Computer Security U8 - Windows 2000 Security

Computer Security U8 - Windows 2000 Security

1. Introduction

   • Memory & Privilege levels
     • linear 32-bit (4GB) address space
   • Object-based security
     • Securable objects
     • Active Directory
       • objects with attributes
   • programs
     • processes
       • threads

2. Basic concepts

   • Principals
     • Security principals
       • Security Identifiers (SIDs)
     • groups
       • security
       • e-mail distribution
   • Objects
     • instance of a class
   • Classes
   • Object Handler
     • controls objects
       • kernel objects
       • executive obejcts

3. Active Directory

   • secure, distributed, scalable & replicated hierarchical directory service
   • integrates DNS
   • single point of admin (incl. security)
   • Objects
     • GUID
     • schema
     • container
       • can hold other objects
         • e.g. directory
     • leaf
   • Names
     • security principal
       • SIDs
         • LDAP Distinguished Name (DN)
           • Relative DN (RDN)
           • canonical
             • GUID

4. Domains & Organizational Units

   • domain controller
   • member server
   • organizational unit
     • organize and contain AD objects
   • Trust relationships
     • domain tree
       • domains with common schema/configuration
     • domain forest
       • trees with common schema
       • not a contiguous namespace in AD
     • managed domains
   • Domain models
     • single
     • master
     • multiple master
     • complete trust

5. Authentication

   • ID verification
   • interactive logon
     • network authentication
   • SAS
   • GINA DLL
     • Local Security Authority (LSA)
   • Kerberos
     • Key Dist. Centre (KDC)
       • ticket-granting ticket (TGT)
         • ticket-granting service (TGS)
     • Single Sign-On (SSO)

6. Access Control

   • DACL
   • object handles
     • handle table
       • 28-bit pointer to object header
       • 32-bit access mask
         • handle file entries
           • access control entires
             • access requests
         • generic access rights
           • (R)ead
             • (W)rite
               • (X)ecute
                 • (A)ll
       • 4 flags: (L)ock (A)udit (P)rotect (I)nherit
   • Control Access Rights
     • extended
     • property sets
     • validated writes
   • privilege
     • take-ownership
   • Impersonation
     • Principle of Least Privilege
   • Access Tokns
     • primary
     • LSA
   • Security Descriptor
     • control flags
       • owner
         • primary group
           • DACL
             • SACL
   • AC Entries
     • Access-denied
       • Access-allowed
         • System-audit

7. Security Management & Audit

   • Security Configuration Tool Set (SCTS)
   • Group Policy Objects (GPOs)
   • Audit
     • detect behaviour that violates policy
     • analyse security breaches
     • provide evidence for prosecution