📖 What is Reference Monitor?
The Reference Monitor is an abstract machine that mediates all access to objects by subjects based on a defined security policy. To be effective, it must be tamper-proof, always invoked, and small enough to be subjected to rigorous analysis and testing.
"Memorize the three requirements: tamper-proof, always invoked, and verifiable. These are high-probability test points for the Security Architecture domain."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Reference Monitor?
- ▸ The Reference Monitor is an abstract conceptual model, whereas the Security Kernel is the actual hardware and software implementation that realizes this model.
- ▸ Tamper-proof design ensures that the mediation mechanism cannot be modified or disabled by unauthorized users or malicious processes to bypass security controls.
- ▸ Complete mediation requires that the monitor is always invoked for every single access attempt, ensuring no request ever bypasses the security policy check.
- ▸ Verifiability means the mechanism must be small and simple enough to be rigorously analyzed, tested, or mathematically proven to be correct and secure.
- ▸ It functions as the central mediator between subjects, such as users or processes, and objects, such as files or memory segments, using security policies.
🎯 How does Reference Monitor appear on the CISSP Exam?
You may be asked to distinguish between the Reference Monitor and the Security Kernel; remember that the Reference Monitor is the theoretical model, while the Security Kernel is the actual physical implementation.
A scenario might describe a system where a user can bypass a security check after the initial authentication, requiring you to identify this as a failure of the 'always invoked' or complete mediation requirement.
Expect questions where you must evaluate a security module's effectiveness based on its complexity, testing your understanding that a monitor must be small and simple enough to be rigorously verified.
❓ Frequently Asked Questions
How does the Reference Monitor relate to the concept of 'Complete Mediation'?
Complete mediation is one of the three core requirements of a Reference Monitor. It ensures that every access to every object is checked, leaving no gaps or shortcuts for unauthorized access.
Can a modern operating system truly implement a perfect Reference Monitor?
In practice, most monolithic OS kernels are too large to be fully verified. However, microkernel architectures attempt to achieve this by moving as much functionality as possible out of the kernel.