According to the Bell-Lapadula model, write access is only to Subject $S$ on object $O$ provided if: $L(S) \leq L(O)$ where $L$ is the clearance level for $S$ and classification for $O$. This seams counter intuitive. Are there any attacks that this protects against and what other benefits are presented by it?
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
This equation expresses a confidentiality property. There are two ways of looking at it: what does it permit and what does it prevent.
- Prevented: writing secure information to an insecure place.
- Permitted: writing insecure information to a secure place.
Clearly, the former is good, otherwise, for example, your PIN number (secure) could become accessible to untrusted third parties.
From a security perspective, the former is safe, because no secure information is leaked. It allows cases such as where you report your daily activities (insecure) to your manager (trusted).
One concern you may have is that writing insecure information to a secure place could lead to problems. These problems would be related to integrity. An integrity violation occurs when bad data from an untrusted source is written into a secure variable. If the data isn't checked for validity, it could mess up programs running securely.
answered Aug 18, 2015 at 13:01
$\begingroup$
$\endgroup$
If you write the code of the electronic lock of your house under your doormat, it's quite risky : Something which should be only in a secure area, like your memory, is now also in an unsecure area.
But if you write it in your bank safe box, it's ok, because it is at least as difficult to learn the code from this very secure area than from your memory (with torture for instance).
