CS 450/650 Fundamentals of Integrated Computer Security

Fall 2014

Homework 5

Due on Tuesday, Nov 25 at 1:00 pm

The following problems are from the text book (Stallings and Brown, 3nd edition):

Chapter 12: 4

User ``ahmed" owns a directory, ``stuff,'' containing a text file called ``ourstuff.txt'' that he shares with users belonging to the group ``staff.'' Those users may read and change this file, but not delete it. They may not add other files to the directory. Others may neither read, write, nor execute anything in ``stuff.'' What would appropriate ownerships and permissions for both the directory ``stuff'' and the file ``ourstuff.txt'' look like? (Write your answers in the form of ``long listing'' output.)

Chapter 13: 4

In the example illustrated in Figure 13.2, state which of the eight BLP rules are invoked for each action in the scenario.

Chapter 13: 8

Each of the following descriptions applies to one or more of the rules in the Clark-Wilson model. Identify the rules in each case.
a. Provide the basic framework to ensure internal consistency of the CDIs.
b. Provide a mechanism for external consistency that control which persons can execute which programs on specified CDIs. This is the separation of duty mechanism.
c. Provide for user identification.
d. Maintain a record of TPs.
e. Control the use of UDIs to update or create CDIs.
f. Make the integrity enforcement mechanism mandatory rather then discretionary.

Chapter 19: 5

Consider a popular DRM system like Apple's FairPlay, used to protect audio tracks purchased from the iTunes music store. If a person purchases a track from the iTunes store by an artist managed by a record company such as EMI, identify which company or person fulfils each of the DRM component roles shown in Figure 19.2.

Chapter 20: 10

Fill in the remainder of this table:

What to turn in: A softcopy of your solutions (could be a scanned version of the hard copy) to be uploaded as a single file to WebCampus.