Computer Security: Art And Science

1439 Pages·2019·79.16 MB·English

by  Matt Bishop, Elisabeth Sullivan, Michelle Ruppel

ptg31181364
(cid:105) (cid:105)
“Bishop_FM” — 2019/7/10 — 11:03 — page i — #1
(cid:105) (cid:105)
Computer Security
Second Edition
ptg31181364
(cid:105) (cid:105)
(cid:105) (cid:105)
This page intentionally left blank
ptg31181364
(cid:105) (cid:105)
“Bishop_FM” — 2019/7/10 — 11:03 — page iii — #3
(cid:105) (cid:105)
Computer Security
Art and Science
Second Edition
Matt Bishop
with contributions from
Elisabeth Sullivan and Michelle Ruppel
ptg31181364
Boston • Columbus • NewYork • SanFrancisco • Amsterdam • CapeTown
Dubai • London • Madrid • Milan • Munich • Paris • Montreal • Toronto • Delhi • MexicoCity
Sa˜oPaulo • Sydney • HongKong • Seoul • Singapore • Taipei • Tokyo
(cid:105) (cid:105)
(cid:105) (cid:105)
(cid:105) (cid:105)
“Bishop_FM” — 2019/7/16 — 11:03 — page iv — #4
(cid:105) (cid:105)
Manyofthedesignationsusedbymanufacturersandsellerstodistinguishtheirproductsareclaimedas
trademarks.Wherethosedesignationsappearinthisbook,andthepublisherwasawareofatrademark
claim,thedesignationshavebeenprintedwithinitialcapitallettersorinallcapitals.
Theauthorsandpublisherhavetakencareinthepreparationofthisbook,butmakenoexpressedor
impliedwarrantyofanykindandassumenoresponsibilityforerrorsoromissions.Noliabilityis
assumedforincidentalorconsequentialdamagesinconnectionwithorarisingoutoftheuseofthe ptg31181364
informationorprogramscontainedherein.
Forinformationaboutbuyingthistitleinbulkquantities,orforspecialsalesopportunities(whichmay
includeelectronicversions;customcoverdesigns;andcontentparticulartoyourbusiness,traininggoals,
marketingfocus,orbrandinginterests),pleasecontactourcorporatesalesdepartmentat
[email protected][phone].
Forgovernmentsalesinquiries,[email protected].
ForquestionsaboutsalesoutsidetheU.S.,[email protected].
VisitusontheWeb:informit.com/aw
LibraryofCongressControlNumber:2018950017
Copyright©2019PearsonEducation,Inc.
Coverillustration:Captiva55/Shutterstock
Allrightsreserved.Thispublicationisprotectedbycopyright,andpermissionmustbeobtainedfrom
thepublisherpriortoanyprohibitedreproduction,storageinaretrievalsystem,ortransmissioninany
formorbyanymeans,electronic,mechanical,photocopying,recording,orlikewise.Forinformation
regardingpermissions,requestformsandtheappropriatecontactswithinthePearsonEducationGlobal
Rights&PermissionsDepartment,pleasevisitwww.pearsoned.com/permissions/.
ISBN-13:978-0-321-71233-2
ISBN-10:0-321-71233-1
ScoutAutomatedPrintCode
(cid:105) (cid:105)
(cid:105) (cid:105)
(cid:105) (cid:105)
“Bishop_FM” — 2019/7/10 — 11:03 — page v — #5
(cid:105) (cid:105)
TomydearHolly;ourchildrenHeidi,Steven,David,andCaroline;ourgrandchildren
SkylerandSage;andourfriendsSeaview,TinkerBelle,Stripe,BabyWindsor,
Scout,Fur,Puff,Mouse,Shadow,Fuzzy,Dusty,andtherestof themenagerie.
ptg31181364
(cid:105) (cid:105)
(cid:105) (cid:105)
This page intentionally left blank
ptg31181364
(cid:105) (cid:105)
“Bishop_FM” — 2019/7/10 — 11:03 — page vii — #7
(cid:105) (cid:105)
Contents
Preface ........................................................ xxix
Acknowledgments................................................ xlv
AbouttheAuthor ................................................ xlix
PART I:INTRODUCTION 1
Chapter1 AnOverviewofComputerSecurity ......................... 3
1.1 TheBasicComponents ...................................... 3
1.1.1 Confidentiality ...................................... 4
ptg31181364
1.1.2 Integrity ........................................... 5
1.1.3 Availability ......................................... 6
1.2 Threats ................................................... 6
1.3 PolicyandMechanism ....................................... 9
1.3.1 Goalsof Security ................................... 10
1.4 AssumptionsandTrust ..................................... 11
1.5 Assurance................................................ 12
1.5.1 Specification ....................................... 14
1.5.2 Design............................................ 14
1.5.3 Implementation .................................... 15
1.6 OperationalIssues ......................................... 16
1.6.1 Cost-BenefitAnalysis ................................ 16
1.6.2 RiskAnalysis ...................................... 17
1.6.3 LawsandCustoms .................................. 19
1.7 HumanIssues............................................. 20
1.7.1 OrganizationalProblems ............................. 20
1.7.2 PeopleProblems .................................... 21
1.8 TyingItAllTogether ....................................... 22
1.9 Summary ................................................ 24
1.10 ResearchIssues............................................ 24
1.11 FurtherReading........................................... 25
1.12 Exercises................................................. 25
vii
(cid:105) (cid:105)
(cid:105) (cid:105)
(cid:105) (cid:105)
“Bishop_FM” — 2019/7/10 — 11:03 — page viii — #8
(cid:105) (cid:105)
