February 14, 2024 Outline

Reading: text, §8.2–8.4
Due: Extra Credit #C, due February 14; Project Progress Report, due February 16; Homework #3 due February 21

Module 29 (Reading: text, §8.2)

1. Clinical Information System Security model
   1. Intended for medical records; goals are confidentiality, authentication of annotators, and integrity
   2. Patients, personal health information, clinician
   3. Assumptions and origin of principles
   4. Access principles
   5. Creation,, deletion principles
   6. Confinement, aggregation principles
   7. Enfircement
   8. Comparison with Bell-LaPadula, Clark-Wilson

Module 30 (Reading: text, §8.3)

2. ORCON
   1. Originator controls distribution
   2. DAC, MAC inadequate
   3. Solution is combination

Module 31 (Reading: text, §8.4)

3. Role-based Access Control (RBAC)
   1. Definition of role
   2. Partitioning as job function
   3. Axioms
   4. Containment and other uses
   5. RBAC₀, RBAC₁, RBAC₂, RBAC₃

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: [email protected]

ECS 235B, Foundations of Computer and Information Security Version of February 15, 2024 at 10:26PM

You can also obtain a PDF version of this.