Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective.

Text books tend to recommend that a combination of these methods be used to meet these security objectives of a DBS - but they often only touch the surface.

Marcin states that, the 'strong *-property', disallowing reading or writing from any other level but your own, is an idea introduced to battle the problem inherent to Biba-LaPadula: no state.

He also goes on to say that the Biba-LaPadulla is really only taught to security students as the first and simplest security model, it's really a toy, an educational construct.

So then, to what extent does the security methodology here apply to DBAs, how might they put it to practise, and just what is the consensus on handling Mandatory Access Control in a DBS?

share|improve this question

migrated from dba.stackexchange.com May 10 '12 at 12:09

This question came from our site for database professionals who wish to improve their database skills and learn from others in the community.

    
related question here - also migrated from dba.se –  Jack Douglas May 10 '12 at 12:10

1 Answer 1

up vote 4 down vote accepted

I tend not to pay much attention to textbooks that recommend Bell-Lapadula or Biba multi-level security. Those schemes are impractical for most real-world settings. They make some beautiful theory, but they have not worked out well for general-purpose computing in practice.

Bell-Lapadula and Biba models have several major problems. Here are two of them:

  • They get in the way of useful work. The combination of Bell-Lapadula and Biba is the worst; it prohibits writing up or down, and prohibits reading up or down. Thus, it basically corresponds to creating multiple databases, segregating your data, and prohibiting any application from accessing more than one database. That's horribly unrealistic and rules out its use in most real systems.

  • They don't provide the security they claim. In practice, such systems always have covert channels that can be used to subvert the security "guarantees" that are supposed to be provided by a multi-level security system.

See the chapter on Multilevel Security in Ross Anderson's Security Engineering book for a lot more discussion on these practical problems, and some hard-earned experience. Ross has put this chapter from the first edition of the book online, so you can check it out. If you find it useful, buy the latest copy of his book; the second edition adds a lot of useful information, and the book is simply brilliant, perhaps the most insightful book on computer security I've ever read.

Bottom line: Bell-Lapadula and Biba aren't very practical, so you can safely ignore them for most settings.

share|improve this answer
2  
Windows Vista/7's security model is based on Biba, but instead of "read up, write down" it's more "read down, write down" (and is discussed in the second edition of that chapter). Ignore seems a bit harsh. –  pdubs May 10 '12 at 18:57
3  
I don't think it's too harsh. I'd even go as far as saying you can ignore Mandatory Access Control altogether for most practical implementations. Unless you work in some secret-service highly-classified organization. Even in those I doubt those models are put to any practical use as is (although I have no experience working in such organizations). –  Yoav Aner May 10 '12 at 20:23
    
Although against guidelines, I will say thanks for the insightful response and the interesting comments guys. It's as much as I had suspected, and I will be checking out that book. :) –  defaye May 10 '12 at 21:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.