1 evaluating systems csse 490 computer security mark ardis, rose-hulman institute may 6, 2004
Post on 18-Dec-2015
218 views
TRANSCRIPT
11
Evaluating SystemsEvaluating SystemsCSSE 490 Computer SecurityCSSE 490 Computer Security
Mark Ardis, Rose-Hulman InstituteMark Ardis, Rose-Hulman Institute
May 6, 2004May 6, 2004
22
AcknowledgementsAcknowledgements
Many of these slides came from Many of these slides came from Chris Clifton and Matt Bishop, Chris Clifton and Matt Bishop, author of author of Computer Security: Art Computer Security: Art and Scienceand Science
33
What is Formal What is Formal Evaluation?Evaluation?
Method to achieve Method to achieve TrustTrust– Not a guarantee of securityNot a guarantee of security
Evaluation methodology includes:Evaluation methodology includes:– Security requirementsSecurity requirements– Assurance requirements showing how to establish Assurance requirements showing how to establish
that security requirements are metthat security requirements are met– Procedures to demonstrate that system meets Procedures to demonstrate that system meets
requirementsrequirements– Metrics for results (level of trust)Metrics for results (level of trust)
Examples: TCSEC (Orange Book), ITSEC, CCExamples: TCSEC (Orange Book), ITSEC, CC
44
Formal Evaluation: Formal Evaluation: Why?Why? Organizations require assuranceOrganizations require assurance
– DefenseDefense– Telephone / UtilitiesTelephone / Utilities– ““Mission Critical” systemsMission Critical” systems
Formal verification of entire systems not Formal verification of entire systems not feasiblefeasible
Instead, organizations develop formal Instead, organizations develop formal evaluation methodologiesevaluation methodologies– Products passing evaluation are trustedProducts passing evaluation are trusted– Required to do business with the organizationRequired to do business with the organization
55
TCSEC: The OriginalTCSEC: The Original
Trusted Computer System Evaluation CriteriaTrusted Computer System Evaluation Criteria– U.S. Government security evaluation criteriaU.S. Government security evaluation criteria– Used for evaluating commercial productsUsed for evaluating commercial products
Policy model based on Bell-LaPadulaPolicy model based on Bell-LaPadula Enforcement: Reference Validation Enforcement: Reference Validation
MechanismMechanism– Every reference checked by compact, Every reference checked by compact,
analyzable body of codeanalyzable body of code Emphasis on ConfidentialityEmphasis on Confidentiality Metric: Seven trust levels:Metric: Seven trust levels:
– D, C1, C2, B1, B2, B3, A1D, C1, C2, B1, B2, B3, A1– D is “tried but failed”D is “tried but failed”
66
TCSEC Class TCSEC Class AssurancesAssurances C1: Discretionary ProtectionC1: Discretionary Protection
– IdentificationIdentification– AuthenticationAuthentication– Discretionary access controlDiscretionary access control
C2: Controlled Access ProtectionC2: Controlled Access Protection– Object reuse and auditingObject reuse and auditing– Most common for commercial systemsMost common for commercial systems
B1: Labeled security protectionB1: Labeled security protection– Mandatory access control on limited set of objectsMandatory access control on limited set of objects– Informal model of the security policyInformal model of the security policy
77
TCSEC Class AssurancesTCSEC Class Assurances(continued)(continued) B2: Structured ProtectionsB2: Structured Protections
– Mandatory access control for all objectsMandatory access control for all objects– Trusted path for loginTrusted path for login– Principle of Least PrivilegePrinciple of Least Privilege– Formal model of Security PolicyFormal model of Security Policy– Covert channel analysisCovert channel analysis– Configuration managementConfiguration management
B3: Security DomainsB3: Security Domains– Full reference validation mechanismFull reference validation mechanism– Constraints on code development processConstraints on code development process– Documentation, testing requirementsDocumentation, testing requirements
A1: Verified ProtectionA1: Verified Protection– Formal methods for analysis, verificationFormal methods for analysis, verification– Trusted distributionTrusted distribution
88
How is Evaluation How is Evaluation Done?Done? Government-sponsored Government-sponsored
independent evaluatorsindependent evaluators– Application: Determine if government Application: Determine if government
carescares– Preliminary Technical ReviewPreliminary Technical Review
Discussion of process, schedulesDiscussion of process, schedules Development ProcessDevelopment Process Technical Content, RequirementsTechnical Content, Requirements
– Evaluation PhaseEvaluation Phase
99
TCSEC:TCSEC:Evaluation PhaseEvaluation Phase Three phasesThree phases
– Design analysisDesign analysis Review of design based on documentationReview of design based on documentation
– Test analysisTest analysis– Final ReviewFinal Review
Trained independent evaluationTrained independent evaluation– Results presented to Technical Review BoardResults presented to Technical Review Board– Must approve before next phase startsMust approve before next phase starts
Ratings Maintenance ProgramRatings Maintenance Program– Determines when updates trigger new Determines when updates trigger new
evaluationevaluation
1010
TCSEC: ProblemsTCSEC: Problems
Based heavily on confidentialityBased heavily on confidentiality– Did not address integrity, availabilityDid not address integrity, availability
