Security Models, Secure Design & Assurance

#Formal Security Models

#What is this?

A security model is a precise set of rules describing what a secure system allows. Each classic model was designed to protect one property: confidentiality, integrity or freedom from conflicts of interest.

#Why it matters

The models explain why real controls look the way they do: why classified systems stop you writing down to lower levels, why banks separate the person who enters a payment from the person who approves it. They are heavily tested on the CISSP and give you vocabulary for design reviews.

#How it works

#Bell-LaPadula — confidentiality

Designed for military classification levels (Top Secret > Secret > Confidential > Unclassified).

        Top Secret     ▲  can't READ UP   ("no read up")
  You → Secret     ────┤
        Confidential   ▼  can't WRITE DOWN ("no write down")

#Biba — integrity (Bell-LaPadula upside down)

• Simple integrity property — no read down: don't let low-integrity data (internet input) contaminate a high-integrity process.
• Star integrity property — no write up: a low-integrity subject can't modify high-integrity data.
• Memory aid: Bell-LaPadula keeps secrets from flowing down; Biba keeps dirt from flowing up.

#Clark-Wilson — integrity through well-formed transactions

Built for commercial systems. Users never touch protected data directly; they must go through approved programs.

• CDI (constrained data item) — protected data, such as account balances.
• UDI (unconstrained data item) — unvalidated input.
• TP (transformation procedure) — the only programs allowed to change CDIs.
• IVP (integrity verification procedure) — checks CDIs are valid.
• The access triple (subject → program → object) plus separation of duties enforces integrity.

A banking app that only lets clerks change balances through a "transfer" function, which checks totals balance and requires a second approver above a threshold, is Clark-Wilson in practice.

#Brewer-Nash (Chinese Wall) — conflict of interest

Access changes based on what you have already accessed. A consultant who reads Bank A's files is then blocked from Bank B's files in the same conflict class. Used in consulting, audit and law firms.

#Others to recognise

In practiceMandatory access control is running on many Linux servers today. SELinux labels every process and file, and policy — not the file owner — decides access:

$ ls -Z /var/www/html/index.html
system_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html       ← type the web server may read
$ ps -eZ | grep httpd
system_u:system_r:httpd_t:s0   1234 ?  00:00:01 httpd
$ ausearch -m AVC -ts recent
type=AVC msg=audit(…): avc:  denied  { read } for  pid=1234 comm="httpd" name="shadow"
  scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0   ← a compromised httpd still can't read /etc/shadow

The s0 at the end is the multi-level security field — Bell-LaPadula levels in a production OS.

🎯

On the job. When an application "needs" SELinux or AppArmor disabled to work, the fix is a policy module for that application, not setenforce 0. See Linux security fundamentals.

#Security angle

Real-world implementations of these ideas include SELinux multi-level security, mandatory access control in Linux (see Linux security fundamentals) and transaction-based integrity in financial systems.

#Secure Design Principles

#What is this?

The short list of principles that architecture reviews check every design against.

#Why it matters

"Walk me through how you'd secure this design" questions are answered by applying these principles one by one, with a concrete example each.

#How it works

📰

Real incident — Target (2013). Attackers stole credentials from Target's heating-and-ventilation contractor, used them to reach a vendor portal, and from there moved through a network that didn't separate vendor access from the payment systems. They installed malware on point-of-sale terminals and stole about 40 million card numbers. Least privilege for the vendor and segmentation of the card environment would each have stopped it.

🎯

On the job. In a design review, walk one request end to end and ask at each hop: who is it authenticated as, what's the minimum it should be allowed, and what happens if this component is compromised or fails? Most findings fall out of those three questions.

#Security angle

Principles conflict: defence in depth adds complexity, which works against keeping it simple. Good answers name the trade-off.

#Product Evaluation — Common Criteria and Certification

#What is this?

Common Criteria (ISO/IEC 15408) is the international standard for independently evaluating the security of IT products, such as firewalls, smart cards and operating systems.

#Why it matters

Governments often buy only evaluated products. Knowing what an evaluation does and doesn't prove stops you over-trusting a certificate.

#How it works

• Protection Profile (PP) — a buyer-side statement of security needs for a product type ("what a firewall must do").
• Security Target (ST) — the vendor's claim of what their product (the Target of Evaluation, TOE) does.
• Evaluation Assurance Levels (EAL) — how rigorously the claim was checked:
  • EAL1 functionally tested · EAL2 structurally tested · EAL3 methodically tested and checked · EAL4 methodically designed, tested and reviewed · EAL5 semi-formally designed and tested · EAL6 semi-formally verified design and tested · EAL7 formally verified design and tested.
• Certification is the technical evaluation of a system; accreditation (authorisation) is management's formal decision to accept the residual risk and operate it.

🎯

On the job. When procurement says a product is "Common Criteria certified," look it up on the Common Criteria portal and check three things: the evaluation assurance level, the version and configuration evaluated, and the protection profile or security target. A firewall evaluated in a strict configuration three versions ago tells you little about the build you're about to deploy.

