Management of Information Security, Fourth Edition 6-1
Chapter 6
Security Management Models
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
Management of Information Security, Fourth Edition 6-2
Lecture Notes
Overview
This chapter educates students on the use of security management models and access
control models. Students will learn about the use of security architecture models, as well as
Chapter Objectives
After reading this chapter and completing the exercises, the student will be able to:
• Describe the dominant InfoSec blueprints, frameworks, and InfoSec management
models, including U.S government-sanctioned models
Teaching Tips
Introduction
1. Explain that many InfoSec models and standards exist, and note that a methodology can
be selected by adopting existing security management models or practices.
Blueprints, Frameworks, and Security Models
1. Explain that the communities of interest accountable for the security of an
organization’s information assets must design a working security plan and then
implement a management model to execute and maintain that plan.
Access Control Models
Management of Information Security, Fourth Edition 6-3
1. Discuss how access controls regulate how users can make use of resources, and
describe the four process of access control:
2. Teach students about the different key principles upon which access control is built:
a. Least privilege, provide users with the minimum amount of access necessary
b. Need-to-know, limit users to only information needed to perform their work
Categories of Access Control
1. Educate students on the different characteristics of access control:
a. Deterrent
b. Preventative
2. Show students how to categorize controls based on their operational impact:
a. Management
3. Explain the approach to categorizing access control methods by the authority under
which the controls are applied.
5. Discuss the five-level classification scheme used by the U.S. military:
a. Unclassified data
b. Sensitive but unclassified (SBU) data
6. Point out the additional classification schemes used by the FBI and CIA, such as
“Need–to–Know” and “Named Projects”. Note that use of special classification schemes
Teaching
In any type of information security environment, users should only be given the
Management of Information Security, Fourth Edition 6-4
d. Classified
8. Describe how security clearance structures are used, in which a user is granted
authorization for specific levels of classification.
9. Discuss how an information asset should be managed throughout its life cycle, starting
from specification, all the way through to the destruction of the asset.
10. Show students examples of how cover sheets can be used to clearly indicate the level of
prevent dumpster diving.
13. Describe a lattice-based access control, which uses a matrix of authorizations for
particular areas of access. Note that the row of attributes associated with a particular
subject, such as a user, is known as a capabilities table, while columns are considered to
be access control lists.
14. Explain nondiscretionary controls as involving the use of either role-based controls
(RBAC) or task-based controls. Students should understand the differences between the
two options.
15. Describe discretionary access controls, which are implemented at the option of the data
Quick Quiz 1
1. ____________________ is the act of retrieving potentially compromising information
from recycle bins or trash areas.
2. True or False: In lattice-based access control, users are assigned a matrix of
authorizations for particular areas of access.
Teaching
Visit the following SANS institute page for more information on RBAC:
Management of Information Security, Fourth Edition 6-5
3. When using the U.S. military classification scheme, which classification indicates that
disclosure of contained information could cause minor or moderate damage to national
security?
A. Confidential data
B. Sensitive but unclassified (SBU) data
C. Top secret data
D. Unclassified data
4. What is the use of specialized classification schemes known as?
A. Clarification
B. Obfuscation
C. Compartmentalization
D. Fortification
5. All but which of the following is a key principle of access control?
A. Highest priority
B. Least privilege
C. Need-to-know
D. Separation of duties
Security Architecture Models
1. Explain that some security architecture models are implemented into computer
Trusted Computing Base
1. Define the Trusted Computer System Evaluation Criteria (TCSEC) as a DoD standard
that defines the criteria for assessing the access controls in a computer system. Note
that this standard is part of a larger set of standards known as the “Rainbow Series”.
2. The trusted computing base (TCB) should be explained as encompassing the hardware,
Management of Information Security, Fourth Edition 6-6
Information Technology System Evaluation Criteria
1. Provide students with information regarding the Information Technology System
Evaluation Criteria (ITSEC), in which targets of evaluation are compared to detailed
security function specifications.
The Common Criteria
1. Introduce the Common Criteria for Information Technology Security Evaluation (CC),
which is considered to be the successor to TCSEC and ITSEC, and note that the CC is
the result of several different countries.
2. Discuss some of the terminology inherent to the common criteria:
a. Target of Evaluation (ToE) – System being evaluated
3. Describe the seven different EAL scale ratings, and discuss how each is used:
a. EAL1: Functionally Tested
b. EAL2: Structurally Tested
Bell-LaPadula Confidentiality Model
1. Explain the Bell-LaPadula (BLP) confidentiality model, which uses MACs, data
classification, and security clearances.
2. Make students aware of how a BLP security rule prevents the flow of information from
Teaching
The rainbow series has long been discussed in hacker circles, and has been
Management of Information Security, Fourth Edition 6-7
Biba Integrity Model
1. Compare the Biba integrity model to the BLP model, and explain how it uses integrity
levels to subjects and objects.
2. Note that the Biba integrity model uses a simple integrity property to permit read
Clark-Wilson Integrity Model
1. Explain that the Clark-Wilson integrity model is built upon principles of change control
rather than integrity levels, and was designed for the commercial environment.
