15 Security.ppt

* * * * * * * * * * * * * * * * * * * * * * * * * * * 15: Security * Jerry Breecher OPERATING SYSTEMS SECURITY 15: Security * SECURITY In This Chapter: ? The Security Problem Program Threats System and Network Threats Cryptography as a Security Tool User Authentication Implementing Security Defenses Firewalling to Protect Systems and Networks Computer-Security Classifications An Example: Windows XP 15: Security * SECURITY SECURITY ISSUES: ? External protection of a system. A classified site goes to extraordinary lengths to keep things physically tight. Among the issues to be considered: Unauthorized access Mechanism assuring only authorized individuals see classified materials. Malicious modification or destruction Accidental introduction of inconsistency. Authentication How do we know the user is who she says she is. Can have passwords on domains. ? Protection of passwords is difficult. Issues include: Its very easy to guess passwords since people use simple and easily remembered words. Need exists to change passwords continually. Limiting number of tries before locking up. 15: Security * SECURITY Security Issues Trojan Horse: A piece of code that misuses its environment. The program seems innocent enough, however when executed, unexpected behavior occurs. Trap Doors: Inserting a method of breaching security in a system. For instance, some secret set of inputs to a program might provide special privileges. Threat monitoring: Look for unusual activity. Once access is gained, how do you identify someone acting in an unusual fashion? Audit Log: Record time, user, and type of access on all objects. Trace problems back to source. Worms Use spawning mechanism; standalone programs. Internet Worm: In the Internet worm, Robert Morse exploited UNIX networking features (remote access) as well as bugs in finger and sendmail programs. Grappling hook program uploaded main worm program. Viruses Fragment of code embedded in a legitimate program. Mainly e