Computer security policy
From Wikipedia, the free encyclopedia
A computer security policy defines the goals and elements of an organization's computer systems. The definition can be highly formal or informal. Security policies are enforced by organizational policies or security mechanisms. A technical implementation defines whether a computer system is secure or insecure. These formal policy models can be categorized into the core security principles of confidentiality, integrity, and availability. For example, the Bell–LaPadula model is a confidentiality policy model, whereas the Biba model is an integrity policy model.[1]
If a system is regarded as a finite-state automaton with a set of transitions (operations) that change the system's state, then a security policy can be seen as a statement that partitions these states into authorized and unauthorized ones.
Given this simple definition, one can define a secure system as one that starts in an authorized state and will never enter an unauthorized state.
Formal policy models
- Confidentiality policy model
- Integrity policies model
- Hybrid policy model
- Chinese wall (Also known as Brewer and Nash model)