Flashcards
Protection and Security
Cards in this deck (49)
- 1ObjectAn OS is a collection of objects
HARDWARE: such as CPU, printer, memory segments, tape drives)
SOFTWARE: such as files, programs, semaphores - 2DomainCollection of access rights, each of which is an ordered pair
- 3ProtectionObjects in an OS must be protected from each other's activities.
Done so via a mechanism that ensures that only processes/users/programs with correct access rights can perform operations objects such as files, memory segments, CPU - 4WHY Protection -Provides a mechanism for enforcing policies>Preventing intentional violation of access rights by bad users
>Preventing access rights from incompetent users
>Ensure each program uses resources consistent with policies
>Improve reliability by detecting latent errors - 5Protection policies established via:-Being fixed in design of system
-Formulated by manager of the system
-Defined by individual user - 6Diff between policy and mechanismPolicy - decide what will have to be done
Mechanism - Specifies how it will be done - 7Possible operations according to objects:CPU: execute
Memory: read/write
Card reader: read
Data files: create, open, read, write - 8Domain AssociationStatic - set resources allocated to a process that is fixed throughout lifetime
Dynamic - bound to change
E.g. If during phase 1 of an activity, process needs read on an object, and on phase 2, the object requires a write, you would not use a static setting as at any point during the objects life time you will only be using 1 right. Use dynamic so that you are allowed read when you need it and same for write - 9Classifying DomainsUSER: access to object depends on identity which is unique to a user; domain changes when a user logs off and another logs on.
PROCESS: access to objects determine by identity of process. Domain different with each process
PROCEDURES: different domain (switched to) when a different procedure is called - 10Protection PrinciplesLeast Privilege: Every object [process/user] should work with a minimal set of privileges to perform tasks and thus access rights should be obtained upon specific request.
Need To Know: Object [process/user] should be able to access resource only when resource required to complete that task. - 11Access MatrixEntry is a set of access rights for an object within a corresponding domain
E.g
File1 File2
D1 r w
D2 r r - 12Use of Matrix ICOPY - ability to copy access from one domain to another '*'
---> Transfer: when copy, original is removed
----> Limited Copy
SWITCH - ability for one domain to switch to access rights of another domain. So if 'switch' present in D2 column of D1, means D1 has access to rights in both D1 and D2 - 13Use of Matrix IIOWNER - allows addition or removal of rights.
E.g.
F1
D2 write/owner
As D2 is owner in F1, means that it own the F1 column and has rights to add or remove rights all throughout F1 e.g can remove rights in [D3,F1]. - 14Use of Matrix IIICONTROL - suppose we included control access right in . This means a process operation in D2 can modify domain D4 as well.
- 15IMPLEMENTATION Global TableE.g. If operation M [e.g. read] executed in D(i) on O(j):
----> Table is searched for triplet
---->If triplet is found with M as an element, then operation is allowed.
DIS:
>Large table, cannot be in memory and thus requires disk I/O
-Matrix speed is sluggish - 16IMPLEMENTATION Access ListEach object has a list
E.g. File1: <(read, {user1}), (write, {user2, user1})>
E.g.2 For process D(i) accessing Object(j) for operation M:
-> Search for (Di, Rk) in O(j)
->If found with M as element of Rk, then it is OKAY
->If not, M is part of default ELSE error - 17IMPLEMENTATION Capability List IList for domains -> list of objects with operation allowed on objects.
E.g. User1: ((read{file1,file2}),(write{file3,file4}))
To execute operation M:
->Process executes M on the capability pointer for object O(j) as parameter.
->Access allowed if process processes capability for O(J) - 18IMPLEMENTATION Capability List IICapability List is protected by OS
>Maintained by OS and accessed by process indirectly
>Inaccessible by users to prevent modification...if a capability list is secure, the object it protects is also secure - 19IMPLEMENTATION Capability List IIIDistinguishing Capability List
1) TAG associating with each object. TAG must be directly accessible by user. Determines type, accessible data and capability. Has bit representation of 0/1 to know id accessible
2) Split address into two parts: Named address [instruction or data], Capability List [only accessible from OS] - 20Capability lists are usually kept within address space of user. How does the system ensure that the user cannot modify the contents of the list?A capability list is considered a "protected object" and is accessed only directly by the user. The OS ensures the user cannot access the capability list directly
- 21What is main difference between Access and Capability List?Access List for an object lists domains which contain the access rights for the object. Should be appropriate for users, as when user creates an object, the user can define which domain can access it and allowed ops. Revocation east as just have to search through list.
