ON FOUR DEFINITIONS OF DATA INTEGRITY

1
Title
FIVE
ON FOUR DEFINITIONS OF DATA INTEGRITY Ravi
Sandhu George Mason University
2
OBJECTIVE

• Reconcile 5 definitions of data integrity
• Scope is limited to data integrity as opposed to
  system integrity
• None of the definitions is wrong or right

3
THE FIVE DEFINITIONS
more general

• 1. Courtney Expectation of data quality
• 2. Sandhu-Jajodia Safeguards against improper
  data modification
• 3. ITSEC, CTCPEC Safeguards against unauthorized
  data modification
• 4. Biba (or BLP) Ensure one directional
  information flow in a lattice
• 5. Network arena Safeguards against message
  modification

less general
4
THE FIVE DEFINITIONS
OBJECTIVES
Liveness and Safety

• 1. Expectation of data quality
• 2. Improper data modification
• 3. Unauthorized data modification
• 4. One directional information flow
• 5. No modification

Safety Only
5
THE FIVE DEFINITIONS
ENFORCEMENT IS PRIMARILY BY
External actions of users Internal actions of
the TCB

• 1. Expectation of data quality
• 2. Improper data modification
• 3. Unauthorized data modification
• 4. One directional information flow
• 5. No modification

Internal actions of the TCB
6
THE FIVE DEFINITIONS
POLICY

• 1. Expectation of data quality
• 2. Improper data modification
• 3. Unauthorized data modification
• 4. One directional information flow
• 5. No modification

Must be articulated by the System Owners
Is built in
7
THE FIVE DEFINITIONS
ENFORCEMENT MECHANISMS

• 1. Expectation of data quality
• 2. Improper data modification
• 3. Unauthorized data modification
• 4. One directional information flow
• 5. No modification

Prevention Detection
Detection
8
THE DATA QUALITY DEFINITION
Integrity -- The property that data, an
information process, computer equipment, and/or
software, people, etc., or any collection of
these entities, meet an a priori expectation of
quality that is satisfactory and adequate in some
specific circumstance. Bob Courtney NIST
Invitational Workshop on Data Integrity, 1989
9
THERMOSTAT MODEL
10
BINARY OR GRADED?

• Binary view Data has integrity if its actual
  state differs from the ideal state by less than
  the tolerable limits of deviation
• Graded view Data has integrity in inverse
  relationship to the extent that its actual state
  differs from the ideal state

IN OTHER WORDS THIS IS A NON-ISSUE
11
CLARK-WILSON MODEL
Internal and external consistency of CDIs
USERS
TPs
IVPs
CDIs
UDIs
12
CLARK-WILSON RULES

• C1 IVPs validate CDI state
• C2 TPs preserve valid state
• C3 Suitable (static) separation of duties
• C4 TPs write to log
• C5 TPs validate UDIs
• E1 CDIs changed only by authorized TP
• E2 Users authorized to TP and CDI
• E3 Users are authenticated
• E4 Authorizations changed only by security officer

13
CLARK-WILSON MODEL

• Concerned with improper modification of data
• Does not address liveness, except to require that
  integrity verification procedures verify
  correspondence of data to external reality
• It is one approach to
• meeting the improper data modification aspects
  of data integrity
• with a small liveness attachment

14
TYPE ENFORCEMENT(Boebert and Kain)

• Type enforcement can be used to implement a
  number of mechanisms related to improper
  modification of data
• well-formed transformation procedures
• data encapsulation
• separation of duties
• assured pipelines
• Type enforcement does not directly support
  liveness requirements

15
OTHER ACCESS CONTROL MODELS

• HRU, TAM, SPM
• can be used to implement a number of mechanisms
  related to improper modification of data
• do not directly support liveness requirements

16
DRAFT FEDERAL CRITERIA

• Integrity - Correctness and appropriateness of
  the content and/or source of a piece of
  information.
• The Courtney and Federal Criteria definitions are
  close enough that they can be reconciled fairly
  easily
• Courtney's definition is more general, because it
  is phrased in terms of data quality, which is a
  more general notion than the specific attributes
  of correctness and appropriateness

17
DOES INTEGRITY SUBSUME SECRECY?
Top Secret Contents
Label Secret

• By Courtney and Federal Criteria definitions this
  is an integrity violation (if we expect labels to
  be correct)

18
HOMEWORK ASSIGNMENT
Unclassified Contents
Label Secret

• Is this an integrity violation?

19
PANELISTS

• John Dobson
• Carl Landwehr
• LouAnna Notargiacomo
• Marv Schaefer