Lab Exercise

1. Suppose you have a secure system with three subjects and three objects, with levels as listed below.

Here H dominates L. You wish to implement a Bell and LaPadula model of security for this system. Fill in the access rights (R and/or W) permitted by the model for each subject/object pair in the access matrix below:

Subject: (H, {A}), Object: (L, {A,B})

Can the subject read the object? Justify your answer

Subject: (H, {A,B}), Object: (L, {A })

Can the subject read the object? Justify your answer

Subject: (L, {A,B}), Object: (H, {A })

Can the subject read the object? Justify your answer

Subject: (L, {A,B}), Object: (H, {A })

Can the subject read the object? Justify your answer

Subject: (H, {A,B,C}), Object: (H, {A,B })

Can the subject read the object? Justify your answer

Subject: (L, {A,B}), Object: (L, {C})

Can the subject read the object? Justify your answer

2.Suppose a department has determined that some users have gained unauthorized access to the computing system. Managers fear the intruders might intercept or even modify sensitive data on the system. Cost to reconstruct correct data is expected to be $1,000,000 with 1% likelihood per year.

One approach to addressing this problem is to install a more secure data access control problem. The cost of access control software is $100,000 with 20% effectiveness.

What is the expected annual total costs?

What is the saving?

Answer if it is worthwhile to invest on the access control software. Justify your answer.