Capability list describes (for each domain) the access rights for each object in that domain. Not appropriate for users but useful to localise a particular process. Revocation is inefficient and capabilities distributed throughout system.
Access is organised by object (column in access matrix) and capability is ordered by domain (row in access matrix) - 22Lock Keys MechanismEach object has a unique list of patterns (locks) and each domain has a unique list of patters (keys). Keys are passed freely between domains. Access rights revoked by changing some locks of an object.
Process in domain Domain(i) can access Object(J) if a key in Domain(i) matches a lock in Object(j) - 23REVOCATION OF RIGHTS OverviewIn dynamic protection sys, sometimes necessary to remove access rights of shared objects
Need to decide if immediate/delayer; permanent/temporary; partial/total etc. - 24REVOCATION OF RIGHTS Access ListSearch for rights to be revoked - delete rights from list. Revocation is immediate. Can be general/selective, total/partial, permanent/temp.
- 25REVOCATION OF RIGHTS Capability List IRequires to locate capability list in system first before capability can be revoked - more difficult as capabilities distributed all over the system, need schemes to do so:
Delete capabilities for a domain periodically. A process can reacquire capability that has been deleted if access is not revoked.
Use list of pointers for each object to all capabilities for the objects. Follow pointers to change capability. - 26REVOCATION OF RIGHTS Capability List I/*More schemes*/
Each capability points to a unique entry in a global table, which in turn points to an object. Search table for desired entry and delete it. Does not allow selective repeat.
Key is unique bit patter associated with each capability. Key is created when capability is created and is not accessible by process. Need master key associated with each object - to revoke, change the master key. Only selective revocation allowed. - 27Why seperate mechanism and policyMechanism and policy must be seperate to ensure that systems are easy to modify.
With mechanism and policy seperate, the policy can be changed at will, while the mechanism stays unchanged. This arrangement provides overall more flexibility. - 28What is the need to know principle and why is it important to adhere to this principle?States that a process should only be allowed access to resources for which it currently needs to complete a task.
By adhering to this concept, damage created by faulty process (via bug or malicious code) is reduced to 'need to know' resources rather than entire set. - 29AD/DIS of ACCESS LISTAD:
-Control comes from storing the access privilege along with each object, allowing object to be easily revoked or easily expand privileges in a localised manner.
DIS:
-Overhead of checking whether requesting domain appears on access list. This check is expensive and needs to be performed every time object is accessed - 30AD/DIS of CAPABILITY LISTAD:
-Provide substantial flexibility and faster access to objects when a domain presents a capability, the system just needs to check authenticity of capability.
-Capabilities can be passed around domains with ease
DIS:
-Flexibility comes at the cost of control; revoking capabilities is difficult, so too is restricting capabilities. - 31SECURITY PROBLEMS What it protects fromSecurity protects from:
-Unauthorised access
-Malicious modification or destruction of code
-Accidental introduction of inconsistency
Easier to protect against accidental than it is malicious. - 32Violations>Confidentiality - unauthorised reading of data
>Integrity - unauthorised modification of data
>Availability - unauthorised destruction of data
>Theft of service - unauthorised use of resources
>Denial of service - prevent use of authorised system - 33BreachesMasquerading - pretending to be someone else and thus use their access rights to access something you don't have rights to
Replay attack - repeat valid data transmission for malicious purpose. Can be repeating on request or mod of request
Man in the middle - located between data communication, pose as legit sender to legit receiver and send to the receiver. The receiver will believe it is from actual sender, and accept
Session Hijacking - intercept a communication session - 34Levels of SecurityPhysical - secure the location of computer system against entry from intruders.
Human - users must be screened so that the chance of authorising a user who then gives access to an intruder is reduced. This also extends to things like being aware of phishing emails.
OS - must be protected against denial of service attacks, stack overflow or data interception on networks - 35AUTHENTICATION User AuthenticationNeed to identify programs and processes that are executing, also need to identify each user.
Can do so with:
User possession - something user has i.e. key card, one time password
User knowledge - something user knows i.e password
User attribute - something user IS e.g. finger print - 36AUTHENTICATION PasswordsUsually need combo of ID and password. Password has faults though - can be guessed, accidentally exposed, etc.
