Q 1-Classify each of the following as an example of a mandatory, discretionary,
ID: 3734707 • Letter: Q
Question
Q 1-Classify each of the following as an example of a mandatory, discretionary, or originator controlled policy, or a combination thereof. Justify your answers. a. The file access control mechanisms of the UNIX operating system b. A system in which no memorandum can be distributed without the author's consent c. A military facility in which only gencrals can enter a particular room d. A university registrar's office, in which a faculty member can see the grades of a particular student provided that the student has given written permission for the faculty member to see them. Q2- Given the security levels TOP SECRET, SECRET, CONFIDENTIAL, and UNCLASSIFIED (ordered from highest to lowest), and the categories A, B, and C, specify what type of access (read, write, or both) is allowed in each of the following situations. Assume that discretionary access controls allow anyone access unless otherwise specified. a. Paul, cleared for (TOP SECRET, A, C, wants to access a document classified (SECRET, B, C ) b. Anna, cleared for (CONFIDENTIAL, C), wants to access a document classified CONFIDENTIAL,B). c. Jesse, cleared for (SECRET, C), wants to access a document classified (CONFIDENTIAL, C ) d. Sammi, cleared for (TOP SECRET, A, C)), wants to access a document classified (CONFIDENTIAL, {A }). c. Robin, who has no clearances (and so works at the UNCLASSIFIED level), wants to access a document classificd (CONFIDENTIAL, B )Explanation / Answer
Q1)
a. The file access control mechanisms of the UNIX operating system - mandatory access control policy, as the file control mechanisms in UNIX are by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target.
b. A system in which no memorandum can be distributed without the author's consent - originator controlled policy, because the information is controlled by originator or creator of information not owner.
c. A military facility in which only generals can enter a particular room - discretionary access , as restricting access to objects based on the identity of subjects and/or groups to which they belong, is a property of discretionary access control.
d. A university registrar's office in which a faculty member can see the grades of a particular students provided that the student has given written permission for the faculty member to see them - This is combination of mandatory, discretionary and originator controlled access control policy. This is because, students are giving discretionary permission to the faculty to view their grades. Also, only faculty members have permission to view the grades and nobody else in university registrar's office. This is mandatory for the same reason as only access is provided for approved faculties.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.