3.1 Security Models

Security models provide the formal mathematical rules for enforcing security policies.

• Bell-LaPadula: The primary model for confidentiality. It defines two mandatory access control rules: the Simple Security Property (No Read Up), preventing a subject at a lower clearance from reading higher-classification data; and the * (Star) Property (No Write Down), avoiding a subject with higher clearance from writing data to a lower classification, thus preventing data leakage.

• Biba: The primary model for integrity. It inverts Bell-LaPadula's rules to prevent the contamination of high-integrity data. It enforces No Read Down (a subject cannot read data from a lower-integrity level) and No Write Up (a subject cannot write data to a higher-integrity level).

• Clark-Wilson: Focuses on commercial integrity. It introduces the concept of well-formed transactions and separation of duties to ensure data integrity. Users cannot manipulate data directly; they must use programs that ensure the integrity of the transformation.

• Brewer-Nash (Chinese Wall): Designed to prevent conflicts of interest. It dynamically changes a user's access rights based on their previous actions. If a consultant accesses data for Company A, they are blocked from accessing data for Company A's competitor, Company B.

3.2 Cryptography and Key Management

Cryptography is the mathematical science of securing information. It provides confidentiality, integrity, authentication, and non-repudiation.

Symmetric Cryptography uses a single shared secret key for both encryption and decryption. Algorithms like AES (Advanced Encryption Standard), DES, 3DES, Blowfish, and Twofish are examples. Symmetric encryption is computationally efficient and suitable for bulk data encryption. However, it suffers from the key distribution problem: secure exchange of the key is difficult over insecure channels.

Asymmetric Cryptography (Public Key Cryptography) uses a mathematically related pair of keys: a public key (widely distributed) and a private key (kept secret).

• Confidentiality: If User A encrypts a message with User B's public key, only User B can decrypt it with their private key.

• Authentication/Non-repudiation: If User A encrypts a message (or its hash) with their private key, anyone can verify it with User A's public key. Since only User A has the private key, this proves the origin.
  Standard asymmetric algorithms include RSA, Elliptic Curve Cryptography (ECC), Diffie-Hellman (used for key exchange), and El Gamal.

Hashing functions (SHA-256, MD5) are one-way mathematical operations that generate a fixed-length string (message digest) from variable-length input. They are used to verify integrity; any change to the input results in a radically different digest.

Digital Signatures combine hashing and asymmetric cryptography. To sign a message, the sender hashes the message and encrypts the hash with their private key. The recipient decrypts the hash with the sender's public key and re-hashes the received message. If the hashes match, integrity and authenticity are verified.

3.3 Physical Security Principles

Physical security is often the first line of defence. It encompasses Crime Prevention Through Environmental Design (CPTED), which uses the physical environment to influence behaviour.

• Perimeter Security: Fences (6-8 feet to deter, higher to prevent), bollards (to stop vehicles), and lighting are critical. Exterior lighting must be designed to eliminate shadows that could hide intruders and to support video surveillance systems.1

• Fire Suppression: Systems are categorised by the agent used.

• Water-based: Sprinklers are standard, but they damage electronics. Wet pipe systems have water in the pipes at all times (risk of freezing/leakage). Dry pipe systems hold water back with air pressure (delay in discharge). Pre-action systems require a secondary trigger (like a smoke detector) before filling the pipes, minimising accidental discharge risks in data centres.

• Gas-based: These systems displace oxygen or interfere with the chemical reaction of fire. Halon was effective but is banned due to ozone depletion. Modern alternatives include FM-200 and Argonite. Safety is a significant concern; gas discharge can asphyxiate humans if not managed correctly.

3.4 System Vulnerabilities

Security engineering must address vulnerabilities across diverse architectures.

• Client-based systems: Vulnerable to web-based attacks, malicious applets, and local user compromise.

• Industrial Control Systems (ICS) / SCADA: These systems control physical infrastructure (power plants, factories). They often run on legacy hardware where availability is the primary concern, making them difficult to patch. Security must focus on network segmentation and strict access control.1

• Internet of Things (IoT): Characterised by low power, low processing capability, and minimal security features. They often lack update mechanisms and use hardcoded credentials, making them easy targets for botnets.1

• Cloud Computing: Introduces shared responsibility models. In SaaS (Software as a Service), the provider manages everything but the data. In IaaS (Infrastructure as a Service), the customer manages the OS and applications while the provider manages the hardware.1