Computer security policy
1000175
222973182
2008-07-02T00:02:12Z
Sleepinj
6207224
/* Formal description */
A '''computer security policy''' defines the goals and elements of an organization's computer systems. The definition can be highly formal or informal. Security policies are enforced by organizational policies or security mechanisms. A technical implementation defines whether a computer system is ''secure'' or ''unsecure''. These formal policy models can be categorized into the core security principles of: Confidentiality, Integrity and Availability. For example the [[Bell-LaPadula_model|Bell LaPadula model]] is a ''confidentiality policy model'', whereas [[Biba_model|Biba model]] is an ''integrity policy model''.
== Formal description ==
If a system is regarded as a [[Finite_state_automaton|finite-state automaton]] with a set of transitions (operations) that change the system's state, then a ''security policy'' can be seen as a statement that partitions these states into authorized and unauthorized ones.
Given this simple definition one can define a ''secure system'' as one that starts in an authorized state and will never enter an unauthorized state.
== Formal Policy Models ==
=== Confidentiality Policy Model===
* [[Bell-LaPadula_model|Bell LaPadula model]]
=== Integrity Policies Model===
* [[Biba_model|Biba model]]
* [[Clark-Wilson_model|Clark-Wilson model]]
=== Hybrid Policy Model===
* [[Chinese_wall#Computer_science|Chinese Wall]]
== Policy languages ==
To represent a concrete policy especially for automated enforcement of it, a language representation is needed. There exist a lot of application specific languages that are closely coupled with the security mechanisms that enforce the policy in that application.
Compared with this abstract policy languages, e.g. the [[Type_enforcement|Domain Type Enforcement]]-Language, are independent of the concrete mechanism.
== See also ==
* [[CIA triad |Information Assurance - CIA Triad]]
*[[Protection mechanisms]]
*[[separation of protection and security]]
== References ==
* {{cite book
| last = Bishop | first = Matt
| title = Computer security: art and science
| publisher = Addison-Wesley
| year = 2004
}}
[[Category:Computer security procedures]]
[[Category:Computer security models]]
[[eo:Komputika Sekureca Politiko]]
[[fr:Politique de sécurité informatique]]
* {{cite encyclopedia
| last = McLean
| first = John
| title = Security Models
| encyclopedia = Encyclopedia of Software Engineering
| volume = 2
| pages = 1136–1145
| publisher = John Wiley & Sons, Inc
| location = New York
| date = 1994 }}