Operating system chapter 16
اسلاید 1: 1SecurityChapter 16
اسلاید 2: 2
اسلاید 3: 3Types of ThreatsInterruptionAn asset of the system is destroyed of becomes unavailable or unusableAttack on availabilityDestruction of hardwareCutting of a communication lineDisabling the file management system
اسلاید 4: 4Types of ThreatsInterceptionAn unauthorized party gains access to an assetAttack on confidentialityWiretapping to capture data in a networkIllicit copying of files or programs
اسلاید 5: 5Types of ThreatsModificationAn unauthorized party not only gains access but tampers with an assetAttack on integrityChanging values in a data fileAltering a program so that it performs differentlyModifying the content of messages being transmitted in a network
اسلاید 6: 6Types of ThreatsFabricationAn unauthorized party inserts counterfeit objects into the systemAttack on authenticityInsertion of spurious messages in a networkAddition of records to a file
اسلاید 7: 7Computer System AssetsHardwareThreats include accidental and deliberate damageSoftwareThreats include deletion, alteration, damageBackups of the most recent versions can maintain high availability
اسلاید 8: 8Computer System AssetsDataInvolves filesSecurity concerns fro availability, secrecy, and integrityStatistical analysis can lead to determination of individual information which threatens privacy
اسلاید 9: 9Computer System AssetsCommunication Lines and Networks – Passive AttacksLearn or make use of information from the system but does not affect system resourcesTraffic analysisEncryption masks the contents of what is transferred so even if obtained by someone, they would be unable to extract information
اسلاید 10: 10Computer System AssetsCommunication Lines and Networks – Passive AttacksRelease of message contents for a telephone conversion, an electronic mail message, and a transferred file are subject to these threats
اسلاید 11: 11Computer System AssetsCommunication Lines and Networks – Passive AttacksTraffic analysisEncryption masks the contents of what is transferred so even if obtained by someone, they would be unable to extract information
اسلاید 12: 12Computer System AssetsCommunication Lines and Networks – Active AttacksMasquerade takes place when one entity pretends to be a different entity
اسلاید 13: 13Computer System AssetsCommunication Lines and Networks – Active AttacksReplay involves the passive capture of a data unit and its subsequent retransmission to produce an unauthorized effect
اسلاید 14: 14Computer System AssetsCommunication Lines and Networks – Active AttackModification of messages means that some portion of a legitimate message is altered, or that messages are delayed or reordered, to produce an unauthorized effect
اسلاید 15: 15Computer System AssetsCommunication Lines and Networks – Active AttacksDenial of service prevents or inhibits the normal use or management of communications facilitiesDisable network or overload it with messages
اسلاید 16: 16ProtectionNo protectionSensitive procedures are run at separate timesIsolationEach process operates separately from other processes with no sharing or communication
اسلاید 17: 17ProtectionShare all or share nothingOwner of an object declares it public or privateShare via access limitationOperating system checks the permissibility of each access by a specific user to a specific objectOperating system acts as the guard
اسلاید 18: 18ProtectionShare via dynamic capabilitiesDynamic creation of sharing rights for objectsLimit use of an objectLimit not just access to an object but also the use to which that object may be putExample: a user may be able to derive statistical summaries but not to determine specific data values
اسلاید 19: 19Protection of MemorySecurityCorrect functioning of the various processes that are active
اسلاید 20: 20User-Oriented Access ControlReferred as authenticationLog onRequires both a user identifier (ID) and a passwordSystem only allows users to log on if the ID is known to the system and password associated with the ID is correctUsers can reveal their password to others either intentionally or accidentallyHackers are skillful at guessing passwordsID/password file can be obtained
اسلاید 21: 21Data-Oriented Access ControlAssociated with each user, there can be a profile that specifies permissible operations and file accessesOperating system enforces these rulesDatabase management system controls access to specific records or portions of records
