8.2 Windows Sec

8.2 Windows Sec

1. Memory and Privilege levels

   • Application code runs in user mode
     • User mode uses privilege mode 3
       • When a user mode application calls a system service the processor traps the call and switches the calling process to kernel mode
   • Operating system code runs in kernel mode
     • In this mode processes have full access to system memory and cpu instructions
       • Kernel mode uses privilege level 0 (most privileged)
   • Most OS and Driver code share the same kernel
     • So any OS code or driver can corrupt data being used by other components
     • Driver signing was introduced to ensure 3rd party drivers are safe and to protect users from malicious drivers

2. Object Based Security

   • Windows implements fine grained access control for all objects contained in active directory
   • Securable objects (files, user objects, reg keys) have a security descriptor that contains security attributes
     • Probably the most important security attribute of a securable object is its discretionary access control list that controls the users and groups that can access it
   • Active directory provides a repository for information about Windows objects, apps, files, printers etc
     • AD entities are objects with attributes.
       • User object will have an e-mail address attribute etc

3. Architecture

   • See page 4. explanations in Moodle

4. Programs, processors and threads

   • Program = static sequence of instructions to be executed by the processor
   • Process = set of resources that enable a program to be executed
     • Process threads
       • entity within windows that actually cause the instructions to be executed
       • Include - contents of a set of CPU registers, kernel mode and user mode stack, thread identifier and a security context
         • The security context of a thread will be the access token of a parent process