#Security angle

A high EAL proves the product meets its security target in the evaluated configuration. It says nothing about a different configuration, a newer version, or claims that were never in the target.

#Access Control Models and the Identity Lifecycle

#What is this?

The different ways a system decides who may access what, and the process that keeps those decisions current as people join, move and leave.

#Why it matters

Access that was right last year is wrong today. Privilege creep and orphaned accounts are among the most common audit findings and breach enablers.

#How it works

#Models

#Authentication factors and biometrics

Factor types: something you know (password), have (security key, phone), are (biometric), plus context such as somewhere you are. See authentication and MFA methods.

Biometric errors:

#Identity lifecycle (joiner–mover–leaver)

Joiner ──► provision accounts from the HR record, role-based birthright access
Mover  ──► add new role access AND remove old role access   ← privilege creep happens here
Leaver ──► disable all access on the last day (immediately for hostile departures)
Always ──► periodic access reviews by managers and data owners; privileged access reviewed more often

In practiceDiscretionary access control is the permission model you use every day:

$ ls -l report.xlsx
-rw-r----- 1 alice finance 48213 Oct  9 report.xlsx      ← owner alice decides; group finance can read
$ chmod o+r report.xlsx                                   ← alice can share it with everyone: that's "discretionary"
$ getfacl report.xlsx
user::rw-
user:bob:r--                                              ← an ACL granting one extra person
group::r--

📰

Real incident — the Galaxy S10 fingerprint bypass (2019). Owners found that a cheap third-party screen protector let any fingerprint unlock some Samsung Galaxy S10 phones, including banking apps. The ultrasonic sensor was effectively accepting the pattern of the protector. A biometric system's false-acceptance rate is only as good as its handling of conditions the designers didn't test.

🎯

On the job. Run quarterly access reviews on the systems that matter, and look specifically for movers: people whose job changed in the last year and who still hold their old access.

#Security angle

Movers are the weak point: organisations are good at adding access and bad at removing it. Tie access to roles fed from HR, and review.

#Physical and Facility Security

#What is this?

Protecting the buildings, data centres and equipment that systems run on, and the people inside them.

#Why it matters

Physical access defeats most logical controls: an attacker who can plug into a server or walk out with a drive doesn't need an exploit.

#How it works

#Security angle

Life safety firstDoors that lock on power failure (fail-secure) protect assets but can trap people; doors on escape routes must fail-safe (unlock). When the exam offers "protect people," it is the answer.

#Embedded, IoT and Industrial Systems

#What is this?

Systems that control physical processes or run on constrained devices: industrial control systems (ICS), SCADA (supervisory control and data acquisition), PLCs (programmable logic controllers), building management, medical devices and consumer IoT (Internet of Things).

#Why it matters

Their failure can cause physical harm, they run for decades, they often can't be patched, and many protocols have no authentication at all.

#How it works

Key differences from IT: availability and safety outrank confidentiality; patching needs plant downtime; legacy protocols (Modbus, DNP3) trust anything on the network. The main controls are network segmentation into zones, strict control of the conduits between them, asset inventory, passive monitoring and secure remote access. The full treatment is in IEC 62443.

📰

Real incident — Mirai (2016). Malware scanned the internet for cameras and routers still using factory-default passwords, enslaved hundreds of thousands of them, and launched DDoS attacks that took down the DNS provider Dyn and, with it, major websites. Default credentials on cheap devices became an internet-wide risk; several countries later banned default passwords on consumer devices.

#Secure Software Development

#What is this?

Building security into how software is planned, written, tested, bought and run, instead of testing it in at the end.

#Why it matters

Fixing a design flaw in production costs far more than fixing it in design. Most breaches exploit application code or its dependencies.

#How it works

#SDLC (software development life cycle) models

#Maturity models

#Acquired software

Commercial off-the-shelf, open-source, outsourced and SaaS software all carry inherited risk: assess the vendor, demand an SBOM (software bill of materials), check update and vulnerability-disclosure practices, use contracts for security obligations, and consider source code escrow in case the vendor fails. See dependency management.

#Database security

📰

Real incident — SolarWinds (2020). Attackers compromised SolarWinds' build environment and inserted a backdoor (SUNBURST) into signed updates of its Orion network-management software. About 18,000 customers installed it, and the attackers selectively exploited government agencies and technology companies. The source code repository looked clean; the build system was the target. It drove the push for build integrity (SLSA), SBOMs and hardened CI/CD.

📰

Real incident — the Strava heatmap (2018). A fitness app published a global heatmap of users' aggregated running routes. Analysts noticed it revealed the layout of military bases and patrol routes in conflict zones, where the only users were soldiers. No individual record was secret; the aggregate was. That is the database aggregation problem at internet scale.

🎯

On the job. Map your pipeline the way SolarWinds' attackers would: who can change the build definition, where do dependencies come from, are builds reproducible and signed, and can a single compromised developer token push to production? See CI/CD security.

#Security angle

Most application risk now comes from dependencies and pipelines, not just first-party code; see AppSec for the attacks themselves.