Basic Resource Protection - created from Mind Map

Seite 1

to ensure that each object is accessed correctly and those processes that are allowed to do so

Access Control

internal protection mechanism

seen in CPU instructions that may only be executed in supervisor mode

Access Matrix

view protection as matrix

rows - domains

column - objects

Access (i,j) is a set of operations that process executing in Domain(i) can invoke on Object(j)

CPU and Memory Protection

in multi-programming environment, protection of CPU and main memory is important

Privileged User

privileged is the right to execute a system call

user that has been allocated powers within the computer system

ex: System and Network Admin

Objects

resources in system that need access control

ex: hardware devices, data files

Subjects

active entities in the system that access objects

ex: user processes

Rights

operations such as enable, disable, read, write, execute on objects

Buffer Overflow Protection

an anomaly where a program overrun buffer boundary and overwrite adjacent memory

BO resulting from a conceptual flaw in C or C++ programming

BO protection is used to detect the most common BO by checking stack has not been altered.

if altered, program exit with segmentation fault

Data Execution Protection

intended to prevent app or service from executing code from a non-executable memory

help prevent certain exploits that store code via buffer overflow

hardware enforced DEP for CPU that can mark memory pages as non-executable

software-enforced DEP with a limited prevention for CPUs with no hardware support

Kernel Patch Protection

practice of using unsupported mechanisms to modify or replace kernel code

KPP monitor if key resources used by kernel has been modified. If it was modified, system shutdown is initiated

Use Safe Libraries

avoid using standard library functions which are not bounds checked

Use canaries

known value that are placed between buffer and control data to monitor BO

canary will be corrupted first when BO occurs

Superuser

Roles Based Access Control (RBAC)

same as program that ran as root

anyone that become superuser can modify firewall, read secret records and shut entire network

Roles Based Access Control (RBAC)

better alternative than superuser model

secure principal of least privilege - user has precisely the amount of privilege to do a job