How to guess:
-Know info about user such as obvious info like bdays or spouse names
-Brute force methods: trying all combination of letters, numbers and symbols
-Accidental exposure: using virtual electronic monitoring, writing down password
Can be generated by system (hard to remember) or by user (easy to guess)
To make good password usually involves: changing passwords frequently, using uppercases, numbers, other symbols or using phrases - 37AUTHENTICATION Securing Passwords 'SALT'What is purpose of salt supplied with user password? How is it generated and how is it used?
When user generates password, system generates random number - the salt - and appends it to the user provided password, before encrypting the resulting string and storing encrypted result + salt in PW file.
--> When password check made, password presented by user is concatenated with salt in PW file, then encrypted before checking equality with stored encrypted value.
-->Since salt is different for each user, password cracker cannot check single candidate password - 38AUTHENTICATION Securing Passwords 'One Time'-Password is different in every instance. Use a set of paired password dual verification to protect against password sniffing and shoulder sniffing.
System randomly selects and presents part of password pair as challenge to user. User responds with other part of password. Algorithm used to generate password(s).
>Sys and user share same symmetric password pw and func(pw, challenge)
E.g. Codebook - list of passwords crossed out after each use. - 39PROGRAM THREATS ITrojan Horse - code segment that misuses environment. Exploit mech allows programs written by one user to be executed by another user. E.g text editor may contain code to search for certain keywords in a file, and if file found, can be opened and copied to an area accessible to the creator of the text editor
Trap Door - A hole in the software purposely left by software dev that can only be used by designer. Could be included in compiler. Hard to detect as have to analyse source code for all components. - 40PROGRAM THREATS IILogic Bombs - Security hold created when a predefined condition met e.g. delete all system files when system programmer not employed!
Stack/Buffer overflow - Most common way to attack outside the system. Programmer could neglect to check limit on input fields so attacker can: overflow input buffer until it writes into the stack - there, the attacker can insert code to be executed - 41How to prevent Stack/Buffer Overflow>One method is to prevent execution of code in the stack. There is a CPU option that disables this ability.
>Improve bound checking abilities - 42PROGRAM THREATS IIIVirus
Fragment of code embedded in a legit program. They are designed to infect other computer systems and are self replicating (spread via email, downloading etc)
Some types include:
File - append virus to file
Boot - infect boot sector of the system
Stealth - modify parts of system used to detect it - 43SYSTEM THREATS IAttacks the targets system and the network connections in contrast to a program which compromises computer protection mechanisms. Can help starting program attacks or misuse system/resources
- 44SYSTEM THREATS IIWorms: Structured standalone program designed to propagate itself to other systems - hence taking up resources, slowing performance down and potentially modifying things
Port Scanning: Means for attacker to find vulnerabilities in the system - e.g. automate connect to TCP/IP ports until successful (finding open port)
DDOS: Overload targeted computer system preventing it from doing any useful work. Attacker can disrupt system resources to the point in which it cannot used facility. E.g. SYN flooding attacks - 45List of Inside and Outside attacksInside:
Trojan Horse, Login spoofing, Logic Bomb, Trap door
Outside:
Worms, Viruses , DDOS - 46Diff between worm and virusWorm is a standalone program
Virus code is embedded in another program
Both are equally dangerous - 47SECURITY DEFENCE Security PolicyIncludes statement on what is being secured. Policy is used by users as a guide. Users should know what activities are allowed/what is not allowed and what is required e.g. know not to share passwords
- 48SECURITY DEFENCE Vulnerability AssessmentDetermine if security has been accurately implemented
Covers: risk assessment, penetration testing, vulnerability scans
Check for:
-Easy passwords
-Unauthorised privileged programs
-Unexpected long running processes
-Look at checksums - 49SECURITY DEFENCE Intrusion DetectionDetects attempts to intrude the system
Criteria for intrusion:
>Signature based: checks for known behaviour or patterns that indicate an attack e.g. strings known for viruses
>Anomaly detection: check for anomalous behaviour in the system. Can be used to find day zero attacks
Information
- Description
- Flashcards on Protection and Security, created by Eric Wojcik on 18/06/2018.
- Created by
- Eric Wojcik
- Views
- 0
- Rating