Article Review

INFORMATION SECURITY ARTICLES REVIEW

Drake Heard Florida State University dsh10c@my.fsu.edu

Abstract
The overview of this paper is to understand the different topics that were discussed in the four articles that were given to me to review. This paper shall discuss topics from RBAC models to computer surveillance and shall give a summary of each article that I read over the course of the first part of the semester. Keywords: RBAC, security, model, computer, hierarchy, computer, data, intrusion, threat, NIST, detection

INTRODUCTION
Information security is a pivotal step in keeping files and data safe from the harm of users who wish to misuse the data or create files that can harm systems. Someone has to be able to detect these threats that harm our safe data and the summaries below help show the different ways that structures and processes that can be implemented to help fight off threats and intrusions.

RBAC Model
INTRODUCTION
The idea of the role-based access control (RBAC) concept started in the 1970s with multi-user and multiapplication on-line systems. The central idea of RBAC was that permissions were associated with roles and users were assigned to the appropriate roles. Roles were created for the different job functions in an organization or company and users would be assigned roles based on their skill set and responsibilities. Any user could be reassigned from one specific role to another with ease. Roles can also be granted new permissions as new systems and applications are added. Permissions can be revoked from roles as need. There are primary rules that are associated with the RBAC model and one should express these rules if they are to truly understand the basis of a RBAC model. The first rule would be role assignment, which a subject can use permission only if the subject has been selected or assigned a role. The next rule is role authorization and that a subjects active role must be authorized for that subject. With the first rule, this makes sure that users can only use roles that they have authorization. The last rule is permission authorization; a subject can use permission only if the permission is authorized for the subject active role. With the first two rules in place, this ensures that users can use only permissions that they are authorized to use.

ROLE HIERARCHIES and CONSTRAINTS

The RBAC model created role hierarchies (RH) that are included whenever roles are discussed. Role hierarchies are ways for structuring roles to illustrate organization lines of authority and responsibility. To someone mathematical, hierarchies are partial orders. A partial order is a reflexive, transitive and anti-symmetric relation. When trying to define a RBAC model the following key would be very useful in understanding the model as a whole: S = Subject = The person or agent

Florida State University iSchool 1

Article Review

R = Role = Job function or title that defines the authority level P = Permissions = A right to access a resource SE = Session = Mapping that involves S, R, and/or P SA = Subject Assignment PA = Permission Assignment RH = Partially ordered Role Hierarchy. It can also be written as

Constraints can be placed as a restrictive rule on the inheritance of permissions from different roles, which can create separation of duties. An example would be that the same person should not be able to both create a login account and authorized the account creation.

CONCLUSION
We have discussed broadly what a RBAC model is and its functions within the model. This model provides a blueprint that any organization can use to create its users and administrators accordingly. There were three rules discussed, (role assignment, role authorization, permission authorization), that created the basis of the RBAC model and its functions. From the blueprint, role hierarchies and constraints are created to give inheritance to certain users and constraint other users from using the same permissions as administrators. All these features help create the RBAC model and its various functions.

Intrusion-Detection Model
INTRODUCTION
This review will discuss the concepts and history of the intrusion-detection model that is talked about in the article. The intrusion-detection model was made as a real-time intrusion detection system for experts. The aim of the model was to detect a wide range of security violations ranging from attempted break-ins by outside hackers to system penetrations and abuse from users. The model was created on the hypothesis that an exploitation of systems vulnerabilities involved the wrong use of a system.

