-->

Selasa, 17 April 2018

A computer security policy defines the goals and elements of an organization's computer systems. The definition can be highly formal or informal. Security policies are enforced by organizational policies or security mechanisms. A technical implementation defines whether a computer system is secure or insecure. These formal policy models can be categorized into the core security principles of: Confidentiality, Integrity and Availability. For example, the Bell-La Padula model is a confidentiality policy model, whereas Biba model is an integrity policy model.

Formal description




How to Write an Information Security Policy in 5 Minutes - Create a draft information security policy in less than five minutes using policy templates. Take the work out of writing security polciies. The templates can be used to comply with ISO 17999,...

If a system is regarded as a finite-state automaton with a set of transitions (operations) that change the system's state, then a security policy can be seen as a statement that partitions these states into authorized and unauthorized ones.

Given this simple definition one can define a secure system as one that starts in an authorized state and will never enter an unauthorized state.

Formal policy models


02-SecurityPolicies - CSC 429 Computer Security Chapter 3 Security ...
02-SecurityPolicies - CSC 429 Computer Security Chapter 3 Security .... Source : www.coursehero.com

Confidentiality policy model

  • Bell-La Padula model

Integrity policies model

  • Biba model
  • Clark-Wilson model

Hybrid policy model

  • Chinese Wall (Also known as Brewer and Nash model)

Policy languages


Reset Local Security Policy Settings to Default in Windows Windows ...
Reset Local Security Policy Settings to Default in Windows Windows .... Source : www.tenforums.com

To represent a concrete policy especially for automated enforcement of it, a language representation is needed. There exist a lot of application specific languages that are closely coupled with the security mechanisms that enforce the policy in that application.

Compared with this abstract policy languages, e.g. the Domain Type Enforcement-Language, are independent of the concrete mechanism.

See also


Chap 4. Security Policies - ppt download
Chap 4. Security Policies - ppt download. Source : slideplayer.com

  • Anti-virus
  • Information Assurance - CIA Triad
  • Firewall (computing)
  • Protection mechanisms
  • separation of protection and security
  • ITU Global Cybersecurity Agenda

References


Security Policy Roadmap Process Creating Security Policies ...
Security Policy Roadmap Process Creating Security Policies .... Source : es.scribd.com

  • Bishop, Matt (2004). Computer security: art and science. Addison-Wesley. 
  • Feltus, Christophe (2008). "Preliminary Literature Review of Policy Engineering Methods - Toward Responsibility Concept". Proceeding of 3rd international conference on information and communication technologies : from theory to applications (ICTTA 08), Damascus, Syria; Preliminary Literature Review of Policy Engineering Methods - Toward Responsibility Concept. 
  • McLean, John (1994). "Security Models". Encyclopedia of Software Engineering. 2. New York: John Wiley & Sons, Inc. pp. 1136â€"1145. 

Policy - Info Sec Dr.Talal Alkharobi - ppt download
Policy - Info Sec Dr.Talal Alkharobi - ppt download. Source : slideplayer.com

 
Sponsored Links