1 / 26

The top ten signs that your classmate is a computer hacker

The top ten signs that your classmate is a computer hacker.

liang
Télécharger la présentation

The top ten signs that your classmate is a computer hacker

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. The top ten signs that your classmate is a computer hacker 10. You ticked him off once and your next phone bill was $20,000.9. He's won the Publisher's Clearing House sweepstakes three years running.8. When asked for his phone number, he gives it in hex.7. Seems strangely calm whenever the office LAN goes down.6. Somehow he/she gets HBO on his PC at work.5. Mumbled, "Oh, puh-leeez" 95 times during the movie "The Net"4. Massive RRSP contribution made in half-cent increments.3. Video dating profile lists "public-key encryption" among turn-ons2. When his computer starts up, you hear, "Good Morning, Mr. President."1. You hear him murmur, "Let's see you use that Visa card now, jerk."

  2. Chinese Wall Security Model Erik Krohn

  3. Chinese Wall Model Outline • What is the Chinese Wall Model? • Chinese Wall Basic Idea • Database Organization • Simple Security • Accessibility • Sanitized Information • *-Property • Bell-LaPadula Model • Other Issues • Other types of Chinese Wall Models • Conclusion

  4. What the Chinese Wall Model is not! China Wall Great Wall of China

  5. What is the Chinese Wall Model? The Chinese Wall Model is an idea that stems from the ability to read or write information. The main idea is that you are able to access any information you want from any company but once you access that information, you are no longer allowed to access information from another company within that class of companies. The in depth look will be at the Brewer and Nash Model which I felt was well done.

  6. Database Organization Three different levels: Objects—Lowest level of the chart; an object can be any information about a company. Company—Group of businesses in the same class. Conflict of Interest Class—Type of business.

  7. Organization (cont) Example: If there are two conflict of interest classes(say banks and oil companies), Oil Company A and Oil Company B must have information separate from each other. Bank A, however, is in it’s own class so their information does not have any rule about knowing information about Bank A and Oil Company B.

  8. Simple Security If a new person enters the system; that person has a free choice on what information they want to know. If they choose Oil Company A there should be no problem with that. Later on that same person decides to get some information on Bank A. This is course is not a problem because Bank A and Oil Company A belong to different classes. However, if our person decides they want to access information from Oil Company B, they must be denied access because of their knowledge of Oil Company A.

  9. Simple Security (cont.) We note that it does not matter whether or not Oil Company A was accessed before Bank A. However, the restrictions of the Chinese Wall would be quite different if the user were to access Oil Company B first. The dataset the user would have access to would change from {Oil Company A, Bank A} to {Oil Company B, Bank A}

  10. Simple Security (cont.) It is now quite obvious how a Chinese Wall can prevent people from viewing information that is outside of their wall. The wall is not constant however and can change shape to include new data from new companies. You can now see that the Chinese Wall Model is a subtle combination of the ability to choose freely what information you want and the control that is needed to prevent knowing too much information.

  11. Now for some math Axiom 1: Y1 = Y2 ----> X1 = X2 Corollary: X1 != X2 ----> Y1 != Y2 Axiom 2: Xc != Xr V Yc = Yr

  12. More Math… Just a couple other axioms needed for later on: Axiom 3: N(v,c) = false Axiom 4: If N(u,c) is everywhere false for some Su, then any request is granted.

  13. Accessibility Theorem 1-Once a subject has accessed an object, the only other objects accessible by that subject lie within the same company dataset or within a different conflict of interest class. Theorem 2-A subject can at most have access to one company dataset in each conflict of interest class. Theorem 3-If for some conflict of interest class X there are Xy company datasets, then the minimum number of subjects which will allow every object to be accessed by at least one subject is y.

  14. Sanitized Information How can a person compare data from Oil Company A to Oil Company B without violating the Chinese Wall Model?

  15. Sanitized Information (cont.) Sanitation takes the form of disguising a corporation’s information. This is done to prevent the discovery of that companies identity. Sanitation can not work if there is data that can lead back to the company from which it originated. It is sensible to assume that all companies contain some sort of information that is unique to each individual company. The rest of the information that is not unique can be considered to be able to be sanitized.

  16. More Axioms! Axiom 5: Y0 <-----> X0 Axiom 6: Ya <>Yb and Ya <>Yo

  17. *-Property Write Access is only permitted if: A) Access is permitted by the simple security rule and B) No object can be read which is in a different company dataset to the one for which write access is requested and contains unsanitized information. Because of this rule we get some more math jargon: Theorem 4-The flow of unsanitized information is confined to its own company dataset. Sanitized information may flow freely throughout the system.

  18. Bell LaPadula ModelQuick Overview Object Composition: Each object within this model has the following attributes: 1. Class 2. Cat Each subject has the following attributes: 1. Clear 2. NTK (need-to-know) Transformation of previous model to BLP Model.

  19. Access Rules Bell LaPadula Model also has a simple security rule and a *-property: Simple Security-Access is granted only if the subject’s clearance is greater than the object’s classification and the subject’s need to know includes the objects categories. *-Property-Write access is granted only if the output object’s classification is greater than the classification of all input objects and it’s category includes the categories of all input objects. This is best represented with a military style model.

  20. Bell LaPadula Side Notes These rules do not contain any information about whether or not a subject already accessed an object. The model only cares about a clearance level and not past knowledge. The Bell LaPadula Model can be transformed fairly easily into the Clark and Wilson Model as was showed before.

  21. Other Issues The policy and model just shown is a very good way to implement a Chinese Wall Model. In some countries(unknown), simply showing that a Chinese Wall Model was in place and was violated is enough evidence to convict people of insider knowledge. Another problem is the other variable of time. As time passes information may no longer belong in a conflict of interest class.

  22. Other Issues Another issue with the model may include a data relinquishing aspect. A person may be reassigned to a different company and therefore needs part of the wall torn down and rebuilt to accept new information and relinquish data from another company.

  23. Other Models There are many different models you can look at to implement the Chinese Wall Model. The following are other models: Clark and Wilson Model 1987 Trace-Based Model 1999 ConSA Model 1998 Brewer and Nash Model 1989 Bell LaPadula Model 1976 Sandhu Model 1993

  24. Conclusion The Chinese Wall Model is a good model that can be implemented in many different ways but must contain the same basic concepts. The Chinese Wall Model is a fairly simple concept to grasp once you get by the mathematical jargon that many papers throw at you. The basic point behind it all is to keep people from obtaining too much information and making criminal actions with that knowledge(ie Martha Stewart). The Chinese Wall Model tries to keep information about a company confidential and private.

  25. Weather Just for the record, this is the current weather: http://www.weather.com/weather/local/54601?lswe=54601&lwsa=WeatherLocalUndeclared Get out and enjoy!

  26. Bibliography • http://www.cs.uidaho.edu/~jimaf/docs/chinese99.pdf • http://mo.co.za/open/chinwall.pdf • http://www.gammassl.co.uk/topics/chinesewall.html • http://piglet.uccs.edu/~cs691/confidentialityPolicyies/hybridPolicy.ppt • http://www.dfki.de/~hutter/lehre/sicherheit/accesscontrol.PDF

More Related