Data Security And Privacy

Security and privacy basics

Martedì 10 marzo 2020 10:27

Security of end systems

Security of information in transit over a network. Today's security is weaker than in the past. We are living in the so-called cyberspace where millions of devices are connected through the Internet.

Cybersecurity

In cyberspace, there are no national boundaries. Attacks can be done remotely, and the attack surface is big.

Basic components of security: CIA triad

• Confidentiality: Information only available to those authorized.
• Availability: Maintaining resource deliverable to intended users.
• Integrity: Maintaining data validity.

Additional components:

• Authenticity
• Accountability
• Privacy: Maintaining confidentiality of personally identifiable information.

Threats

Potential scenarios of attack:

• Potential violation of security - Violation doesn't need to actually occur, this fact makes it a threat.
• The violation of security is called "Attack".

Common security threats

• Interruption, delay, denial of service (system information becomes unavailable).
• Interception or snooping (unauthorized gains access to information).
• Modification or alteration (unauthorized changes information in transit).
• Fabrication, masquerade, spoofing (fake information inserted into the system).
• Repudiation of origin (false denial that an entity did something).

Attacks

The act of causing harm by exploiting a vulnerability. Causes of software security incidents include:

• Buggy software and wrong configuration
• Lack of awareness and education
• Poor usability
• Economic factors
• Human factors

Organizational problems and people problems (outsiders and insiders).

Policies and mechanisms

Policy: Says what is, and is not, allowed (define security).

• Natural language (imprecise but easy to understand)
• Mathematics (precise but hard to understand)
• Policy language

Mechanisms enforce policies. Examples include:

• Encryption
• Digital Signature
• Authentication protocols
• Access control

Data Security And Privacy Page 1

Security and privacy basics (2) - Lecture 3.1

Mercoledì 18 marzo 2020 10:10

Goal of security

• Prevention: Prevent attackers from violating security policy.
• Detection: Detect attackers violating security policy.
• Verify how good is prevention mechanism.
• If detection connects a lot of lacks of security system weaknesses.
• Response and recovery: When you detect an attack, you need to try to stop it and repair the damage.
• Fix vulnerabilities for preventing future attacks.

Assumptions and trust

Assumptions regarding policies:

• Select what type of user can do and can't do.

Assumptions regarding mechanisms:

• Assume that all components work correctly.

System state

Reachable state: If the system can enter this state.

Secure state: A state that a system can enter but it's authorized by policy.

Type of security mechanisms

• Secure: Set of reachable states in a bigger set of secure states.
• Precise: Maximize availability of system without compromising security - all secure states are reachable.
• Broad: Some non-secure states are reachable - TO AVOID.

Assurance

Indicate how much to trust a system, achieved by ensuring that:

• Required functionality is correctly implemented.
• Sufficient protection against unintentional errors.
• Sufficient resistance to intentional attacks and by-pass.

Data Security And Privacy Page 3

Data Security - Lecture 3.2

Mercoledì 18 marzo 2020 10:49

Basic security pipeline

1. Identification (identify user): System uses the user ID to identify the user.
2. Authentication (demonstrate identity): Process to verify the digital identity of the sender of a communication. Authentication depends upon one or more authentication factors.
3. Authorization (allow action): Determine what types of activities or access are permitted for a logical resource.

The difference between identification and authentication is that the first identifies only the user and the second checks the user's ID with a supplied password.

Data Security And Privacy Page 4

Access Control: Basic concepts - Lecture 4.1

Mercoledì 18 marzo 2020 11:12

Regulate every operation

Regulate every operation (read, write, update) that can be performed on the data stored in the database. Purpose: Limit and control operations the user carries out.

Goals of Access Control

• Preventing access
• Limiting access
• Granting access
• Revoking access

Basic Components

Security of user, a set of administrators that has to specify access control policies:

• Translate into a set of authorizations to implement access control.
• Specify that a specific user can access specific files/levels.

Subjects (user or application that require access to data):

• Submit a query to select some data.

Reference Monitor

The most important component:

• Software module that enforces access control.
• Intercept any submission request, check authorization, and decide if access can be granted or denied.

Access Control Policies

Define the high-level guidelines describing the access to be authorized in the system. Translated into a set of authorizations stating who can access and under which mode.

AC Model: Used to formally specify authorization. Policies and authorization are expressed in terms of subject, objects (resource to be protected), and access rights (specify the operation that can be performed by subject).

Subjects are active entities that get accessed, while objects are passive entities that require protection. Rights represent different types of access. All of this can be hierarchically organized to reduce the number of authorizations.

Authorizations

Represented as a triple (s, o, r) (subject, object, right).

