Question

Show that the Clinical Information System model’s principles implement the Clark-Wilson enforcement and certification rules.

Please keep your answer concise.

Answer 1

Hello, Student I hope you are doing great in lockdown.

Here is answer of your question,still if you have any doubt then feel free to ask in comment section, I am always happy to help you.

Please upvote.

Q)Show that the Clinical Information System model’s principles implement the Clark-Wilson enforcement and certification rules.

Answer: -

We know that Information systems security has  three essential properties of information:

1.Confidentiality

2.Integrity

3.Availability

These characteristics of information are major concerns throughout the commercial and military industry.

At that time Confidentiality is most important because of its importance in military,and they do not want to disclosure any of information, but at same time commercial security systems wants to ensure that the integrity of data is protected from improper modifications and inappropriate actions performed by unauthorized users. And further David D. Clark and David R. Wilson argue that the integrity of the information is more important than its confidentiality in most commercial systems.

After this everyone has started developing sophisticated models and mechanisms for confidentiality so they can provide confidentiality in information systems.

Clark-Wilson (CW) model :-

1.Integrity

Data integrity is defined as the, quality, correctness, authenticity, and accuracy of information stored within an information system.Systems integrity is the successful and correct operation of information resources. Together, these definitions define integrity as information is not modified in unauthorized ways, that it is internally consistent and consistent with the real-world objects that it represents, and that the system performs correctly.

Security Policy The goal of information systems is to control or manage the access of subjects (users, processes) to objects (data, programs). This control is governed by a set of rules and objectives called a security policy.

There are three goals of integrity:

• Prevent unauthorized modifications

• Maintain internal and external consistency

• Prevent authorized but improper modifications

To accomplish these goals, a collection of security services that embody the properties needed for integrity as well as a framework for composing them is needed. The needed security properties for integrity include integrity, access control, auditing, and accountability. The Clark-Wilson (CW) model is an integrity, application level model which attempts to ensure the integrity properties of commercial data and provides a framework for evaluating security in commercial application systems.

Certification Rules :-

1. C1 (IVP Certification) - The system will have an IVP for validating the integrity of any CDI

2. C2 (Validity) - The application of a TP to any CDI must maintain the integrity of that CDI. CDIs must be certified to ensure that they result in a valid CDI

3.C3 - A CDI can only be changed by a TP. TPs must be certified to ensure they implement the principles of separation of duties & least privilege

4.C4 (Journal Certification) - TPs must be certified to ensure that their actions are logged

5.C5 - TPs which act on UDIs must be certified to ensure that they result in a valid CDI

Enforcement Rules :-

1.  E1 (Enforcement of Validity) - Only certified TPs can operate on CDIs

2.E2 (Enforcement of Separation of Duty) - Users must only access CDIs through TPs for which they are authorized

3. E3 (User Identity) - The system must authenticate the identity of each user attempting to execute a TP

4. E4 (Initiation) - Only administrator can specify TP authorizations The CW model differs from the other models that allow subjects to gain access to objects directly, rather than through programs

The access triple is at the heart of the CW model, (Summers) which prevents unauthorized users from modifying data or programs. From what is presented above, we see that the CW model shows that the rules seek to enforce the needed security properties for integrity, which are described below: [18] Integrity An assurance that CDIs can only be modified in constrained ways to produce valid CDIs. This property is ensured by the rules: C1, C2, C5, E1 and E4. Access control The ability to control access to resources. This is supported by the rules: C3, E2 and E3. Auditing The ability to ascertain the changes made to CDIs and ensure that the system is in a valid state. This is ensured by the rules C1 and C4.

Clark-Wilson Model :

Rule 1. The sy stem will hav e an IVP f or v alidating the integrity of any CDI.

Rule 2.The application of a TP to any CDI must maintain the integrity of that CDI

Rule 3. A CDI can only be changed by a TP

Rule 4. Subjects can only initiate certain TPs on certain CDIs

Rule 5. CW-triples must enf orce some appropriate separation of duty policy on subjects

Rule 6. Certain special TPs on UDIs can produce CDIs as output

Rule 7. Each TP application must cause inf ormation suff icient to reconstruct the application to be written to a special append-only CDI

Rule 8. The sy stem must authenticate subjects attempting to initiate a TP

Rule 9. The sy stem must only permit special subjects (i.e., security officers) to make any authorization-related lists.

last words:

Confidentiality, integrity, availability are very important and much related aspects of security. To achieve any of these goals, the objective is to strike a balance between applying generally accepted models and incorporating the latest security technologies and products, applying security patches, risk management, adhering to industry standards and guidelines, and implementing sound management principles to achieve secure systems.

Feel free to ask in comment section (if needed).

Please do not forget to hit that like or thumbs-up button, it really motivates me<3

Thank you!!

Have a nice day:)