CISSP 8.3 - Understand the Fundamental Concepts of Security Models (Part 1 of 3)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens a three-part tour of security models in Domain 3, showing how a policy written in plain language becomes rules a machine can actually enforce — from the trusted core at the heart of a system to the foundational models that every named framework in the later parts builds upon.

Frequently Asked Questions

What is a security model, and why do we need one?

A security model is a formal way to express a security policy as explicit rules a computer can follow. It takes abstract goals and maps them into the algorithms and data structures needed to build the actual hardware and software, turning intent into something testable. It also gives designers a yardstick to measure their implementation against.

How do we tag an object’s security attributes?

There are three common ways. A security token is a small separate object that travels with a resource and announces its security details before access is requested. A capabilities list keeps a row of security attributes for each object, offering faster lookups but less flexibility, while a security label is usually a permanent, unchangeable part of the object itself, and that permanence makes it resist tampering in a way the other two cannot.

What is the trusted computing base, and where is its boundary?

The trusted computing base is the combination of hardware, software, and controls that together enforce your security policy. It is only a subset of the whole system, and you want it as small as possible so it can be analyzed thoroughly and trusted completely. Around it sits the security perimeter, an imaginary boundary separating the trusted core from everything else, crossed only by tightly controlled trusted paths.

What is a reference monitor, and how does the security kernel enforce it?

The reference monitor is the part of the trusted base that checks every access request before it is allowed, standing between every subject and every object and verifying that the requester’s credentials satisfy the object’s requirements. It is a concept, a rule that must always hold. The security kernel is the actual collection of hardware and software that puts that concept into practice, mediating every resource request and granting only those that match the rules.

How does noninterference stop hidden leaks?

Noninterference makes sure the actions of a high-level subject never affect what a low-level subject sees or does. If a high user’s activity could ripple down and change the low user’s view, that low user might infer secrets they were never cleared for, which is exactly what a covert channel exploits. By forbidding that interference, the model also blocks a class of malicious programs, like a Trojan horse trying to signal secrets downward.

Reference: This article is based on concepts discussed in CISSP 8.3 - Understand the Fundamental Concepts of Security Models (Part 1 of 3).