implies it functions as it should (assurance) I has availability with respect to X if all members of X can access I n Time limits (quality of service) Prof. Stefano Bistarelli - Sicurezza Informatica 5

Confidentiality Policy n Also known as information flow n n Model often depends on trust n n n Transfer of rights Transfer of information without transfer of rights Temporal context Parts of system where information could flow Trusted entity must participate to enable flow Highly developed in Military/Government Prof. Stefano Bistarelli - Sicurezza Informatica 6

Integrity Policy n Defines how information can be altered n n Examples: n n n Entities allowed to alter data Conditions under which data can be altered Limits to change of data Purchase over $1000 requires signature Check over $10, 000 must be approved by one person and cashed by another n Separation of duties : for preventing fraud Highly developed in commercial world Prof. Stefano Bistarelli - Sicurezza Informatica 7

Commercial policies: Integrity and Transactions n Begin in consistent state n n “Consistent” defined by specification Perform series of actions (transaction) n n n Actions cannot be interrupted If actions complete, system in consistent state If actions do not complete, system reverts to beginning (consistent) state Prof. Stefano Bistarelli - Sicurezza Informatica 8

Availability n n n X set of entities, I resource I has availability property with respect to X if all x X can access I Types of availability: n n traditional: x gets access or not quality of service: promised a level of access (for example, a specific level of bandwidth) and not meet it, even though some access is achieved Prof. Stefano Bistarelli - Sicurezza Informatica 9

Policy Models n n Abstract description of a policy or class of policies Focus on points of interest in policies n n n Security levels in multilevel security models Separation of duty in Clark-Wilson model Conflict of interest in Chinese Wall model Prof. Stefano Bistarelli - Sicurezza Informatica 10

Mechanisms n Entity or procedure that enforces some part of the security policy n n Access controls (like bits to prevent someone from reading a homework file) Disallowing people from bringing CDs and floppy disks into a computer facility to control what is placed on systems Prof. Stefano Bistarelli - Sicurezza Informatica 11

Key Points n n n Policies describe what is allowed Mechanisms control how policies are enforced Trust underlies everything Prof. Stefano Bistarelli - Sicurezza Informatica 12

n Trust? ? ? n Esempio segue! Prof. Stefano Bistarelli - Sicurezza Informatica 13

Question: n Istallare una patch incrementa la security? Prof. Stefano Bistarelli - Sicurezza Informatica 14

Dipende: Trust Administrator installs patch 1. Trusts patch came from vendor, not tampered with in transit 2. Trusts vendor tested patch thoroughly 3. Trusts vendor’s test environment corresponds to local environment 4. Trusts patch is installed correctly Prof. Stefano Bistarelli - Sicurezza Informatica 15

Again: n Formal verification of a system! n Then we are secure? ? Prof. Stefano Bistarelli - Sicurezza Informatica 16

Trust in Formal Verification n Gives formal mathematical proof that given input i, program P produces output o as specified Suppose a security-related program S formally verified to work with operating system O What are the assumptions? Prof. Stefano Bistarelli - Sicurezza Informatica 17

Trust in Formal Methods Proof has no errors 1. • Bugs in automated theorem provers Preconditions hold in environment in which S is to be used S transformed into executable S whose actions follow source code 2. 3. n Compiler bugs, linker/loader/library problems Hardware executes S as intended 4. n Hardware bugs (Pentium f 00 f bug, for example) Prof. Stefano Bistarelli - Sicurezza Informatica 18

esercizio Prof. Stefano Bistarelli - Sicurezza Informatica 19

Question n Policy disallows cheating n n n Includes copying homework, with or without permission CS class has students do homework on computer Anne forgets to read-protect her homework file Bill copies it Who cheated? n Anne, Bill, or Prof. both? Stefano Bistarelli - Sicurezza Informatica 20

Answer Part 1 n Bill cheated n n Policy forbids copying homework assignment Bill did it System entered unauthorized state (Bill having a copy of Anne’s assignment) If not explicit in computer security policy, certainly implicit n Not credible that a unit of the university allows something that the university as a whole forbids, unless the unit explicitly says so Prof. Stefano Bistarelli - Sicurezza Informatica 21

Answer Part 2 n Anne didn’t protect her homework n n n Not required by security policy She didn’t breach security If policy said students had to readprotect homework files, then Anne did breach security n She didn’t do this Prof. Stefano Bistarelli - Sicurezza Informatica 22

Access Control n Discretionary Access Control (DAC) n n n Owner determines access rights Typically identity-based access control (IBAC): Owner specifies other users who have access Mandatory Access Control (MAC) n n Rules specify granting of access Also called rule-based access control n Indipendente dal soggetto!! Prof. Stefano Bistarelli - Sicurezza Informatica 23

Access Control n Originator Controlled Access Control (ORCON) n Originator controls access Originator need not be owner! Role Based Access Control (RBAC) n n n Identity governed by role user assumes Prof. Stefano Bistarelli - Sicurezza Informatica 24

Example policy n Bishop University Prof. Stefano Bistarelli - Sicurezza Informatica 25

