Tusted Computing Base Compare and contrast the various issues of building securi

Question

Tusted Computing Base

Compare and contrast the various issues of building security into a system from the initial implementation versus adding security to an existing system. Discuss the problems and issues of one approach versus the other. Consider the functionality provided by the reference monitor in a TCB. Discuss the problems and issues to retrofit a reference monitor to an existing implementation versus implementing the reference monitor from the initial implementation. Good answers will address each of the previous stated points and will also provide specific examples with explanations.

Explanation / Answer

Designing a system with security from start is always a better option.

Below issues are addressed when building a security into a system from initial implementation versus adding security to an existing system:

1. Trustworthiness of software and hardware are essential concern.

2. When adding security to existing system, unstable software may lead to crash.

3. Software’s used may be incompatible with new security policies.

4. An in-depth risk analysis will be required before installing the new security features to tackle the past and existing risk, mitigation strategies will be a challenge in this case.

5. Granting permissions and revocation will be another issue for the administrator.

6. When building security into a system from the initial implementation, you have the freedom to design and align the system as per the security policies and other security requirements. Scope of the system is defined and then the security is implemented.

7. For the existing system, defining the scope of the system and finding out what all places data is used and linked is another challenge.

Reference Monitor is a part of Trusted Computing Base. All the access related decisions for security are made by Reference Monitor. It controls the read/write abilities of the users/processors. Each system call goes through reference monitor for security validation. Still it is recommended to integrate the security into the system from start.

Related Questions

Navigate

• Browse (All)
• Browse T
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.