\documentclass[dvipsnames,14pt,t]{beamer}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

% beamer stuff 

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Access Control and \\[-3mm] 

  \LARGE Privacy Policies (4)\\[-6mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\end{center}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

As a proof-of-concept, the following URL allows 

attackers to control the return value saved on 

the stack (the vulnerability is triggered when

executing "/usr/sbin/widget"):

The value of the "hash" HTTP GET parameter consists of

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

D-Link router flaw lets anyone login through "Joel's Backdoor":\medskip

If you tell your browser to identify itself as Joel's backdoor, instead of (say) 

as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip

"What is this string," I hear you ask?

You will laugh: it is 

\hfill\footnotesize October 15, 2013\\

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control in Unix}

\begin{itemize}

\item access control provided by the OS

\item authenticate principals (login)

\item mediate access to files, ports, processes according to \alert{roles} (user ids)\\

\item roles get attached with privileges\bigskip\\%

\hspace{8mm}

\alert{principle of least privilege:}\\

\end{itemize}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Access Control in Unix (2)}

\begin{itemize}

\end{itemize}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control}

\begin{itemize}

based on user identity. Each object is owned by a user. Owners can 

specify freely (at their discretion) how they want to share their objects 

with other users, by specifying which other users can have which 

form of access to their objects.\medskip

(Unix, Windows NT, etc.).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control}

\begin{itemize}

to prevent certain flows of information. In some forms, the system maintains 

security labels for both objects and subjects (processes, users), based on 

which access is granted or denied. Labels can change as the result of an 

access. Security policies are enforced without the cooperation of users or 

This is implemented today in special military operating system versions

(SELinux).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

In its most generic form usually given by an Access Control Matrix 

of the form

\begin{center}

\begin{tabular}{r|c|c|c}

                 & /mail/jane & edit.exe & sendmail \\\hline

jane          & r, w & r, x & r, x\\\hline

john          & $\varnothing$ & r, w, x&  r, x\\\hline

sendmail  & a & $\varnothing$ &  r, x\\

\end{tabular}

\end{center}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Mandatory Access Control}

\begin{itemize}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Bell/LaPadula Model}

\begin{itemize}

\begin{center}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}[c]

  \frametitle{Bell-LaPadula}

  \small

  \begin{itemize}

  \item \alert{Read Rule}: A principal \bl{$P$} can read an object \bl{$O$} if and only if

  \bl{$P$}'s security level is at least as high as \bl{$O$}'s.

  \item \alert{Write Rule}: A principal \bl{$P$} can write an object \bl{$O$} if and only if

  \bl{$O$}'s security level is at least as high as \bl{$P$}'s.\medskip

  \item Meta-Rule: All principals in a system should have a sufficiently high security level

  in order to access an object.

  \end{itemize}\bigskip

  This restricts information flow $\Rightarrow$ military\bigskip\bigskip\pause

  Bell-LaPadula: {\bf `no read up'} - {\bf `no write down'}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}[c]

  \frametitle{\begin{tabular}{c}Principle of\\[-2mm] Least Privilege\end{tabular}}

  A principal should have as few privileges as possible to access a resource.

  \small

  \begin{itemize}

  \item Bob ($T\!S$) and Alice ($S$) want to communicate

  \item[] $\Rightarrow$ Bob should lower his security level

  \end{itemize}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}[c]

  \frametitle{Biba Policy}

  \small

  Data Integrity (rather than data confidentiality)

  \begin{itemize}

  \item Biba: {\bf `no read down'} - {\bf `no write up'}

  \item \alert{Read Rule}: A principal \bl{$P$} can read an object \bl{$O$} if and only if

  \bl{$P$}'s security level is lower or equal than \bl{$O$}'s.

  \item \alert{Write Rule}: A principal \bl{$P$} can write an object \bl{$O$} if and only if

  \bl{$O$}'s security level is lower or equal than \bl{$P$}'s.

  \end{itemize}\bigskip\bigskip\pause

  E.g.~Firewalls: you can read from inside the firewall, but not from outside\\

  Phishing: you can look at an approved PDF, but not one from a random email\\

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{itemize}

\item Biba model is for data integrity  

\begin{itemize}

\item read: your own level and above

\item write: your own level and below

\end{itemize}

\end{itemize}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Shared Access Control}

\begin{center}

\end{center}

\begin{textblock}{11}(10.5,10.5)

\small

To take an action you\\[-1mm] 

need at least either:

\begin{itemize}

\item 1 CEO\\[-5mm]

\item 2 MDs, or\\[-5mm]

\item 3 Ds

\end{itemize}

\end{textblock}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

Not just restricted to Unix:

\begin{itemize}

\item if you have too many roles (i.e.~too finegrained AC), then 

	hierarchy is too complex\\

\end{itemize}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

  \begin{frame}[t]

  \frametitle{Protocols}