AC Mechanism

Based on the definition of a reference monitor that should be:

• Tamperproof: Cannot be altered.
• Not bypassable: Mediate all access to system and resources.
• Small enough to be susceptible to rigorous verification methods (the logical implementation of the reference monitor should be very simple, so it's easy to grant access).
• Confined in a limited part of the system.

Data Security And Privacy Page 5

Access Control: Main Models - Lecture 4.2

Mercoledì 18 marzo 2020 15:07

AC: Relevant Models (enforce AC)

• DAC (Discretionary access control)
• MAC (Mandatory access control)
• RBAC (Role-based access control)

DAC

The most important feature: Users can modify the authorization base (authorization in the system). Enforce AC on the basis of:

• Identity of the requestors
• A set of authorizations explicitly specified by users

Reference monitor checks the authorization to determine if access can be granted.

Advantages:

• Very flexible: Users can explicitly modify the authorization base.
• Supported by almost all DBMS, OSs, and SQL, Social Networks (change the privacy setting).

Weaknesses:

• No control of what happens to information once released.
• Vulnerable to Trojan horse (application that contains hidden code to transfer information without violating policies).

Data Security And Privacy Page 6

MAC and RBAC - Lecture 4.3

Mercoledì 18 marzo 2020 15:44

Mandatory Access Model

Restricts access of subject to object. Prevent Trojan Horse. System security policy is managed by a set of administrators (not possible for users to change authorization base). Based on subject and object classification.

• Multilevel security (MLS)
• DB systems that implement MAC are called Multilevel secure DBMS (MLS/DBMS). Many of these have been designed based on the Bell and LaPadula Model (BLP).

Basic idea:

• Subjects and objects are classified in security levels referred to as access classes.
• Partial order among access classes.
• Access classes are assigned by the Security Officer based on the sensitivity of the information and the trust level of the subject.
• Who gets access is determined by access classes.

Advantages:

• Prevent Trojan.

Disadvantages:

• Can be easily applied only in specified contexts (objects and subjects can be classified).
• Not supported by SQL and many DBMS.

RBAC: Motivations

Modification of DAC, works in the same way as DAC, but it has been designed to resolve the big issue of DAC (management of authorization). Authorization is not based on identity but on role. Control is based on employee functions rather than data ownership.

Roles: Represent job functions within an organization to which a set of authorizations should be granted. So, RBAC is the same as DAC but the authorization is assigned to the role instead of the user.

Advantages:

• Roles are smaller in number than users —> less authorization.
• Roles are more stable in the system than users.
• RBAC models have been shown to be policy-neutral.

Limitations:

• Role explosion (number of roles can be very high).

Data Security And Privacy Page 7

Advanced AC Models - Lecture 4.4

Mercoledì 18 marzo 2020 17:07

PBAC (Purpose based access control)

When privacy should be protected:

• Purpose for which the data is acquired (address for shipping purposes).
• Authorization is based on the purpose for which data is used.
• A user can read data only for a specific function (e.g., a vendor can see the customer's address only for shipping purposes).

TBAC (Time based access control)

Access is linked to the temporal dimension. Authorization has a temporal limit.

LBAC (Location based access control)

Allow authorization only when access is requested from a target location.

ABAC (Attribute based access control)

More general than previous, in the sense that it can model all kinds of access control. Uses attributes as building blocks to define authorization. Attributes are name-value pairs (e.g., role=manager).

Data Security And Privacy Page 8

Administrative Policies - Lecture 5.1

Giovedì 19 marzo 2020 10:10

Define who can specify authorization and revoke them

Bottleneck: Occurs when the capacity of an application or computer system is limited by a single component.

Centralized

A privileged authority is in charge of granting/revoking authorization (MAD).

Advantages:

• Only one person handles authorization.

Disadvantages:

• Can become a bottleneck in terms of efficiency and security.

Ownership-based

The creator of objects becomes Security Administrator (can grant and revoke). Authority to specify authorizations can be delegated (SQL - Grant options).

Advantages:

• Being more flexible.

Disadvantages:

• Delegation complicates the scenario (if many users are delegated to grant access on my object, I can lose control).

Cooperative

Granting and revoking authorization requires the consent of different admins. Good fit for specific scenarios.

Design Principles

Need to know principle: Give each subject only the necessary access to complete its task.

If some data aren't covered by any authorization, a system is denoted as:

• Closed: Prohibits access for these objects (default) —> Stronger security.
• Open: Authorizes access for these objects —> Less secure.

Data Security And Privacy Page 9

Bell and LaPadula model (1) - Lecture 5.2

Giovedì 19 marzo 2020 10:47

Reference Access Control Models

• MAC - Bell and LaPadula model
• DAC - Grant-Revoke (System R) model
• RBAC - NIST model

The Bell and LaPadula model is defined for operating systems and the military domain.