8.3 WinSec Basic Concepts

8.3 WinSec Basic Concepts

1. Principles

   • AD uses user / computer accounts and groups, these are its security principles which are all assigned unique Security Identifiers SID's
     • User and computer accounts are used to authenticate access to domain resources
       • Each user has a unique username and password for authentication
       • Each computer has its own unique account that monitors access to domain resources
   • Group accounts represent groups of users or computers
     • Two group types, security groups and e-mail groups
       • Security groups has a SID that controls access to objects by members of the group
       • E-mail Groups are not security enabled

2. Objects

   • In the context of object oriented computer programming an object is an instance of a class
     • Idea of a class is to encapsulate the characteristics of a particular set of entities
       • EG: a class called Vehicle, includes wheels and speed.
       • New classes extend the original class by adding additional attributes
   • In Object oriented programming it is common to have a hierachy
     • Classes are derived from ones higher up the hierarchy
       • The advantage is that high level functions that apply to all objects can be defined at a high level providing a consistent approach to all objects lower down the hierarchy

3. Classes

   • Abstract and auxilary classes are building blocks for structural classes
     • A structural class inherits all the attributes of an abstract class and some of the attributes of an auxilary class
   • All AD objects are instances of structural classes

4. Object handler

   • Controls objects (processes, threads, jobs) in an access control sense
     • Object manager provides a single interface to system resources and isolates object protection
   • 2 Kinds of object
     • Kernel Objects, implemented by the kernel
       • not visible to user mode code
     • executive objects implemented by executive components such as NTFS and process manager
       • These are exposed to user mode code, include files, processes ,threads and tokens
     • Every object has a header, body and a type
       • Object headers are controlled by the object manager
         • Object headers contain objects name and security descriptor
           • Informatin in the header is used by the object manager to control access to the object
       • Object bodies are controlled by the relevant executive component