اسلاید 22: 22Access MatrixSubjectAn entity capable of accessing objectsObjectAnything to which access is controlledAccess rightsThe way in which an object is accessed by a subject
اسلاید 23: 23Access Matrix
اسلاید 24: 24Access Control ListMatrix decomposed by columnsFor each object, an access control list gives users and their permitted access rights
اسلاید 25: 25Access Control List
اسلاید 26: 26Capability TicketsDecomposition of access matrix by rowsSpecifies authorized objects and operations for a user
اسلاید 27: 27Capability Tickets
اسلاید 28: 28Intrusion TechniquesObjective of intruder is the gain access to the system or to increase the range of privileges accessible on a systemProtected information that an intruder acquires is a password
اسلاید 29: 29Techniques for Learning PasswordsTry default password used with standard accounts shipped with systemExhaustively try all short passwordsTry words in dictionary or a list of likely passwordsCollect information about users and use these items as passwords
اسلاید 30: 30Techniques for Learning PasswordsTry users’ phone numbers, social security numbers, and room numbersTry all legitimate license plate numbers for this stateUse a Trojan horse to bypass restrictions on accessTap the line between a remote user and the host system
اسلاید 31: 31ID Provides SecurityDetermines whether the user is authorized to gain access to a systemDetermines the privileges accorded to the userSuperuser enables file access protected by the operating systemGuest or anonymous accounts have more limited privileges than othersID is used for discretionary access controlA user may grant permission to files to others by ID
اسلاید 32: 32UNIX Password Scheme
اسلاید 33: 33UNIX Password Scheme
اسلاید 34: 34Password Selection StrategiesComputer generated passwordsUsers have difficulty remembering themNeed to write it downHave history of poor acceptance
اسلاید 35: 35Password Selection StrategiesReactive password checking strategySystem periodically runs its own password cracker to find guessable passwordsSystem cancels passwords that are guessed and notifies userConsumes resources to do thisHacker can use this on their own machine with a copy of the password file
اسلاید 36: 36Password Selection StrategiesProactive password checkerThe system checks at the time of selection if the password is allowableWith guidance from the system users can select memorable passwords that are difficult to guess
اسلاید 37: 37
اسلاید 38: 38Intrusion DetectionAssume the behavior of the intruder differs from the legitimate userStatistical anomaly detectionCollect data related to the behavior of legitimate users over a period of timeStatistical tests are used to determine if the behavior is not legitimate behavior
اسلاید 39: 39Intrusion DetectionRule-based detectionRules are developed to detect deviation from previous usage patternExpert system searches for suspicious behavior
اسلاید 40: 40Intrusion DetectionAudit recordNative audit recordsAll operating systems include accounting software that collects information on user activityDetection-specific audit recordsCollection facility can be implemented that generates audit records containing only that information required by the intrusion detection system
اسلاید 41: 41Malicious ProgramsThose that need a host programFragments of programs that cannot exist independently of some application program, utility, or system programIndependentSelf-contained programs that can be scheduled and run by the operating system
اسلاید 42: 42
اسلاید 43: 43TrapdoorEntry point into a program that allows someone who is aware of trapdoor to gain accessUsed by programmers to debug and test programsAvoids necessary setup and authenticationMethod to activate program if something wrong with authentication procedure
اسلاید 44: 44Logic BombCode embedded in a legitimate program that is set to “explode” when certain conditions are metPresence or absence of certain filesParticular day of the weekParticular user running application
اسلاید 45: 45Trojan HorseUseful program that contains hidden code that when invoked performs some unwanted or harmful functionCan be used to accomplish functions indirectly that an unauthorized user could not accomplish directlyUser may set file permission so everyone has access
