Return to Answer

This "question" is biased because there is no definitive answer to this. The term "Open PC" is confusing: There's not such thing like "Open PC model" within the area of architecture/security models.

From an IT Security/Administrator perspective that is obviously the worst thing to allow. One of the first rule of security is to perform an audit on the different roles within the organisation, define levels of permissions/access to the corporate assets & applications using the least privilege principle. Those policies would be enforced by system level mechanisms.

Roles and permission must be rewied on a regular basis. A software & hardware inventory must be managed.

• Access Control model(s) to implement (MAC, RBAC, etc...)
• Plaftform type (purpose built "appliances", dumb terminal, full PC,...)
• OS architectures & limitations (Permission management, sandboxing, trust model...)
• Software distribution (In house, SaaS, Classic vendor channel, "app-store"...)
• Information System management

In order to define what should be an alternative to the so-called "open PC" security model, this term must be defined. The described "Open PC" security model is in fact a use case where security is unmanaged. Computer systems roughly fall into the following categories:

• A PC (Personal computer) is intended to be operated by its end-user. Strictly speaking, PC is a general-purpose computer for home use.
• A workstation is a computer used in the corporate/professional environment
• A terminal (usually dumb) is a purpose-built system that expose a constrained user interface to perform specific tasks (Cash register, ATM, Thin client...)
• An appliance is a "turn-key" system made of tailored harwdware and/or software and is not intended for end-users. Usually an appliance is used in a networked environment for specific purpose (Security, storage, etc...)
• A server is a system that typically responds to client request in a networking environmnent (the client/server model can also apply within the OS as a type of communication framework between components). Clients can either be terminals, PCs, Workstations, appliances, application processes...

Security models are well defined within the infosec literature and are abstract models intended to help developing security policies, systems & softwares, as well as managing information flow within an organisation. Security and access control models are mainly high-level. See: https://en.wikipedia.org/wiki/Computer_security_model.

Trying to define new security paradigms as alternatives to particular uses cases is a dead-end. Nevertheless one could argue that the question here is likely more about software provisioning (which refers to the process of assessment, delivery and monitoring of software) and access control implementation.

Software provisioning models mostly depends on:

1. Computer system category where the sofware will reside
2. Operating systems features
3. Vendor business model
4. Environment where it is deployed

Access control model implementation depends on:

1. Operating systems features
2. Compliance to standards & interoperability
3. Environment where it is deployed
4. Level of risk acceptance regarding data security (balance between security controls implementation in order to protect assets & costs)

This "question" is biased because there may not be a definitive answer. The term "Open PC" is equivocal: There's no "Open PC" model within the area of computer architecture/security models.

From an IT security and system administrator perspective, giving full administrative rights to a user is not acceptable. A "best practice" is to audit the different roles within the organisation and map their levels of permissions/access accordingly. The least privilege principle must apply when it comes to user permissions. Such policies need to be enforced at system level and a network level. Roles and permissions tied to systems & applications must be reviewed on a regular basis. A software & hardware inventory must be managed.

• Access Control model(s) to implement (MAC, DAC, RBAC, etc...)
• Plaftform type (PC, dumb terminal, appliance, server...)
• OS architectures & limitations (Permission management, sandboxing mechanisms, trust model for software...)
• Software distribution (in-house, SaaS, Classic vendor channel, "app-store", distributed repositories...)
• Information System management (Policies, technical controls, audit, monitoring...)

In order to define what should be an alternative to the so-called "open PC" security model, the former must be defined: The mentionned "Open PC" security model appears to be a use case where security of the platform is completely unmanaged. This use case cannot be defined as a "model".

Platform types fall into the following categories:

• A Personal computer (PC) is intended to be operated by its end-user. Strictly speaking, PC is a general-purpose computer for home use.
• A workstation is a computer in the corporate/professional environment (single-user or multidesk).
• A terminal (usually dumb) is a purpose-built system that expose a constrained user interface to perform specific tasks only (Cash register, ATM, Thin client...).
• An appliance is a "turn-key" system made of tailored hardware and/or software. It is not intended for end-users. Usually an appliance is used in a networked environment for specific purpose (security, storage, ...)
• A server is a system that responds to client requests in a networking environment (client/server model is also used as a communication framework between components, applications and processes). Clients can either be PCs, Workstations, terminals, appliances, application processes, other servers...

Security models are abstract models intended to help developing security policies, systems & softwares, as well as managing information flow within an organisation. Security and access control models are mainly high-level. They are well defined within the official infosec literature.

Trying to define new security paradigm as alternative to particular use case is a dead-end. Nevertheless the question is likely more about software provisioning and access control implementation within computer systems.

Software provisioning model depends on:

1. Computer system category/platform type
2. Operating system features
3. Environment (single-user, multidesk, distributed, networked...)
4. Vendor business model

Access control model implementation depends on:

1. Risk acceptance regarding the data to be protected. A cost/benefit analysis must be performed to keep the balance between security & cost of security). Note that cost might be either money, time, expertise...
2. Environment (single-user, multidesk, distributed, networked...)
3. Operating systems features available to enforce the security controls
4. Governance model (User-driven,role-based,organisation policy based, outsourced...)

