Epistemological Relativism » Application Security http://www.thummy.com/roodee My Wrong Opinions.. Wed, 23 Feb 2011 00:54:42 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 Security Frames http://www.thummy.com/roodee/2009/03/03/security-frames/ http://www.thummy.com/roodee/2009/03/03/security-frames/#comments Tue, 03 Mar 2009 18:02:56 +0000 Rudy Ruiz http://www.thummy.com/roodee/?p=254 The classic CIA Triad (Confidentiality, Integrity and Availability) as it is affectionately called has been used for decades as a means to coarsely outline certain security/assurance expectations of a system. It has lasted this long because who can forget a TLA? Sadly, it is too general to be used effectively in most application security endeavors. There have been many who have attempted to elaborate on the triad to make it more useful. Microsoft’s Security Frame was a great effort. It identified the important and relevant categories that were hidden away within the triad. However, going from a TLA to a set of ten concepts or IAACSSCEA isn’t exactly easy to recall. Yes, I know, this should be documented as part of a defined process chock full of cheat sheets, tips and lists. Well, in an effort to align these concepts with my view of security functions and properties I created a set of six concepts that are derived from CIA, but that add more precision. You’ll probably recognize some of these labels. Yes, some of them made sense to retain from Microsoft’s Frame, others were useful labels gathered from the Common Criteria (oh no! not that!?). So, I managed to trim a few items by merging them with a more common categrory. Let’s see if an uninformed reader can make sense of these:

  1. Accountability and Event Reconstruction
  2. Data Protection
  3. Identity and Access Management
  4. Exception Management and Availability
  5. Management and Configuration
  6. Survivability

Identity and Access Management is perhaps the most intuitive category. In encompasses authentication, authorization and other concepts related to access control. Accountability is also fairly straight forward. What is your take on the others?

]]> http://www.thummy.com/roodee/2009/03/03/security-frames/feed/ 0