imported>Kvng: avoid unnec redirects. caps. format endmatter.

2025-01-27T13:55:30Z

avoid unnec redirects. caps. format endmatter.

New page

{{Cleanup rewrite|date=August 2013}}

A '''computer security policy''' defines the goals and elements of an organization's computer systems. The definition can be highly formal or informal. Security policies are enforced by organizational policies or security mechanisms. A technical implementation defines whether a computer system is ''secure'' or ''insecure''. These formal policy [[Computer security model|models]] can be categorized into the core security principles of confidentiality, integrity, and availability. For example, the [[Bell–LaPadula model]] is a ''confidentiality policy model'', whereas the [[Biba model]] is an ''integrity policy model''.<ref>{{Cite web |title=What is a Security Policy? - Definition from SearchSecurity |url=https://www.techtarget.com/searchsecurity/definition/security-policy |access-date=2022-07-12 |website=SearchSecurity |language=en}}</ref>

== Formal description ==
If a system is regarded as a [[finite-state automaton]] with a set of transitions (operations) that change the system's state, then a ''security policy'' can be seen as a statement that partitions these states into authorized and unauthorized ones.

Given this simple definition, one can define a ''secure system'' as one that starts in an authorized state and will never enter an unauthorized state.

== Formal policy models ==

=== Confidentiality policy model===
* [[Bell-La Padula model]]

=== Integrity policies model===
* [[Biba model]]
* [[Clark-Wilson model]]

=== Hybrid policy model===
* [[Chinese wall#Computer science|Chinese wall]] (Also known as [[Brewer and Nash model]])

== Policy languages ==
To represent a concrete policy, especially for automated enforcement of it, a language representation is needed. There exist a lot of application-specific languages that are closely coupled with the security mechanisms that enforce the policy in that application.

Compared with this abstract policy languages, e.g., the [[Type enforcement|Domain Type Enforcement]]-Language, is independent of the concrete mechanism.

== See also ==
* [[Anti-virus]]
* [[CIA triad|Information Assurance - CIA Triad]]
* [[Firewall (computing)]]
* [[Protection mechanisms]]

== References ==
{{Reflist}}
{{refbegin}}
* {{cite book
| last = Bishop | first = Matt
| title = Computer security: art and science
| publisher = Addison-Wesley
| year = 2004
}}
* {{cite encyclopedia
| last = McLean
| first = John
| title = Security Models
| encyclopedia = Encyclopedia of Software Engineering
| volume = 2
| pages = 1136–1145
| publisher = John Wiley & Sons, Inc
| location = New York
| year = 1994 }}
*Clark, D.D. and Wilson, D.R., 1987, April. A comparison of commercial and military computer security policies. In ''1987 IEEE Symposium on Security and Privacy'' (pp. 184–184). IEEE.
{{refend}}

{{DEFAULTSORT:Computer Security Policy}}
[[Category:Computer security procedures]]
[[Category:Computer security models]]

Computer security policy - Revision history

imported>Kvng: avoid unnec redirects. caps. format endmatter.