Example English Policy n Computer security policy for academic institution n n Institution has multiple campuses, administered from central office Each campus has its own administration, and unique aspects and needs Authorized Use Policy Electronic Mail Policy Prof. Stefano Bistarelli - Sicurezza Informatica 26

Authorized Use Policy n n Intended for one campus (Davis) only Goals of campus computing n n Procedural enforcement mechanisms n n Underlying intent Warnings Denial of computer access Disciplinary action up to and including expulsion Written informally, aimed at user community Prof. Stefano Bistarelli - Sicurezza Informatica 27

Electronic Mail Policy n n Systemwide, not just one campus Three parts n n n Summary Full policy Interpretation at the campus Prof. Stefano Bistarelli - Sicurezza Informatica 28

Summary n Warns that electronic mail not private n n n Can be read during normal system administration Can be forged, altered, and forwarded Unusual because the policy alerts users to the threats n Usually, policies say how to prevent problems, but do not define threats Prof. Stefano Bistarelli - Sicurezza Informatica 29

Summary n What users should and should not do n n n Think before you send Be courteous, respectful of others Don’t nterfere with others’ use of email Personal use okay, provided overhead minimal Who it applies to n n Problem is UC is quasi-governmental, so is bound by rules that private companies may not be Educational mission also affects application Prof. Stefano Bistarelli - Sicurezza Informatica 30

Full Policy n Context n n Does not apply to Dept. of Energy labs run by the university Does not apply to printed copies of email n n Other policies apply here E-mail, infrastructure are university property n n n Principles of academic freedom, freedom of speech apply Access without user’s permission requires approval of vice chancellor of campus or vice president of UC If infeasible, must get permission retroactively Prof. Stefano Bistarelli - Sicurezza Informatica 31

Uses of E-mail n Anonymity allowed n n Can’t interfere with others’ use of e-mail n n Exception: if it violates laws or other policies No spam, letter bombs, e-mailed worms, etc. Personal e-mail allowed within limits n n Cannot interfere with university business Such e-mail may be a “university record” Prof. Stefano Bistarelli - Sicurezza subject to disclosure Informatica 32

Security of E-mail n University can read e-mail n n Won’t go out of its way to do so Allowed for legitimate business purposes Allowed to keep e-mail robust, reliable Archiving and retention allowed n May be able to recover e-mail from end system (backed up, for example) Prof. Stefano Bistarelli - Sicurezza Informatica 33

Implementation n Adds campus-specific requirements and procedures n n Example: “incidental personal use” not allowed if it benefits a non-university organization Allows implementation to take into account differences between campuses, such as selfgovernance by Academic Senate Procedures for inspecting, monitoring, disclosing e-mail contents Backups Prof. Stefano Bistarelli - Sicurezza Informatica 34

Discussion: Prof. Stefano Bistarelli - Sicurezza Informatica 35

Esempio di politica di sicurezza 1. 2. 3. 4. 5. 6. 7. 8. 9. Un utente ha il permesso di leggere un qualunque file pubblico Un utente ha il permesso di scrivere solo sui file pubblici di sua proprietà Un utente ha il divieto di sostituire un file con una sua versione più obsoleta Un utente ha l’obbligo di cambiare la propria password quando questa scade Un utente segreto ha il permesso di leggere su un qualunque file non pubblico Un utente segreto ha il permesso di scrivere su un qualunque file non pubblico Un amministratore ha il permesso di sostituire un qualunque file con una sua versione più obsoleta Un utente che non cambia la sua password scaduta (negligente) ha il divieto di compiere qualunque operazione Un utente che non cambia la sua password scaduta (negligente) non ha discrezione di cambiarla Prof. Stefano Bistarelli - Sicurezza Informatica 36

I mattoni dell’esempio n n Utenti Ruoli: utente, utente segreto, sistemista, utente negligente Operazioni: leggere, scrivere, “downgrade”, cambio password Modalità: obbligo, permesso, divieto, discrezionalità Prof. Stefano Bistarelli - Sicurezza Informatica 37

Relazioni fra le modalità n n Modalità base: Obbligatorio(x) Permesso(x) = ¬Obbligatorio(¬x) Vietato(x) = Obbligatorio(¬x) Discrezionale(x) = ¬Obbligatorio(x) Prof. Stefano Bistarelli - Sicurezza Informatica 38

Intersezione dei ruoli n Problema: un utente riveste più ruoli Prof. Stefano Bistarelli - Sicurezza Informatica 39

Inconsistenze di una politica n n Contraddizione: Obbligatorio(x) ∧¬Obbligatorio(x) Dilemma: Obbligatorio(x) ∧Obbligatorio(¬x) Prof. Stefano Bistarelli - Sicurezza Informatica 40

Inconsistenze nell’esempio n Contraddizione da regole 3 e 7 n n Un amministratore ha permesso e divieto di fare downgrade di un file Dilemma da regole 8 e 9 n Un utente negligente ha l’obbligo sia di cambiare sia di non cambiare la propria password Prof. Stefano Bistarelli - Sicurezza Informatica 41

Esercizio Trovare tutte le inconsistenze nell’esempio Prof. Stefano Bistarelli - Sicurezza Informatica 42