Which of the following security mode of operation does NOT require all users to have the clearance for all information processed on the system?
Answer(s): B
The multilevel security mode permits two or more classification levels of information to be processed at the same time when all the users do not have the clearance of formal approval to access all the information being processed by the system.In dedicated security mode, all users have the clearance or authorization and need-to-know to all data processed within the system.In system-high security mode, all users have a security clearance or authorization to access the information but not necessarily a need-to-know for all the information processed on the system (only some of the data).In compartmented security mode, all users have the clearance to access all the information processed by the system, but might not have the need-to-know and formal access approval.Generally, Security modes refer to information systems security modes of operations used in mandatory access control (MAC) systems. Often, these systems contain information at various levels of security classification.The mode of operation is determined by:The type of users who will be directly or indirectly accessing the system. The type of data, including classification levels, compartments, and categories, that are processed on the system.The type of levels of users, their need to know, and formal access approvals that the users will have.Dedicated security modeIn this mode of operation, all users must have:Signed NDA for ALL information on the system.Proper clearance for ALL information on the system.Formal access approval for ALL information on the system. A valid need to know for ALL information on the system.All users can access ALL data.System high security modeIn this mode of operation, all users must have:Signed NDA for ALL information on the system.Proper clearance for ALL information on the system.Formal access approval for ALL information on the system. A valid need to know for SOME information on the system.All users can access SOME data, based on their need to know.Compartmented security modeIn this mode of operation, all users must have:Signed NDA for ALL information on the system.Proper clearance for ALL information on the system.Formal access approval for SOME information they will access on the system. A valid need to know for SOME information on the system.All users can access SOME data, based on their need to know and formal access approval.Multilevel security modeIn this mode of operation, all users must have:Signed NDA for ALL information on the system.Proper clearance for SOME information on the system.Formal access approval for SOME information on the system. A valid need to know for SOME information on the system.All users can access SOME data, based on their need to know, clearance and formal access approval.
WALLHOFF, John, CBK#6 Security Architecture and Models (CISSP Study Guide), April 2002 (page 6).andhttp://en.wikipedia.org/wiki/Security_Modes
What prevents a process from accessing another process' data?
Process isolation is where each process has its own distinct address space for its application code and data. In this way, it is possible to prevent each process from accessing another process' data. This prevents data leakage, or modification to the data while it is in memory. Memory segmentation is a virtual memory management mechanism. The reference monitor is an abstract machine that mediates all accesses to objects by subjects. Data hiding, also known as information hiding, is a mechanism that makes information available at one processing level is not available at another level.
HARE, Chris, Security Architecture and Models, Area 6 CISSP Open Study Guide, January 2002.
What can best be defined as the sum of protection mechanisms inside the computer, including hardware, firmware and software?
Answer(s): C
The Trusted Computing Base (TCB) is defined as the total combination of protection mechanisms within a computer system. The TCB includes hardware, software, and firmware. These are part of the TCB because the system is sure that these components will enforce the security policy and not violate it.The security kernel is made up of hardware, software, and firmware components at fall within the TCB and implements and enforces the reference monitor concept.
AIOv4 Security Models and Architecture pgs 268, 273
A trusted system does NOT involve which of the following?
A trusted system is one that meets its intended security requirements. It involves sufficiency and effectiveness, not necessarily efficiency, in enforcing a security policy. Put succinctly, trusted systems have (1) policy, (2) mechanism, and (3) assurance.
What can be described as an imaginary line that separates the trusted components of the TCB from those elements that are NOT trusted?
The security perimeter is the imaginary line that separates the trusted components of the kernel and the Trusted Computing Base (TCB) from those elements that are not trusted. The reference monitor is an abstract machine that mediates all accesses to objects by subjects. The security kernel can be software, firmware or hardware components in a trusted system and is the actual instantiation of the reference monitor. The reference perimeter is not defined and is a distracter.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.