Hello wise academics,
I am interested in finding literature on models of data security. Conceptual models would be great and literature from any business field on data security would be useful.
Could someone recommend some key literature/articles in this area?
Many thanks!
Here's a range of papers and websites about data security models that you may find helpful, with some fundamental papers and a pointer at what people use today. The reference sections in the papers will have more pointers.
Fundamental data security models:
Bell and Lapadula. "Secure Computing Systems: Mathematical Foundations" 1973. https://apps.dtic.mil/dtic/tr/fulltext/u2/770768.pdf
Goguen and Meseguer. "Security Policies and Security Models" https://www.cs.purdue.edu/homes/ninghui/readings/AccessControl/goguen_meseguer_82.pdf
RS Sandhu. Article Role-Based Access Control.
What's used today:
Common Criteria for Information Technology Security Evaluation (https://www.commoncriteriaportal.org/)
Jeff Sedayao and Mohammed Ramadan
, thank you to you both, these are great sources however too technical for me. I am more after the treatment of data security / cybersecurity from a management point of view, therefore more of a managerial model / management solutions so that I can try to conceptualise and link to a particular industry.
I'm looking for article/reference about campus security comprehensive management system. Anyone can share/idea for that matter. Tq
https://en.wikibooks.org/wiki/Security_Architecture_and_Design/Security_Models
A security policy is a document that expresses clearly and concisely what the protection mechanisms are to achieve. Its a statement of the security we expect the system to enforce.
- A security model is a specification of a security policy:
- it describes the entities governed by the policy,
- it states the rules that constitute the policy.
- There are various types of security models:
- Models can capture policies for confidentiality (Bell-LaPadula) or for integrity (Biba, Clark-Wilson).
- Some models apply to environments with static policies (Bell-LaPadula), others consider dynamic changes of access rights (Chinese Wall).
- Security models can be informal (Clark-Wilson), semi-formal, or formal (Bell-LaPadula, Harrison-Ruzzo-Ullman).
- Model vs Policy
- A security model maps the abstract goals of the policy to information system terms by specifying explicit data structures and techniques that are necessary to enforce the security policy. A security model is usually represented in mathematics and analytical ideas, which are then mapped to system specifications, and then developed by programmers through programming code
- For Example, if a security policy states that subjects need to be authorized to access objects, the security model would provide the mathematical relationships and formulas explaining how x can access y only through the outlined specific methods
- A security policy outlines goals without regard to how they will be accomplished. A model is a framework that gives the policy form and solves security access problems for particular situations.
Anca Cristiana Yallop
You state to be looking for sources in the literature on security, but find the suggestions by Lauzanne Alain on ISO27K and Mohammed Ramadan
on IS2C/ISACA too technical for your purposes.The gist of those standards and certification bodies is centered around risk management. Perhaps the simplest conceptual approach is by making an inventory of your data assets, mapping them against the business processes to arrive at an understanding of risk - which will involve your corporate objectives (the reason you have those data assets to begin with).
I hope these steps help you design your data security model.
Pieter van de Griend thanks for your useful input, best wishes!
good day all. am also in need of data security model that has to do with cloud computing
- Badges
- Science topic
- Similar topics
- Chemistry