2. List the change control principles on which the Clark-Wilson model operates:
3. Teach students about the difference between internal consistency and external
consistency.
4. Explain that this model is designed to be used in conjunction with a well-formed
transaction via a validated program, in order to help ensure data security. Note some of
5. List the different elements of the Clark-Wilson model:
a. Constrained data item (CDI)
6. Make students aware of the fact that all subjects and objects are labeled with TPs,
which operate as the intermediate layer between subjects and objects.
Graham-Denning Access Control Model
2. Note that subjects are composed of both a process and domain, and a domain consists
of constraints controlling how subjects can access objects. Rights should be explained
as governing how passive objects may be worked on.
3. List the eight primitive protection rights present in the Graham-Denning access control
model:
a. Create object
Management of Information Security, Fourth Edition 6-8
d. Delete subject
Harrison-Ruzzo-Ullman Model
1. Explain that the Harrison-Ruzzo-Ullman (HRU) model defines a method to allow
changes to access rights and the addition and removal of subjects and objects.
2. Note that HRU is built on an access control matrix and includes a set of generic rights
Brewer-Nash Model (Chinese Wall)
1. Describe the Brewer-Nash model, commonly known as a Chinese wall, which is
Security Management Models
1. Explain that the use of proprietary models typically require purchasing rights. Note that
The ISO 27000 Series
1. Discuss the Information Technology – Code of Practice for Information Security
Management, or BS7799 management model, and explain that it has evolved into the
ISO27002 document. Outline the different sections that exist within this document.
2. Point out that because this is a proprietary standard, it must be purchased in order to
view the contents of the standard.
Management of Information Security, Fourth Edition 6-9
7. Teach students about how the SAN SCORE (Security Consensus Operational
Readiness Evaluation) Audit Checklist can be used to verify compliance with the ISO
27002 model.
NIST Security Models
1. Note that other approaches to structuring information security management are found in
the many documents available from NIST’s Computer Security Resource Center.
2. Point out the two advantages that the NIST security models have over the ISO/IEC
17799 standards:
a. They are freely available
b. They have been thoroughly reviewed
3. Explain that although the SP 800-12 Computer Security Handbook functions as an
5. Describe the SP 800-14 “Generally Accepted Principles and Practices for Security
Information Technology Systems” document as providing recommended best practices
and information on commonly accepted InfoSec principles. List some of the points
made in NIST SP 800-14:
a. Security supports the mission of the organization
6. Educate students on the different principles set within the NIST SP 800-14 document,
such as the establishment of a sound security policy, treating security as an integral part
of design, and clearly delineating physical and logical security boundaries.
7. Introduce NIST SP 800-18 Rev. 1 Guide for Developing Security Plans for Federal
Management of Information Security, Fourth Edition 6–10
9. Describe the NIST 800-53A Rev. 1 Guide for Assessing the Security Controls in
Federal Information Systems and Organizations: Building Effective Security
Assessment Plans document as the successor to SP 800-26.
Control Objectives for Information and Related Technology
1. Introduce Control Objectives for Information and Related Technology (COBIT), which
provides advice about the implementation of sound controls and control objectives for
information security. Note that it can be used as a planning tool and as a controls
model.
Committee of Sponsoring Organizations
1. Describe the controls-based model, the Committee of Sponsoring Organizations of the
2. Discuss the different categories of objectives in the COSO model:
3. Provide students with an overview of COSO’s key concepts, and list the five
components used in the model:
a. Control environment
Teaching
Tip
The following Wikipedia page provides additional information on the COBIT
model:
Management of Information Security, Fourth Edition 6–11
Information Technology Infrastructure Library
1. Define the Information Technology Infrastructure Library (ITIL) as a collection of
Information Security Governance Framework
1. Educate students on the use of the Information Security Governance Framework, which
is a managerial model that guides development and implementation of an InfoSec
governance structure. Explain how the guide recommends responsibilities for the
2. Explain the Information Security Governance Framework recommendations for the
development, documentation, and implementation of an InfoSec program consistent
with accepted security practices.
3. Students should also be aware of the recommendation to establish clear, effective, and
Quick Quiz 2
1. In the Clark-Wilson model, a(n) ____________________ is a procedure that only
allows changes to a constrained data item.
2. True or False: The Biba integrity model is based on the premise that lower levels of
integrity are more worthy of trust than higher ones.
3. The ISO 27002 document was originally based on the __________ British Standard.
4. Which of the following is NOT one of the five components of the COSO framework?
A. Control environment
B. Risk assessment
C. Meeting stakeholder needs
D. Information and communication
Management of Information Security, Fourth Edition 6–12
5. Which of the following is NOT one of the primitive protection rights in the Graham-
Denning Access Control Model?
A. Create object
B. Grant object
C. Read access
D. Transfer access
Class Discussion Topics
1. Get students to discuss the various security architectures. Which provides the best
balance between simplicity and security? Have students justify their answers.
Additional Projects
1. Task students with researching the different Rainbow series books, and get them to
document some of the books that are more commonly referred to.
Additional Resources
1. FreeBSD handbook regarding the operating system’s use of a Mandatory Access
Control:
2. Article on government classification levels and why information is classified: