Putting the Biba-LaPadula Mandatory Access Control Methods to Practise?

Question

Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective.

Text books tend to recommend that a combination of these methods be used to meet these security objectives of a DBS - but they often only touch the surface.

Marcin states that, the 'strong *-property', disallowing reading or writing from any other level but your own, is an idea introduced to battle the problem inherent to Biba-LaPadula: no state.

He also goes on to say that the Biba-LaPadulla is really only taught to security students as the first and simplest security model, it's really a toy, an educational construct.

So then, to what extent does the security methodology here apply to DBAs, how might they put it to practise, and just what is the consensus on handling Mandatory Access Control in a DBS?

Answer 1

I tend not to pay much attention to textbooks that recommend Bell-Lapadula or Biba multi-level security. Those schemes are impractical for most real-world settings. They make some beautiful theory, but they have not worked out well for general-purpose computing in practice.

Bell-Lapadula and Biba models have several major problems. Here are two of them:

• They get in the way of useful work. The combination of Bell-Lapadula and Biba is the worst; it prohibits writing up or down, and prohibits reading up or down. Thus, it basically corresponds to creating multiple databases, segregating your data, and prohibiting any application from accessing more than one database. That's horribly unrealistic and rules out its use in most real systems.

• They don't provide the security they claim. In practice, such systems always have covert channels that can be used to subvert the security "guarantees" that are supposed to be provided by a multi-level security system.

See the chapter on Multilevel Security in Ross Anderson's Security Engineering book for a lot more discussion on these practical problems, and some hard-earned experience. Ross has put this chapter from the first edition of the book online, so you can check it out. If you find it useful, buy the latest copy of his book; the second edition adds a lot of useful information, and the book is simply brilliant, perhaps the most insightful book on computer security I've ever read.

Bottom line: Bell-Lapadula and Biba aren't very practical, so you can safely ignore them for most settings.