Security Assessment Methodology for Isolated Systems of a Certain Class

• Autorzy: Wiechecki Daniel

Identyfikatory

DOI

10.24425/ijet.2020.134005

• Języki publikacji: EN

Abstrakty

EN

This paper introduces security assessment methodology for isolated single-workstation multilayer systems processing sensitive or classified data according with a corresponding security model for such system. The document provides a high-level tool for systematizing certain-class-systems security models development. The models based on the introduced methodology cover data confidentiality and availability attributes protection on a sufficient level.

Słowa kluczowe

EN

cybersecurity; security assessment methodology; security model; Graham-Denning model; Bell-LaPadula model; Clark-Wilson model

• Wydawca: Polish Academy of Sciences, Committee of Electronics and Telecommunication
• Czasopismo: International Journal of Electronics and Telecommunications
• Rocznik: 2020
• Tom: Vol. 66, No. 3
• Strony: 499--505
• Opis fizyczny: Bibliogr. 20 poz.

Twórcy

autor

Wiechecki Daniel

• absolwent i uczestnik projektów badawczych, Military University of Technology

Bibliografia

• [1] Act of August 5, 2010 for the protection of classified information, Journal of Laws for 2010 No. 182, item 1228.
• [2] Alpcan T., Basar T., A game theoretic analysis of intrusion detection in access control systems, Proc. IEEE Conference on Decision and Control: p. 1568-1573, USA 2004.
• [3] Barkley J., Comparing Simple Role Based Access Control Models and Access Control Lists, Proc. Second ACM workshop on Role-Based Access Control: p. 127-132, USA 1997.
• [4] Bell D.E., Looking Back at the Bell-La Padula Model, Proc. 21st Annual Computer Security Applications Conference: p. 337-352, USA 2005.
• [5] Bell D.E., La Padula L.J., Secure Computer System: Unified Exposition and Multics Interpretation, ESD-TR-75-306, Bedford 1974 MA: ESD/AFSC, Hanscom AFB.
• [6] Biba K.J., Integrity Considerations for Secure Computer Systems, MITRE, USA 1975.
• [7] Chukwudi A.E., Udoka E., Ikerionwu C., Game Theory Basics and Its Application in Cyber Security, Advances in Wireless Communications and Networks. Volume 3, Issue 4: p. 45-49, 2017.
• [8] Clark D.D., Wilson D.R., A Comparison of Commercial and Military Computer Security Policies, Proc. IEEE Symposium on Research in Security and Privacy: p. 184-194, USA 1987.
• [9] Denning D.E., A lattice model of secure information flow, Communications of the ACM Volume 19 Issue 5: p. 236-243, USA 1976.
• [10] Ferraiolo D., Kuhn D.R., Role-Based Access Controls, Proc. 15th National Computer Security Conference: p. 554-563, USA 1992
• [11] Graham R., Denning P., Protection - Principles and Practice, Proc. AFIPS Spring Joint Computer Conference: p. 417-429, USA 1972.
• [12] Harrison M.A., Ruzzo W.L., Ullman J.D., Protection in Operating Systems, Communications of the ACM Volume 19 Issue 8: p. 461-471, USA 1976
• [13] ISO/IEC 27002:2013, Information technology - Security techniques - Code of practice for information security controls.
• [14] Kuhn D.R. Role Based Access Control on MLS Systems Without Kernel Changes, Proc. Third ACM Workshop on Role-Based Access Control: p. 25-32, USA 1998
• [15] Laskowski W., Teoriogrowe modele bezpieczeństwa systemów teleinformatycznych, Proc. IV Konferencja Entuzjastów Informatyki: p. 81-90, Chełm 2005.
• [16] Loscocco P.A., Smalley S.D., Muckelbauer P.A., Taylor R.C., Turner S.J., Farrell J.F., The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments. Proc. 21st National Information Systems Security Conference: p. 303–314, October 1998
• [17] Lye K., Wing J., Game strategies in network security, Proc. 15th IEEE Computer Security Foundations Workshop, Copenhagen, Denmark 2002.
• [18] Regulation of the Prime Minister dated July 20, 2011 on the basic requirements of IT security, Journal of Laws for 2011, No. 159, item 948.
• [19] Sandhu R.S., Lattice-Based Access Control Models, IEEE Computer, Volume 26 Issue 11: p. 9-19, USA 1993.
• [20] Wiechecki D., The security model of a virtual machines system with multi-layer cryptographic protection, Military University of Technology, Warsaw, 2019.

Uwagi

This work was presented at the International Scientific Conference Mathematical Cryptology & Cybersecurity (MC&C 2020), Warsaw, 16-17.01.2020.

Opracowanie rekordu ze środków MNiSW, umowa Nr 461252 w ramach programu "Społeczna odpowiedzialność nauki" - moduł: Popularyzacja nauki i promocja sportu (2020).