Confidentiality policies

Question 1

What are the main components of a multilevel security policy?

Answer 1

Multilevel security policies consist of a set of clearances and categories.

A category is a set of objects (pieces of information). One example may be the set of files concerning a companies finances.

A clearance is an hierarchical structure of sensitivity levels.

Subjects are assigned clearance levels and objects are assigned classification levels. A subject s can only read an object o if s has a clearance level equal or higher than that of o and for the same category.

Question 2

What are the typical clearance levels?

Answer 2

The typical clearance levels are:

Top Secret - Secret - Confidential - Unclassified

Question 3

What is the Simple Security condition?

Answer 3

The Simple Security condition says that a subject s may only read o if l(s) >= l(o). This is also refereed to as s dominating 0.

The simple security condition is frequently described as “no read up”.

• l(s) is the security level of s and l(o) for the object o.

Question 4

What is the *-property?

Answer 4

The *-(star)property states that a subject s can write to o only if l(s)<=l(o). In other words, s can only write to o if its security clearance is equal or less than that of o.

• l(s) is the security level of s and l(o) for the object o.

** It might seem counter intuitive to allow subjects with a lower clearance level to write upwards. However, the main goal with both the *-property and the simple security condition is to ensure that information only flows “upwards”. A subject with a higher clearance level will have access to information with a higher security level than o. By not permitting s to write to o we guarantee that information with a higher security level is not leaked to o and thereby to other subjects with lower levels.

Question 5

What is the point of adjusting the security clearance of subjects and having both a current security level and a maximum security level?

Answer 5

Allowing a subject to alter its security level allows for more flexibility than the strict requirements imposed by the simple security condition and the *-property.

If Alice wants to communicate with Bob and her current security level is higher than Bob, she must first reduce her security level.

• Alice communicating to Bob is effectively the same as writing to an object.