Operating System Security Andy Wang COP 5611 Advanced Operating Systems Outline Introduction Threats Basic security principles Security on a single machine Distributed systems security and data communications security Introduction Security is an engineering problem Always a tradeoff between safety cost and inconvenience Not much solid theory in the field Hard to provide any real guarantees Because making mistakes is easy And the nature of the problem implies that mistakes are always exploited History of Security Problem Originally there was no security problem Later there was a problem but nobody cared Now there are increasing problems and people are beginning to care Automation Action at a distance Technique propagation Fundamental Constraints of Practical Computer Security Security costs If too much it won t be used If it isn t easy it won t be used Misuse often makes security measures useless Fit the stringency of the measure to the threat being countered Security is as Strong as the Weakest Link Those breaking security will attack the weakest point Putting an expensive lock on a cheap door doesn t help much Must look on security problems as part of an integrated system not just a single component Security Threats Extremely wide range of threats From a wide variety of sources Requiring a wide variety of countermeasures Generally countering any threat costs something So people frequently try to counter as few as they can afford Physical Security Some threats involve access to the equipment itself Such as theft destruction tampering Physical threats usually require physical prevention methods Social Engineering and Security Computer security easily subverted by bad human practices E g giving key out over the phone to anyone who asks Social engineering attacks tend to be cheap easy effective So all our work may be for naught A Classification of Threats Viewed as types of attacks on normal service So what is normal service Information Source Information Destination Classification of Threat Types Secrecy Integrity Availability Exclusivity Interruption Information Source Information Destination Interruption Threats Denial of service Prevents source from sending information to receiver Or receiver from sending request to source A threat to availability How Does an Interruption Threat Occur Destruction of HW SW Interference with communications channel Overloading a shared resource Interception Information Source Information Destination Unauthorized Third Party Another Type of Interception Information Source Information Destination Unauthorized Third Party Interception Threats Data or services provided to unauthorized party Either in conjunction with or independent of authorized access A threat to secrecy Also a threat to exclusivity How Do Interception Threats Occur Eavesdropping Masquerading Break ins Illicit data copying Modification Information Source Information Destination Unauthorized Third Party Another Type of Modification Threat 3 Information Source 1 2 Information Destination Unauthorized Third Party Modification Threats Unauthorized parties modify data Either on the way to the users Or permanently at the servers A threat to integrity How Do Modification Threats Occur Interception of data requests Masquerading Illicit access to servers services Fabrication Information Source Information Destination Unauthorized Third Party Fabrication Threats Unauthorized party inserts counterfeit objects into the system Causing improper changes in data Or improper use of system resources A threat of integrity How Do Fabrication Threats Occur Masquerading Bypassing protection measures Duplication of legitimate requests Active Threats vs Passive Threats Passive threats are forms of eavesdropping No modifications injections of requests etc occur Active threats are more aggressive Passive threats are mostly to secrecy Active threats are to availability integrity exclusivity What Are We Protecting Hardware Software Data Communications lines and networks Economic values Basic Security Principles Terms and concepts Mechanisms Security and Protection Security is a policy Protection is a mechanism E g no unauthorized user may access this file E g the system checks user identity against access permissions Protection mechanisms implement security policies Design Principles for Secure Systems Economy Complete mediation Open design Least privilege Least common mechanism Acceptability Fail safe defaults Economy in Security Design Economical to develop And to use Should add little of no overhead Should do only what needs to be done Generally try to keep it simple and small Complete Mediation Apply security on every access to an object that a mechanism is meant to protect E g each read of a file not just the open Does not necessarily require actual checking on each access Open Design Don t rely on security through obscurity Assume all potential intruders know everything about the design And completely understand it Separation of Privileges Provide mechanisms that separate the privileges used for one purpose from those used for another To allow flexibility in the security system E g separate access control on each file Least Privilege Give bare minimum access rights required to complete a task Require another request to perform another type of access E g don t give write permission if he only asked for read Least Common Mechanism Avoid sharing parts of the security mechanism among different users Coupling users leads to possibilities for them to breach the system Acceptability Mechanism must be simple to use Simple enough that people will use it automatically Must rarely or never prevent permissible accesses Fail Safe Designs Default to lack of access So if something goes wrong is forgotten isn t done no security is lost If important mistakes are made you ll find out about them Without loss of security Sharing Security Spectrum No protection Isolation Share all or nothing Share with access limitations Share with dynamic capabilities Important Security Mechanisms Authentication Encryption Passwords Other authentication mechanisms Access control mechanisms Authentication If a system supports more than one user it must be able to tell who s doing what I e all requests to the system must be tagged with user identity Authentication is required to assure system that the tags are valid Encryption Various algorithms can be used to make data unreadable to intruders This process is called encryption Typically
View Full Document
Unlocking...