Security policy foundations in context UNITY

ABSTRACT

Security certification includes assessing an information system to verify its compliance with diverse, pre-selected security controls. The goal of certification is to identify where controls are implemented correctly and where they are violated, creating potential vulnerability risks. Certification complexity is magnified in software composed of systems of systems where there are limited formal methodologies to express management policies, given a set of security control properties, and verify them against the interaction of the participating components and their individual security policy implementations. In this paper, we extend Context UNITY, a formal, distributed, and context aware coordination language to support policy controls. The new language features enforce security controls and provide a means to declare policy specifics in a manner similar to declaring variable types. We use these features in a specification to show how verifying system compliance with selected security controls, such as those found in the NIST SP800-53 document, can be accomplished.

References

1. U. S. DoD, "DoD Information Assurance Certification and Accreditation Process (DIACAP)," 2007.
2. NIST, "SP 800-53 Rev 3: Recommended Security Controls for Federal Information Systems and Organizations," 2010.
3. G.-C. Roman, C. Julien, and J. Payton, "Modeling Adaptive Behaviors in Context UNITY," Theoretical Computer Science, vol. 376, pp. 185--204, May 2007.
4. "Common Criteria for Information Technology Security Evaluation," vol. Version 3.1, Part 2: Security Functional Components ed, 2007.
5. U. S. DoD, "Information Assurance (IA) Implementation," 2003.
6. J. Jurjens, J. Schreck, and P. Bartmann, "Model-based security analysis for mobile communications," in 30th International Conference on Software Engineering, pp. 683--692, 2008.
7. B. Best, J. Jurjens, and B. Nuseibeh, "Model-based Security Engineering of Distributed Information Systems using UMLsec," in 29th International Conference on Software Engineering, 2007.
8. D. Gelernter, "Generative communication in Linda," ACM Transactions on Programming Languages and Systems, vol. 7, pp. 80--112, 1985.
9. M. Bravetti, N. Busi, R. Gorrieri, R. Lucchi, and G. Zavattaro, "Security issues in the tuple-space coordination model," Formal Aspects in Security and Trust, pp. 1--12, 2005.
10. R. Focardi, R. Lucchi, and G. Zavattaro, "Secure shared data-space coordination languages: A process algebraic survey," Science of Computer Programming, vol. 63, pp. 3--15, 2006.
11. G.-C. Roman and P. J. McCann, "A notation and logic for mobile computing," Formal Methods in System Design vol. 20, pp. 47--68, 2002.
12. K. M. Chandy and J. Misra, Parallel Program Design: A Foundation: Addison-Wesley, 1988.
13. J. Hosey and R. Gamble, "Extracting Security Control Requirements," in Cyber Security and Information Intelligence Research Workshop, 2010.

Index Terms

• Security and privacy

  • Security in hardware

  • Security services

    • Authentication

    • Authorization

• Social and professional topics

  • Professional topics

    • Management of computing and information systems

      • Information system economics