This "question" is biased because there is no definitive answer to this. The term "Open PC" is confusing: There's not such thing like "Open PC model" within the area of architecture/security models.

Users have full, system administrator/developer-level access to their own machine

From an IT Security/Administrator perspective that is obviously the worst thing to allow. One of the first rule of security is to perform an audit on the different roles within the organisation, define levels of permissions/access to the corporate assets & applications using the least privilege principle. Roles and permission must be rewied on a regular basis. Administrator accounts must be limited and strictly monitored.

The topic is broad, different aspects might be discussed:

• Access Control model(s) to implement (MAC, RBAC, etc...)
• Plaftform type (purpose built "appliances", dumb terminal, full PC,...)
• OS architectures & limitations (Permission management, sandboxing, trust model...)
• Software distribution (In house, SaaS, Classic vendor channel, "app-store"...)
• Information System management

This "question" is biased because there is no definitive answer to this. The term "Open PC" is confusing: There's not such thing like "Open PC model" within the area of architecture/security models.

Users have full, system administrator/developer-level access to their own machine

From an IT Security/Administrator perspective that is obviously the worst thing to allow. One of the first rule of security is to perform an audit on the different roles within the organisation, define levels of permissions/access to the corporate assets & applications using the least privilege principle. Those policies would be enforced by system level mechanisms.

Roles and permission must be rewied on a regular basis. A software & hardware inventory must be managed.

The topic is broad, different aspects might be discussed:

• Access Control model(s) to implement (MAC, RBAC, etc...)
• Plaftform type (purpose built "appliances", dumb terminal, full PC,...)
• OS architectures & limitations (Permission management, sandboxing, trust model...)
• Software distribution (In house, SaaS, Classic vendor channel, "app-store"...)
• Information System management

In order to define what should be an alternative to the so-called "open PC" security model, this term must be defined. The described "Open PC" security model is in fact a use case where security is unmanaged. Computer systems roughly fall into the following categories:

• A PC (Personal computer) is intended to be operated by its end-user. Strictly speaking, PC is a general-purpose computer for home use.
• A workstation is a computer used in the corporate/professional environment
• A terminal (usually dumb) is a purpose-built system that expose a constrained user interface to perform specific tasks (Cash register, ATM, Thin client...)
• An appliance is a "turn-key" system made of tailored harwdware and/or software and is not intended for end-users. Usually an appliance is used in a networked environment for specific purpose (Security, storage, etc...)
• A server is a system that typically responds to client request in a networking environmnent (the client/server model can also apply within the OS as a type of communication framework between components). Clients can either be terminals, PCs, Workstations, appliances, application processes...

Security models are well defined within the infosec literature and are abstract models intended to help developing security policies, systems & softwares, as well as managing information flow within an organisation. Security and access control models are mainly high-level. See: https://en.wikipedia.org/wiki/Computer_security_model.

Trying to define new security paradigms as alternatives to particular uses cases is a dead-end. Nevertheless one could argue that the question here is likely more about software provisioning (which refers to the process of assessment, delivery and monitoring of software) and access control implementation.

Software provisioning models mostly depends on:

1. Computer system category where the sofware will reside
2. Operating systems features
3. Vendor business model
4. Environment where it is deployed

Access control model implementation depends on:

1. Operating systems features
2. Compliance to standards & interoperability
3. Environment where it is deployed
4. Level of risk acceptance regarding data security (balance between security controls implementation in order to protect assets & costs)

This "question" is biased because there is no definitive answer to this. The term "Open PC" is confusing: There's not such thing like "Open PC model" within the area of architecture/security models.

Users have full, system administrator/developer-level access to their own machine

From an IT Security/Administrator perspective that is obviously the worst thing to allow. One of the first rule of security is to perform an audit on the different roles within the organisation, define levels of permissions/access to the corporate assets & applications using the least privilege principle. Roles and permission must be rewied on a regular basis. Administrator accounts must be limited and strictly monitored.

The topic is broad, different aspects might be discussed:

• Access Control model(s) to implement (MAC, RBAC, etc...)
• Plaftform type (purpose built "appliances", dumb terminal, full PC,...)
• OS architectures & limitations (Permission management, sandboxing, trust model...) Software distribution (In house, SaaS, Classic vendor channel, "app-store"...)
• Information System management

This "question" is biased because there is no definitive answer to this. The term "Open PC" is confusing: There's not such thing like "Open PC model" within the area of architecture/security models.

Users have full, system administrator/developer-level access to their own machine

From an IT Security/Administrator perspective that is obviously the worst thing to allow. One of the first rule of security is to perform an audit on the different roles within the organisation, define levels of permissions/access to the corporate assets & applications using the least privilege principle. Roles and permission must be rewied on a regular basis. Administrator accounts must be limited and strictly monitored.

The topic is broad, different aspects might be discussed:

• Access Control model(s) to implement (MAC, RBAC, etc...)
• Plaftform type (purpose built "appliances", dumb terminal, full PC,...)
• OS architectures & limitations (Permission management, sandboxing, trust model...)
• Software distribution (In house, SaaS, Classic vendor channel, "app-store"...)
• Information System management