How User- and Code-IdentityBased Security Systems Complement Each Other

for RuBoard

How User - and Code-Identity “Based Security Systems Complement Each Other

User- and code-identity “based security are not contradictory, mutually exclusive mechanisms for making a computer secure. In fact, code-identity “based security can be seen as a complement to user-identity “based security in a world of highly interconnected computing. Classical user-identity “based security schemes continue to be crucially important for security decisions in organizations where access rights to computing resources need to mirror the roles and responsibilities users have in that organization. Code-identity “based security is therefore not intended to nor likely to replace user-identity “based security. However, as has been shown, user-identity “based security systems alone cannot serve all security administration needs and scenarios. Running all code in a given user context with the same set of access rights does not honor the fact that different applications themselves , not just different users, require trust differentiations due to coming from less or more trusted origins. Code-identity “based security can therefore orthogonally complement user-identity “based security. Code run on behalf of a user is itself subject to further trust limitations depending on its origin. Where code-identity and user-identity security both protect the same resource (that is, Windows Access control and CAS protect the registry), no one security system can typically override the other. For example, managed code can only write into the registry if both the CAS policy system and Windows access control have granted access to the respective registry location. When code is run under both user- and code-identity “based security systems (such as Windows access controls and CAS), the access rights that piece of code possesses is the intersection of the access rights the user identity possesses and the access rights the code's origin elicits. Consequently, user- and code-identity “based security systems complement each other by placing limitations on code depending both on the user the code is run for as well as the origin of the code itself.

NOTE

See Chapter 17 for more information about the interaction about Windows Access protections and CAS.

for RuBoard