Let's talk about the terminologies identified by Saltzer in his seminal paper
from 1975, that talks about the issues in computer security. The first issue
that is identified is when to release information. In this day and age,
we all know the importance of privacy of information. And there is
a distinction between privacy of information and security. Privacy has to to
with when, as individuals, we expect
to release information or. Prevent information for
being released. That's the individual's right
and responsibility in terms of information that
they own. Security, on the other hand, is dealing with how to make
sure that the system is respecting the guarantees that the user needs
both in terms of. Privacy of information as well as when they want to
release information. Said differently, privacy is
more concerning the individual and the information
that they own, they possess, how
their information is protected and released when.
And if an individual wants to release information. Security on the other hand,
is a system function. The system
is guaranteeing certain properties about information that
it is preserving on behalf of the user community. And in particular, the
system has to protect information that belongs
to individuals. And ensure that those information
is released only when the individual that
owns that information wants it to be released.
So in this sense, there's an obligation for the system to ensure that users of
the system are authenticated. Meaning, that if
I go to the system and want to access
some information. The system has to ensure that
I am who I am. That's authentication, and
then, it also has to make sure that whatever information I have access to,
is something that is not violating any privacy of other individuals that may
have put information into the system. So,
protection and authentication go hand in hand.
And building a secure system. This also
identifies a comprehensive set of security concerns.
The first security concern is unauthorized information
release. If I have put some information
into the system, then it is a responsibility of the system to make sure that
the information that I've put in, is
not released without my authorization as the
owner of the information. So that is
the first concern. The second concern is unauthorized
modification of information. I may have released it for a certain set of
users to access information that I've put into the system. But, I may not have
given authority for them to modify the
information, so, unauthorized modification of information is
the second set of concerns. The third
security concern is unauthorized denial of use.
What that means is. If I've given authority
to a set of users that they can access my information, there should be nothing
that prevents that set of authorized users from being able to access
that information. So that is what unauthorized denial of
use is concerned about. And you may be much more familiar with the term
Denial Of Service. That's exactly what this
particular concern is all about. In fact, this
is the first mention in the literature of Denial of Service attacks on a server,
that prevents authorized users from being able to get service from the system.
So what should be the goal of a secure system? Well the goal of a secure system
should be to make sure that all such violations do not occur. That
is, preventing all violations is the concern of a
secure system. But unfortunately stated this way, it's a negative statement,
preventing all violations, that's insuring that
the system is somehow secure proof,
meaning that nobody can attack the system.
And because it's a negative statement it's hard
to achieve. It's sort of like saying there, are no bugs in my program. There
is no way to prove that a program has no bugs. And in a similar manner there, is
no way to assure that the system prevents all violations. So what
Saltzer argues is, the goal of the secure system should
not be stated negatively, but positively. If the goal of the
secured system is stated in this negative manner that it
has to prevent all violations. At best, it can give a
false sense of security because there is no way to assure
that bad guys are not going to break into
the system. So, making a statement like my system
prevents all violation, is giving a false sense
of security because it is not achievable in practice.