TYPES of SYSTEM ABUSE

There are many types of abuse that occur within a system and the following below are just a fraction of the many options available to someone who wants to abuse a system. Attempted break-in: Someone trying to break into a system which might generate a high rate of password failures with a single account Virus: file that is planted and may cause an increase in the amount of executable files rewritten, or program being executed as the virus spreads Denial-of-Service: Someone is able to monopolize a network and have high activity with the resource, while other users are low

OVERVIEW of MODEL
The intrusion-detection model is based on four factors. The first is that most existing systems in use have security flaws that makes them open to intrusion, penetrations, and other types of abuse. Next, existing systems with known flaws are easy to replace with newer systems that are more secure because some systems have cute features that are mission in the secure system or they cannot be replaced because of funding. Third, developing systems that are more secure are difficult to accomplish. Finally, even the most secure systems are vulnerable to users who misuse their privileges. All these factors gave birth to the model and how it has evolved over the years The model has six pieces that makes it up:

2 Florida State University iSchool

Article Review

Subjects: Initiators of activity on a system that can be a target Objects: Resources managed by the system Audit records: Generated by the target systems in response to actions performed or attempted by subjects on objects like users logging into a computer or accessing files Profiles: Structures that characterize the behavior of the subjects with respect to objects in terms of statistical metrics and models of observed activity. Anomaly records: Generated when abnormal behavior is detected Activity rules: Actions taken when some condition is satisfied

The thing is to monitor the operations on a target system, looking for deviations in the usage. This model does not contain any special features for handling complex actions that exploit a known or suspected flaw in the system. By detecting the intrusion, the security administrator may have a better understanding on how to locate vulnerabilities.

CONCLUSION
The IDES model gives a sound basis for developing real-time intrusion detection capable of detecting a wide range of intrusions related to break-ins, viruses, Trojan horses, etc. This model allows intrusions to be detected without knowing about any flaws in the target system that allowed the intrusion to take place. There is very little knowledge about the exact relationship between certain types of abnormalities and intrusions and with knowledge creates understanding of how intrusions happen and how they play a part in detecting these new types of intrusions

NIST RBAC
INTRODUCTION
This summary will discuss the unified model for the role-based access control. There has not been a standard model in effect that has resulted in uncertainty and confusion about its meaning. The NIST model will try to resolve this issue by unifying ideas from previous RBAC models, commercial products and research prototypes. It will serve as the new foundation for developing future standards. The NIST model is organized into for levels which I will talk about each briefly in the paragraphs below. The four levels consist of flat RBAC, hierarchal RBAC, constrained RBAC, and symmetric RBAC.

FLAT RBAC
Flat RBAC takes a lot from the original RBAC model but adds a new requirement for its model. The new requirement is for user-role review where the roles assigned to a specific user can be determined as well as users assigned to specific roles. Also the flat RBAC requires that users can simultaneously exercise permissions of multiple roles. Below are some functional capabilities for flat RBAC: Users acquire permissions through roles Must support many-to-many user-role assignment Must support many-to-many permission-role assignment Must support user-role assignment review Users can use permissions of multiple roles simultaneously

HIERARCHICAL RBAC

Florida State University iSchool 3

Article Review

The hierarchical RBAC will add a requirement for supporting role hierarchies. A hierarchy is a mathematically partial order defining a senior relation between roles. The NIST model has two sub levels, general and restricted hierarchical RBAC. General hierarchical RBAC is support for an arbitrary partial order to serve as the role hierarchy. Restricted hierarchical RBAC are limited to simple structures such as trees or inverted trees. There are also some functional capabilities below that describe hierarchical RBAC: Flat RBAC+ Must support role hierarchy (partial order) Level 2a requires support for arbitrary hierarchies (General Hierarchy) Level 2b denotes support for limited hierarchies (Restricted Hierarchy)

CONSTRAINED RBAC
Constrained RBAC adds yet another requirement for enforcing separation of duties (SOD). It is a time-honored technique for reducing the possibility of fraud and accidental damage. The SOD spreads responsibility and authority for an action or task over multiple users raising the risk for causing a fraudulent act. Functional capabilities are: Hierarchical RBAC+ Must enforce separation of duties (SOD) Level 3a requires support for arbitrary hierarchies Level 3b denotes support for limited hierarchies

SYMMETRIC RBAC
The final level of the NIST RBAC model is the symmetric RBAC. This level adds a requirement for permission-role reviews that is similar to user-role review introduced in level one. The roles to which a particular permission is assigned can be determined as well as permissions assigned to a specific role. The functional capabilities are: Constrained RBAC+ Must support permission-role review with performance effectively comparable to user-role review Level 4a requires support for arbitrary hierarchies Level 4b denotes support for limited hierarchies

CONCLUSION
In conclusion, the motivation for RBAC is to simplify the process by becoming a flexible and customized policy. RBAC is now starting to be expected with large users and the amounts of vendors are growing at a rapid pace. Even though the RBAC model is considered a single access control model, the NIST RBAC model has been organized into four separate levels of increasing functional capabilities. Each has specific rules that make them stand out from the others. All this together creates the NIST RBAC model that we know today.

Computer Security Threat Monitoring & Surveillance

INTRODUCTION
The introduction of this article is to discuss ways to improve the computer security auditing surveillance capabilities of end user systems. Since this article is so detailed I will only take from it what I thought were important points of the article.

4 Florida State University iSchool

Article Review

INTERNAL PENETRATION
With many computers out there in the world there are threats that harm the existence of all computers as a whole from outside attacks. Many do not realize that there are also just as many internal penetrations that get overlooked at while focusing on the outside and not looking in. Within the ranks of internal penetrations, there are classes of users that stand out more than others and those are the masquerader, the legitimate user, and the clandestine user. The masquerader is an internal user by definition from anywhere. He/she can be any type of individual, either an external penetrator who has success in penetrating the system or employee without full access to a computer system, or even an employee who has full access to the computer who wants to cause harm to passwords or files. While masqueraders can be anyone, there really isnt any correct way to identify a ma squerader from a legitimate user. A masquerader is technically legitimate user because of the credentials that they have are valid as far as a user name and password. Next is the legitimate user, who may appear pure by means of access to an account, may be using their access to harm both the system and its data. Since the user is authorized to use the account, trail records would not show any signs misuse or abuse. If this user misuses its authority slightly like printing drift photos or a form for school then detecting them will become even more difficult if they were to print off records or data that may be private that makes it hard to distinguish what is misuse and what is an intrusion. Lastly is the clandestine use, which is possibly the most difficult to detect by normal audit trail methods. Clandestine user can seize supervisory control of the machine and evade the audit trail all together. The clandestine user is the user that isnt there but is. There isnt anything that can be done to detect this ty pe of user unless they get careless and activates it clandestine operations in a masquerade or misfeasance of a legitimate user that may create individual records that show up under the categories that they used.

CONCLUSION
In conclusion, security monitoring and surveillance is very important skill set that any information security specialist should know. Trying to detect threats from outside intrusions can be found with the right skills, while looking into internal intrusions from users with authorized accounts takes more time and sometimes are difficult to acquire. The skills that are needed to carefully filter out these threats takes years to acquire and a keen eye for anyone trying to gain access to a computer. Within the next couple of years, I hope to be able to add my skills to the security world and help keep our computers safe from all types of threats.

PAPER CONCLUSION
To conclude, this paper was to give you an overview of the articles that I read this semester for this class and how they may pertain to information security as a whole. The first review was of the RBAC model and the simple structuring of that model within the use of information security. Next was the review on the intrusiondetection model and how that model helps identify intruders that may potentially misuse a system. I then revisited the RBAC model but added a new layer to the model which was the NIST RBAC. The differences between the two were that the NIST RBAC has characterized into four layers that increased in capabilities from each layer to the next. Lastly, the monitoring and surveillance of computer security was a guideline to the different types of threats that occur in computer security and how to properly detect these threats. All these articles shared an overall view of the importance of information security and I hope that someday I will be able to apply some of the topics discussed in this paper with a potential job that I would acquire.

Florida State University iSchool 5