اسلاید 46: 46VirusProgram that can “infect” other programs by modifying themModification includes copy of virus programThe infected program can infect other programs
اسلاید 47: 47WormsUse network connections to spread form system to systemElectronic mail facilityA worm mails a copy of itself to other systemsRemote execution capabilityA worm executes a copy of itself on another systemRemote log-in capabilityA worm logs on to a remote system as a user and then uses commands to copy itself from one system to the other
اسلاید 48: 48ZombieProgram that secretly takes over another Internet-attached computerIt uses that computer to launch attacks that are difficult to trace to the zombie’s creator
اسلاید 49: 49Virus StagesDormant phaseVirus is idlePropagation phaseVirus places an identical copy of itself into other programs or into certain system areas on the disk
اسلاید 50: 50Virus StagesTriggering phaseVirus is activated to perform the function for which it was intendedCaused by a variety of system eventsExecution phaseFunction is performed
اسلاید 51: 51Types of VirusesParasiticAttaches itself to executable files and replicatesWhen the infected program is executed, it looks for other executables to infectMemory-residentLodges in main memory as part of a resident system programOnce in memory, it infects every program that executes
اسلاید 52: 52Types of VirusesBoot sectorInfects boot recordSpreads when system is booted from the disk containing the virusStealthDesigned to hide itself form detection by antivirus software
اسلاید 53: 53Types of VirusesPolymorphicMutates with every infection, making detection by the “signature” of the virus impossibleMutation engine creates a random encryption key to encrypt the remainder of the virusThe key is stored with the virus
اسلاید 54: 54Macro VirusesPlatform independentMost infect Microsoft Word documentsInfect documents, not executable portions of codeEasily spread
اسلاید 55: 55Macro VirusesA macro is an executable program embedded in a word processing document or other type of fileAutoexecuting macros in WordAutoexecuteExecutes when Word is startedAutomacroExecutes when defined event occurs such as opening or closing a documentCommand macroExecuted when user invokes a command (e.g., File Save)
اسلاید 56: 56Antivirus ApproachesDetectionIdentificationRemoval
اسلاید 57: 57Generic DecryptionCPU emulatorInstructions in an executable file are interpreted by the emulator rather than the processorVirus signature scannerScan target code looking for known virus signaturesEmulation control moduleControls the execution of the target code
اسلاید 58: 58Digital Immune SystemDeveloped by IBMMotivation has been the rising threat of Internet-based virus propagationIntegrated mail systemsMobile-program system
اسلاید 59: 59
اسلاید 60: 60E-mail VirusActivated when recipient opens the e-mail attachmentActivated by opening an e-mail that contains the virusUses Visual Basic scripting languagePropagates itself to all of the e-mail addresses known to the infected host
اسلاید 61: 61Trusted SystemsMultilevel securityInformation organized into levelsNo read upOnly read objects of a less or equal security levelNo write downOnly write objects of greater or equal security level
اسلاید 62: 62
اسلاید 63: 63Trojan Horse Defense
اسلاید 64: 64Trojan Horse Defense
اسلاید 65: 65Trojan Horse Defense
اسلاید 66: 66Trojan Horse Defense
اسلاید 67: 67Windows 2000 SecurityAccess Control SchemeName/passwordAccess token associated with each process object indicating privileges associated with a user
اسلاید 68: 68Access TokenSecurity IDIdentifies a user uniquely across all the machines on the network (logon name)Group SIDsList of the groups to which this user belongsPrivilegesList of security-sensitive system services that this user may call
اسلاید 69: 69Access tokenDefault ownerIf this process creates another object, this field specifies who is the ownerDefault ACLInitial list of protections applied to the objects that the user creates
اسلاید 70: 70Security DescriptorFlagsDefines type and contents of a security descriptorOwnerOwner of the object can generally perform any action on the security descriptorSystem Access Control List (SACL)Specifies what kinds of operations on the object should generate audit messagesDiscretionary Access Control List (DACL)Determines which users and groups can access this object for which operations
اسلاید 71: 71
نقد و بررسی ها
هیچ نظری برای این پاورپوینت نوشته نشده است.