Reference monitor

A reference monitor is an abstract machine that mediates all access by subjects to objects, checking each request against the security policy and permitting it only if the policy allows. A subject is the active party, a user or a process; an object is the passive party, a file, a device or a region of memory. The concept comes from James P. Anderson’s Computer Security Technology Planning Study (ESD-TR-73-51, 1972) and it states a requirement rather than a design, which is why it has outlasted every architecture built to satisfy it.

Three properties must hold together. It must provide complete mediation, meaning it is always invoked and no path reaches an object around it. It must be tamper-proof, meaning it is protected inside the boundary it guards. And it must be verifiable, meaning small and simple enough for its correctness to be demonstrated rather than assumed. That third property is the link to the size of the trusted computing base. The concept is realised in running code by the security kernel, and the rules it checks against are the security policy, whether those come from labels under mandatory access control or from an access control list.

Exam relevance: a scenario describing something checked on every single access points to the reference monitor. Options that describe it as a specific product, or as a control that distinguishes malicious code from benign, tend to be distractors: it evaluates subjects against policy and has no view on intent.