We present an implementation of mandatory access control for Linux network communications that restricts socket access to labelled IPSec security associations. The Linux Security Modules (LSM) framework defines a reference monitor interface that enables security modules (e.g., SELinux) to enforce comprehensive mandatory access control (MAC) for Linux version 2.6. The current LSM control over ne...

In this paper, we present an enhanced use of RBAC features in articulating a security policy for access control in medical database systems. The main advantage of this implementation is that it supports both MAC and DAC features at the same time; a feature that has been proved to be necessary in healthcare environments. The eMEDAC security policy that results from the above implementation provi...

This article presents a novel approach to confidentiality violation detection based on taint marking. Information flows are dynamically tracked between applications and objects of the operating system such as files, processes and sockets. A confidentiality policy is defined by labelling sensitive information and defining which information may leave the local system through network exchanges. Fu...

In this paper, we present an approach for verifying that trusted programs correctly enforce system security goals when deployed. A trusted program is trusted to only perform safe operations despite have the authority to perform unsafe operations; for example, initialization programs, administrative programs, root network daemons, etc. Currently, these programs are trusted without concrete justi...

In a market where consumers are not fully informed about the actual production technology or environmental performance of firms that engage in strategic competition, I study the effect of environmental consciousness of consumers on the incentive to invest in cleaner technology. Firms compete in prices and may signal their environmental performance to uninformed consumers through prices. I also ...

The paper analyzes the welfare implications of mandatory disclosure of losses at financial institutions when it is common knowledge that some banks have incurred losses but not which ones. We develop a model that features “contagion,” meaning that banks not hit by shocks may still suffer losses because of their exposure to banks that are. In addition, banks in our model have profitable investme...

While theory suggests that information programs may correct market failures and improve welfare, the empirical impacts of these policies remain undetermined. We show that mandatory disclosure programs in the electricity industry achieve stated policy goals. We find that the proportion of fossil fuels decreases, and the proportion of clean fuels increases in response to disclosure programs. Howe...

We analyze amodel in which firms are able to acquire information about product risks and may or may not be required to disclose this information. We initially study the effect of disclosure rules assuming that firms are not liable for the harm caused by their products. Mandatory disclosure is obviously superior to voluntary disclosure given the information about product risks that firms possess...

This study examines the e ect of increased product information to consumers on rm behavior. In 1998, Los Angeles County introduced hygiene quality grade cards to be displayed in restaurant windows. This regulatory change provides exogenous variation in whether rms are subject to voluntary disclosure (of hygiene quality) without a standard-format, voluntary disclosure with a standard-format or m...

Which budgetary institutions result in efficient provision of public goods? We analyze a model with two parties bargaining over the allocation to a public good each period. Parties place different values on the public good, and these values may change over time. We focus on budgetary institutions that determine the rules governing feasible allocations to mandatory and discretionary spending pro...