PrepAway - Latest Free Exam Questions & Answers

How is polyinstantiation used to secure a multilevel database?

How is polyinstantiation used to secure a multilevel database?

PrepAway - Latest Free Exam Questions & Answers

A.
It prevents low-level database users from inferring the existence of higher level data.

B.
It confirms that all constrained data items within the system conform to integrity specifications.

C.
It ensures that all mechanism in a system are responsible for enforcing the database security
policy.

D.
Two operations at the same layer will conflict if they operate on the same data item and at least
one of them is an update.

Explanation:
“Polyinstantiation is the development of a detailed version of an object from another object using
different values in the new object. In the database information security, this term is concerned with
the same primary key for different relations at different classification levels being stored in the same
database. For example, in a relational database, the same of a military unit may be classified Secret
in the database and may have an identification number as the primary key. If another user at a lower
classification level attempts to create a confidential entry for another military unit using the same
identification number as a primary key, a rejection of this attempt would imply to the lower level
user that the same identification number existed at a higher level of classification. To avoid this
inference channel of information, the lower level user would be issued the same identification
number for their unit and the database management system would manage this situation where the
same primary key was used for different units.” Pg 352-353 Krutz: The CISSP Prep Guide: Gold
Edition. “Polyinstantiation occurs when to or more rows in the same table appear to have identical
primary key elements but contain different data for use at differing classification levels.
Polyinstantiation is often used as a defense against some types of inference attacks. For example,
consider a database table containing the location of various naval ships on patrol. Normally, this
database contains the exact position of each ship stored at the level with secret classification.
However, on particular ship, the USS UpToNoGood, is on an undercover mission to a top-secret
location. Military commanders do not want anyone to know that the ship deviated from its normal
patrol. If the database administrators simply change the classification of the UpToNoGood’s location
to top secret, a user with secret clearance would know that something unusual was going on when
they couldn’t query the location of the ship. However, if polyinstantiation is used, two records could
be inserted into the table. The first one, classified at the top secret level, would reflect the true
location of the ship and be available only to users with the appropriate top secret security clearance.
The second record, classified at the secret level, would indicate that the ship was on routine patrol
and would be returned to users with a secret clearance.” Pg. 191 Tittel: CISSP Study Guide Second
Edition


Leave a Reply