IT Networks and Security
& CERIAS
CISSP Luncheon Series
Security Architecture and Design
Presented by Rob Stanfield
Domain Overview
Identify key principles and concepts
critical to securing the infrastructure
• Design
• Implementation
• Operation
Ensure security from a hardware/software
level
• Operating Systems
• Applications
• Equipment
• Networks
CISSP Expectations
Identify physical components of IT architecture
Understand software relationships
Understand design principals for the architecture
Describe how to secure an enterprise
Identify trusted and un-trusted components
Discuss security models and architecture theory
Identify appropriate protection mechanisms
Discuss evaluation methods and criteria
Understand the role of assurance evaluations
Explain certification and accreditation
Identify techniques used to provide system security
System Architecture
Three basic components
CPU – Central Processing Unit
Storage Devices – includes both long and
short-term storage, such as memory
and disk
Peripherals – includes both input and
output devices, such as keyboards and
printer
CPU – Computer Brain
ALU – Arithmetic Logic Unit
Control Unit
Registers
• General and special registers
Bus
• Address and data
Privileged mode or user mode
Multiprocessor - symmetric or
asymmetric
CPU Example
Storage Devices
Primary Storage
Cache or registers
Memory (RAM, ROM, Cache, Flash)
Secondary Storage
Disk
CD or Tape
Virtual Memory
Memory
Peripherals or I/O Devices
Some examples are
Monitor
Keyboard
Printers
Basic Components Diagram
Operating System
Architecture
An Operating System provides an
environment to run applications
Process Management for all processes
• Process - a set of instructions and the
information & resources needed to process
it.
Multitasking – cooperative, preemptive
Process State – running, ready, blocked
Application Programs
Applications interact with the operating
system to perform a task
Each application is a process
Applications run in user mode
Threads
Other applications
• Firmware and Middleware
Protection Rings
Security Models
Security Policy – documents the security
requirements for an organization
Security Model – formally outlines the
requirements needed to support the security
policy, and how authorization is enforced
Reference Monitor – abstract machine that
provides auditable access control to objects
Trusted Computing Base (TCB)
Security Model Examples
Biba Integrity Model
Bell-LaPadula Confidentiality Model
Clark-Wilson Integrity Model
Brewer and Nash Model
Others
• State Machine Model
• Non-Interference Model
• Graham Denning Model
• Harrison-Ruzzo-Ullman Model
Bell-LaPadula Confidentiality
Model
Subject to object model
• Objects you are able to access
Used to provide confidentiality
3 main rules used and enforced
• Simple security rule (no read up)
» Subject cannot read data at a higher level
• The *-property rule (no write down)
» Subject cannot write data to a lower level
• Strong star property rule
» Subject with read/write – only at same level
Biba Security Model
Similar to the Bell-LaPadula Model
First to address integrity
• Difference between Biba and Bell-LaPadula
Two main rules used and enforced
• *-integrity axiom (no write up)
» Subject cannot write data to objects at higher level
• Simple integrity axiom (no read down)
» Subject cannot read data from lower level
Biba and BP are informational flow models
• Concerned with data flowing up or down levels
Clark-Wilson Model
Addresses all 3 integrity model goals
• Prevent unauthorized users from
making modifications
• Prevent authorized users from making
improper modifications (separation of
duties)
• Maintain internal/external consistency
(well-formed transaction)
Other Models
Non-interference model - Actions at a higher
level (domain) cannot interfere with actions at a
lower level.
State machine model - Abstract math model
that uses state variables to represent the
system state. Failure of a state machine should
fail in a secure state.
Graham-Denning Modem – Used eight basic
protection rules.
Brewer and Nash Model (Chinese Wall Model) -
Allows for dynamically changing access
controls to protect against conflicts of interest
Evaluation Methods and
Criteria
Trusted Computer Security Evaluation Criteria (TCSEC) –
addresses confidentiality only
• A Verified protection
» A1 verified design
• B Mandatory Protection
» B3 Labeled Security
» B2 Structured Protection
» B1 Labeled Security
• C Discretionary Protection
» C2 Discretionary Protection
» C1 Controlled Access
• D Minimal Security
Others are ITSEC, SEI
Common Criteria (ISO) based on TCSEC & ITSEC
• Evaluation Assurance Levels (EAL 1 – 7 )
Certification and
Accreditation
These are distinct steps
• Certification relates to validation of the
system
» Security modes of operation
» Data sensitivity handling procedures
» System and facility configuration
» Intercommunication with other systems
• Accreditation relates to management
evaluation once the certification process is
complete. Does the system meet the needs of
the business while satisfying the security
needs?
