[[!meta copyright="Copyright © 2007, 2008, 2010 Free Software Foundation, Inc."]] [[!meta license="""[[!toggle id="license" text="GFDL 1.2+"]][[!toggleable id="license" text="Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled [[GNU Free Documentation License|/fdl]]."]]"""]] Alan Karp [identifies][1] 11 security questions: [1]: http://www.eros-os.org/pipermail/cap-talk/2007-December/009460.html * Authentication Who am I talking to? * Authorization What should I be able to do? * Audit Who did that? * Access control Should this request be honored? * Non-repudiation Can I pretend I never said that? * Confidentiality Can others see what I'm seeing? * Privacy Can others see that I'm seeing it? * Integrity Can this data be changed? * Anonymity Can others find out who I am? * Denial of service Can I be assured of access? * Physical security Who can touch it? Mark Miller [proposes][2] some ways to think about security relationships: [2]: http://www.eros-os.org/pipermail/cap-talk/2008-March/010615.html A way to talk about security relationships Permissions channels (necessarily overt in a sensible system) are phisical: * Alice gives Bob a car or a car key. Online overt information channels are visual: * Bob can see Carol. Bob can see Carol's car. * (Potential, transitive) overt connectivity is line of sight. * Lack of overt connectivity (including revocation) is occlusion. * Alice tells the Caretaker to turn opaque, blocking Bob's view of Carol. Offline overt channels are visual but indirect: * Bob can see that Kilroy was here. Online non-overt channels (both covert & side) are auditory: * Bob can hear Carol (e.g., hear Carol banging on the wall) * Alice tries to silence (or mute) Carol * Alice deafens Bob (or creates a deaf Bob) * In order for Bob to hear Carol's wall banging, Bob and Carol, must be awake at the same time Offline non-overt channels are olfactory: * Bob can smell that Kilroy was here, even if Kilroy is asleep or dead. --- [[Open Issues related to security|open_issues/security]].