Base TCSEC geared to operating Base TCSEC geared to operating systemssystems– TNI: Trusted Network InterpretationTNI: Trusted Network Interpretation– TDI: Trusted Database management TDI: Trusted Database management
System InterpretationSystem Interpretation
1111
Later StandardsLater Standards
CTCPEC – CanadaCTCPEC – Canada ITSEC – European StandardITSEC – European Standard
– Did not define criteriaDid not define criteria– Levels correspond to strength of evaluationLevels correspond to strength of evaluation– Includes code evaluation, development methodology Includes code evaluation, development methodology
requirementsrequirements– Known vulnerability analysisKnown vulnerability analysis
CISR: Commercial outgrowth of TCSECCISR: Commercial outgrowth of TCSEC FC: Modernization of TCSECFC: Modernization of TCSEC FIPS 140: Cryptographic module validationFIPS 140: Cryptographic module validation Common Criteria: International StandardCommon Criteria: International Standard SSE-CMM: Evaluates developer, not productSSE-CMM: Evaluates developer, not product
1212
ITSEC: LevelsITSEC: Levels
E1: Security target defined, testedE1: Security target defined, tested– Must have informal architecture descriptionMust have informal architecture description
E2: Informal description of designE2: Informal description of design– Configuration control, distribution controlConfiguration control, distribution control
E3: Correspondence between code and security E3: Correspondence between code and security targettarget
E4: Formal model of security policyE4: Formal model of security policy– Structured approach to designStructured approach to design– Design level vulnerability analysisDesign level vulnerability analysis
E5: Correspondence between design and codeE5: Correspondence between design and code– Source code vulnerability analysisSource code vulnerability analysis
E6: Formal methods for architectureE6: Formal methods for architecture– Formal mapping of design to security policyFormal mapping of design to security policy– Mapping of executable to source codeMapping of executable to source code
1313
ITSEC Problems:ITSEC Problems:
No validation that security No validation that security requirements made senserequirements made sense– Product meets goalsProduct meets goals– But does this meet user But does this meet user
expectations?expectations? Inconsistency in evaluationsInconsistency in evaluations
– Not as formally defined as TCSECNot as formally defined as TCSEC
1414
Replaced TCSEC, ITSECReplaced TCSEC, ITSEC
1.1. CC DocumentsCC Documents– Functional requirementsFunctional requirements– Assurance requirementsAssurance requirements– Evaluation Assurance Levels (EAL)Evaluation Assurance Levels (EAL)
2.2. CC Evaluation MethodologyCC Evaluation Methodology– Detailed evaluation guidelines for each EALDetailed evaluation guidelines for each EAL
3.3. National Scheme (Country specific)National Scheme (Country specific)
1616
Some AbbreviationsSome Abbreviations
CC: Common CriteriaCC: Common Criteria PP: Protection ProfilePP: Protection Profile ST: Security TargetST: Security Target TOE: Target of EvaluationTOE: Target of Evaluation TSF: TOE Security FunctionTSF: TOE Security Function TSP: TOE Security PolicyTSP: TOE Security Policy
1717
CC Evaluation 1:CC Evaluation 1:Protection Protection ProfileProfile
Implementation Implementation independent, domain-independent, domain-specific set of security specific set of security requirementsrequirements
Narrative OverviewNarrative Overview Product/System Product/System
descriptiondescription Security Environment Security Environment
(threats, overall policies)(threats, overall policies) Security Objectives: Security Objectives:
System, EnvironmentSystem, Environment IT Security RequirementsIT Security Requirements
– Functional requirements Functional requirements drawn from CC setdrawn from CC set
– Assurance levelAssurance level Rationale for objectives Rationale for objectives
and requirementsand requirements
1818
CC Evaluation CC Evaluation 2:2:Security Security TargetTarget
Specific Specific requirements used requirements used to evaluate systemto evaluate system
Narrative Narrative introductionintroduction
EnvironmentEnvironment Security ObjectivesSecurity Objectives
– How metHow met Security Security
RequirementsRequirements– Environment and Environment and
systemsystem– Drawn from CC setDrawn from CC set
Mapping of Function Mapping of Function to Requirementsto Requirements
Claims of Claims of Conformance to Conformance to Protection ProfileProtection Profile
1919
Common Criteria:Common Criteria:Functional RequirementsFunctional Requirements
362 page document362 page document 11 Classes11 Classes
– Security Audit, Communication, Security Audit, Communication, Cryptography, User data protection, Cryptography, User data protection, ID/authentication, Security ID/authentication, Security Management, Privacy, Protection of Management, Privacy, Protection of Security Functions, Resource Utilization, Security Functions, Resource Utilization, Access, Trusted pathsAccess, Trusted paths
Several families per classSeveral families per class Lattice of components in a familyLattice of components in a family
2020
Class Example:Class Example:CommunicationCommunication
Non-repudiation of originNon-repudiation of origin1.1. Selective Proof. Capability to request Selective Proof. Capability to request
verification of originverification of origin
