Live briefing
Everything about Capability-based security
Computer safety concept
Capability-based security is a concept in the design of secure computing systems, one of the existing security models. A capability is a communicable, unforgeable token of authority. It refers to a value that references an object along with an associated set of access rights. A user program on a capability-based operating system must use a capability to access an object. Capability-based security refers to the principle of designing user programs such that they directly share capabilities with each other according to the principle of least privilege, and to the operating system infrastructure necessary to make such transactions efficient and secure. Capability-based security is to be contrasted with an approach that uses traditional UNIX permissions and access control lists. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Capability-based securityA 5-minute orientation
- Skim a recent paper: Trust‐aware task load balancing in multi‐access edge computing based on blockchain and a zero trust security capability frameworkInfluential work since 2022
- Pick up a classic book: Modern Operating SystemsThe most-reprinted book on the subject
- Read the landmark paper: A capability-based security approach to manage access control in the Internet of ThingsCited 319 times
- Go sideways: Capsicum (Unix)A closely related topic
- Go sideways: Handle (computing)A closely related topic
📖 Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
A capability-based security approach to manage access control in the Internet of Things
Capability-Based Security Enforcement in Named Data Networking
On security in capability-based systems
Security in a secure capability-based system
Total transfer capability computation using small signal stability-based security constrained optimal power flow
Updating the National Planning Scenarios: Using Wicked Problems and Capability-Based Planning Concepts for Homeland Security
Security Process Capability Model Based on ISO/IEC 15504 Conformant Enterprise SPICE
A Verified Capability-Based Model for Information Flow Security With Dynamic Policies
🆕 Influential since 2022
Trust‐aware task load balancing in multi‐access edge computing based on blockchain and a zero trust security capability framework
Stakeholder Alignment/Capability Based Security Engineering: Capability Engineering vs “Problemeering” and “Solutioneering” – Prioritizing Stakeholder Needs Over Requirements
ANALYSIS OF FOREIGN EXPERIENCE IN CAPABILITY-BASED OPERATIONAL PLANNING OF BORDER SECURITY UNITS OF NATO MEMBER AND PARTNER COUNTRIES
Analysis of Regional Innovation Capability Based on Information Security Data Mining Algorithm
From Education to Food Security: A Capability-Based Perspective on Household Well-being in Indonesia
📚 Books worth reading
Modern Operating SystemsAndrew S. Tanenbaum, Herbert Bos · 1992
Business Information SystemsWitold Abramowicz · 2007
Apache CookbookKen Coar, Rich Bowen · 2003- 📕DefenseUnited States · 2012
- 📕Information technologyUnited States. Dept. of the Treasury. Office of Inspector General · 2001
Immunoassay and Other Bioanalytical TechniquesJeanette M. van Emon · 2006
The U.S. intelligence communityJeffrey Richelson · 1985- 📕Infrared and Raman spectroscopy in forensic scienceJohn M. Chalmers, Howell G. M. Edwards · 2011
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Capsicum (Unix) Capsicum is an implementation of capability-based security for UNIX and similar systems. Presented at USENIX Security Symposium 2010, the system is part…
- Handle (computing) In computer programming, a handle is an abstract reference to a resource that is used when application software references blocks of memory or objects…
- SELinux Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies, including…
- Access-control list In computer security, an access-control list (ACL) is a list of permissions associated with a system resource (object or facility). An ACL specifies which…
- File descriptor In Unix and Unix-like computer operating systems, a file descriptor (FD, less frequently fildes) is a process-unique identifier (handle) for a file or…
- Group identifier In Unix-like systems, multiple users can be put into groups. POSIX and conventional Unix file system permissions are organized into three classes, user…
- Ptrace ptrace is a system call found in Unix and several Unix-like operating systems. By using ptrace (an abbreviation of "process trace") one process can control…
- Unix domain socket A Unix domain socket (UDS), also called a local socket or inter-process communication (IPC) socket, is a communication endpoint used for data exchange…