viii Contents
PART II:FOUNDATIONS 29
Chapter2 AccessControlMatrix .................................. 31
2.1 ProtectionState ........................................... 31
2.2 AccessControlMatrixModel ................................ 32
2.2.1 AccessControlbyBooleanExpressionEvaluation ......... 35
2.2.2 AccessControlledbyHistory.......................... 36
2.3 ProtectionStateTransitions.................................. 37
2.3.1 ConditionalCommands .............................. 40
2.4 Copying,Owning,andtheAttenuationof Privilege ............... 42
2.4.1 CopyRight ........................................ 42
2.4.2 OwnRight ........................................ 42
2.4.3 Principleof Attenuationof Privilege .................... 43
2.5 Summary ................................................ 44
2.6 ResearchIssues............................................ 44
2.7 FurtherReading........................................... 44
2.8 Exercises................................................. 45
Chapter3 FoundationalResults ................................... 49
ptg31181364
3.1 TheGeneralQuestion ...................................... 49
3.2 BasicResults ............................................. 51
3.3 TheTake-GrantProtectionModel ............................ 56
3.3.1 Sharingof Rights ................................... 57
3.3.2 Interpretationof theModel ........................... 61
3.3.3 TheftintheTake-GrantProtectionModel ............... 62
3.3.4 Conspiracy ........................................ 66
3.3.5 Summary ......................................... 68
3.4 ClosingtheGap:TheSchematicProtectionModel ............... 68
3.4.1 LinkPredicate...................................... 69
3.4.2 FilterFunction ..................................... 70
3.4.3 PuttingItAllTogether ............................... 71
3.4.4 DemandandCreateOperations........................ 72
3.4.5 SafetyAnalysis ..................................... 75
3.5 ExpressivePowerandtheModels ............................. 81
3.5.1 Brief Comparisonof HRUandSPM ................... 82
3.5.2 ExtendingSPM .................................... 83
3.5.3 SimulationandExpressiveness......................... 88
3.5.4 TypedAccessMatrixModel........................... 92
3.6 ComparingSecurityPropertiesof Models ...................... 94
3.6.1 ComparingSchemesandSecurityProperties ............. 95
3.6.2 AugmentedTypedAccessMatrixModel................. 99
(cid:105) (cid:105)
(cid:105) (cid:105)
(cid:105) (cid:105)
“Bishop_FM” — 2019/7/10 — 11:03 — page ix — #9
(cid:105) (cid:105)
Contents ix
3.7 Summary ............................................... 101
3.8 ResearchIssues........................................... 102
3.9 FurtherReading.......................................... 102
3.10 Exercises................................................ 103
PART III:POLICY 107
Chapter4 SecurityPolicies ...................................... 109
4.1 TheNatureof SecurityPolicies .............................. 109
4.2 Typesof SecurityPolicies................................... 113
4.3 TheRoleof Trust......................................... 115
4.4 Typesof AccessControl ................................... 117
4.5 PolicyLanguages ......................................... 118
4.5.1 High-LevelPolicyLanguages......................... 119
4.5.2 Low-LevelPolicyLanguages ......................... 125
4.6 Example:AcademicComputerSecurityPolicy.................. 126
4.6.1 GeneralUniversityElectronicCommunications
Policy ........................................... 127
4.6.2 ImplementationatUCDavis ......................... 130
ptg31181364
4.7 SecurityandPrecision ..................................... 131
4.8 Summary ............................................... 136
4.9 ResearchIssues........................................... 136
4.10 FurtherReading.......................................... 137
4.11 Exercises................................................ 138
Chapter5 ConfidentialityPolicies................................. 141
5.1 Goalsof ConfidentialityPolicies ............................. 141
5.2 TheBell-LaPadulaModel .................................. 142
5.2.1 InformalDescription ............................... 142
5.2.2 Example:TrustedSolaris ............................ 146
5.2.3 FormalModel..................................... 151
5.2.4 ExampleModelInstantiation:Multics ................. 158
5.3 Tranquility .............................................. 161
5.3.1 DeclassificationPrinciples ........................... 163
5.4 TheControversyovertheBell-LaPadulaModel................. 164
5.4.1 McLean’s†-PropertyandtheBasicSecurityTheorem ..... 164
5.4.2 McLean’sSystemZandMoreQuestions................ 166
5.5 Summary ............................................... 169
5.6 ResearchIssues........................................... 169
5.7 FurtherReading.......................................... 170
5.8 Exercises................................................ 171
(cid:105) (cid:105)
(cid:105) (cid:105)