Principle of Complete Mediation
The Principle of Complete Mediation is a crucial concept in information security that ensures every access to every resource is checked for proper authorization. This principle guarantees that all attempts to access system resources, whether they are files, databases, or network connections, are mediated by a security mechanism to verify that the access is allowed. This prevents unauthorized access and helps maintain the integrity and confidentiality of the system.
Principle of Complete Mediation
- Consistent Enforcement:
- All access requests, regardless of origin or type, must be checked by the security mechanism. This includes initial access as well as subsequent accesses during a session.
- No Bypassing:
- Ensure there are no alternative paths or shortcuts that bypass the security mechanism. Every access must go through the same rigorous checks.
- Granular Control:
- Access controls should be fine-grained, checking not just at a broad level but also at specific levels, such as individual files, records, or fields.
- Real-Time Verification:
- Security checks should be performed in real-time to ensure that permissions are still valid at the moment of access. This helps in responding to dynamic changes in permissions or user roles.
- Logging and Auditing:
- Every access attempt should be logged and auditable. This helps in tracking unauthorized access attempts and understanding access patterns for security analysis.