HOME WORK # 4
REVIEW QUESTIONS
4.4 In the context of access control, what is the difference between a subject and object.
A subject is an entity capable of accessing objects (eg. user, application, process). A subject is typically held accountable for the actions they have initiated, and an audit trail may be used to record the association of a subject with security relevant actions performed on an object by the subject.
An object is resource to which access is controlled. An object is an entity used to contain information. Any user or application actually gains access to an object by means of a process that represents that user or application. The process takes on the attributes of the user, such as access rights. In general, object is an entity used to contain and or receive information. Examples include records, blocks, pages. Segments, files, portion of files, directories, directory trees, mail boxes, messages and programs.

4.9 List and briefly define the four types of entities in a base model RBAC system.
*USER: An individual that has access to this computer system. Each individual has an associated user ID.
*ROLE: A named job function within the organization that controls this computer system.
*PERMISSION: An approval of a particular mode of access to one or more objects.
*SESSION: A mapping between a user and an activated subset of the set of roles to which the user is assigned.

PROBLEM: 4.8 Assume a system with N job positions. For job position I, the number of individual users on that position is Ui, and the number of permissions required for the job positions is Pi,
a. For a traditional DAC scheme, How many relationships between users and permissions must be defined?
b. For a RBAC scheme, how many relationships between users and permissions must be