2.2. Enforced Proof. All communication Enforced Proof. All communication includes verifiable originincludes verifiable origin
2121
Class Example: PrivacyClass Example: Privacy
1.1. PseudonymityPseudonymity1.1. The TSF shall ensure that The TSF shall ensure that
[assignment: [assignment: set of users set of users and/or subjectsand/or subjects] are unable to ] are unable to determine the real user name determine the real user name bound to [assignment: bound to [assignment: list of list of subjects and/or operations subjects and/or operations and/or objectsand/or objects]]
2.2. The TSF shall be able to provide The TSF shall be able to provide [assignment: [assignment: number of number of aliasesaliases] aliases of the real user ] aliases of the real user name to [assignment: name to [assignment: list of list of subjectssubjects]]
3.3. The TSF shall [selection: The TSF shall [selection: determine an alias for a user, determine an alias for a user, accept the alias from the useraccept the alias from the user] ] and verify that it conforms to and verify that it conforms to the [assignment: the [assignment: alias metricalias metric]]
2.2. Reversible PseudonimityReversible Pseudonimity1.1. ……
3.3. Alias PseudonimityAlias Pseudonimity1.1. ……
2222
Common Criteria:Common Criteria:Assurance RequirementsAssurance Requirements
216 page document216 page document 10 Classes10 Classes
– Protection Profile Evaluation, Security Target Protection Profile Evaluation, Security Target EvaluationEvaluation
– Configuration management, Delivery and Configuration management, Delivery and operation, Development, Guidance, Life operation, Development, Guidance, Life cycle, Tests, Vulnerability assessmentcycle, Tests, Vulnerability assessment
– MaintenanceMaintenance Several families per classSeveral families per class Lattice of components in familyLattice of components in family
2323
Example:Example:Protection Profile Protection Profile EvaluationEvaluation
Security environment Security environment In order to determine whether the In order to determine whether the
IT security requirements in the PP IT security requirements in the PP are sufficient, it is important that are sufficient, it is important that the security problem to be solved is the security problem to be solved is clearly understood by all parties to clearly understood by all parties to the evaluation.the evaluation.
1.1. Protection Profile, Security Protection Profile, Security environment, Evaluation environment, Evaluation requirementsrequirements– Dependencies: No Dependencies: No
dependencies.dependencies.– Developer action elements:Developer action elements:
The PP developer shall provide a The PP developer shall provide a statement of TOE security statement of TOE security environment as part of the PP.environment as part of the PP.– Content and presentation of Content and presentation of
evidence elements:...evidence elements:...
2424
Example:Example:Delivery and OperationDelivery and Operation
Installation, generation and start-upInstallation, generation and start-upA.A. Installation, generation, and start-up proceduresInstallation, generation, and start-up procedures
– Dependencies: AGD_ADM.1 Administrator guidanceDependencies: AGD_ADM.1 Administrator guidanceB.B. Developer action elements:Developer action elements:
– The developer shall document procedures necessary for the secure The developer shall document procedures necessary for the secure installation, generation, and start-up of the TOE.installation, generation, and start-up of the TOE.
C.C. Content and presentation of evidence elements:Content and presentation of evidence elements:– The documentation shall describe the steps necessary for secure The documentation shall describe the steps necessary for secure
installation, generation, and start-up of the TOE.installation, generation, and start-up of the TOE.D.D. ……....
2525
Common Criteria:Common Criteria:Evaluation Assurance Evaluation Assurance LevelsLevels
1.1. Functionally testedFunctionally tested2.2. Structurally tested (TCSEC C1)Structurally tested (TCSEC C1)3.3. Methodically tested and checked (C2)Methodically tested and checked (C2)4.4. Methodically designed, tested, and reviewed Methodically designed, tested, and reviewed
(B1)(B1)5.5. Semi-formally designed and tested (B2)Semi-formally designed and tested (B2)6.6. Semi-formally verified design and tested (B3)Semi-formally verified design and tested (B3)7.7. Formally verified design and tested (A1)Formally verified design and tested (A1)
2626
Common Criteria:Common Criteria:Evaluation ProcessEvaluation Process
National Authority authorizes National Authority authorizes evaluatorsevaluators– U.S.: NIST accredits commercial U.S.: NIST accredits commercial
organizationsorganizations– Fee charged for evaluationFee charged for evaluation
Team of four to six evaluatorsTeam of four to six evaluators– Develop work plan and clear with NISTDevelop work plan and clear with NIST– Evaluate Protection Profile firstEvaluate Protection Profile first– If successful, can evaluate Security TargetIf successful, can evaluate Security Target
2727
Common Criteria:Common Criteria:StatusStatus
About 80 registered productsAbout 80 registered products– Only one at level 5Only one at level 5
(Java Smart Card)(Java Smart Card)– Several OS at 4Several OS at 4– Likely many more not registeredLikely many more not registered
New versions appearing on New versions appearing on regular basisregular basis