ENGINEERING BLOG

Computer-Security Classifications  * No computer system can be 100% safe, and attempts to make it so can fastly make it not usable. * However one can establish a level of faith to which one feels "safe" using a given computer system for specific security needs. * The U.S. Department of Defense’s "Trusted Computer System Evaluation Criteria" defines four broad levels of faith, and sub-levels in some cases: • Level D is the minimum trustworthy, and incorporate all systems that do not meet any of the more strict criteria. DOS and Windows 3.1 fall into level D, whichhas no user identification or authorization, and anyone who sits down has full process and control over the machine. • Level C1 adds user identification and authorization, and some means of  controlling what users are permited to process what files. It is constructed for use by a group of mostly cooperating users, and describes most common UNIX systems. • Level C2 adds individual-level control and monitoring...

Fire walling to Protect Systems and Networks * Firewalls are devices (or sometimes software) that sits on the border between two securities domains and monitor/log activity between them, sometimes avoiding the traffic that can pass between them based on certain criteria. * For example a firewall router may permit HTTP: requests to pass through to a web server inside a company domain while not allowing telnet, ssh, or other traffic to pass through. * A common architecture is to place a de-militarized zone, DMZ, which arrange of sits "between" the company domain and the outside world, as shown below. Company computers can extend either the DMZ or the outside world, but outside computers can only extend the DMZ. Perhaps most importantly, the DMZ cannot extend any of the other company computers, so even if the DMZ is breached, the attacker cannot get to the balance of the company network. (In some cases the DMZ may have restricted access to company computers, such as a web server...

Implementing Security Defenses Security Policy * A security policy should be well thought-out, agreed upon, and restrained in a living  document that everyone adheres to and is updated as required. * Examples of contents adds how often port scans are run,password requirements, virus detectors, etc. Vulnerability Assessment * Periodically examine the system to detect vulnerabilities. • Port scanning. • Check for bad passwords. • Look for suid programs. • Unauthorized programs in system directories. • Incorrect permission bits set. • Program checksums / digital signatures which have modified. • Unexpected or hidden network daemons. • New entries in start-up scripts, shutdown scripts, cron tables, or other system scripts or configuration files. • New unauthorized accounts. * The government considers a system to be only as guard as its most far-reaching  component. Any system linked to the Internet is inherently less secure than one that is in a sealed room with no external commun...

User Authentication * Protection, dealt with making sure that only certain users were allowed to perform certain tasks, i.e. that a users privileges were dependent on his or her identity. But how does one verify that identity to begin with? Passwords * Passwords are the most common form of user authentication. If the user is in  possession of the correct password, then they are considered to have identified  themselves. * In theory separate passwords could be implemented for separate activities, such as reading this file, writing that file, etc. In practice most systems use one password to confirm user identity, and then authorization is based upon that identification. This is a result of the classic trade-off between security and convenience. Password Vulnerabilities * Passwords can be guessed. • Intelligent guessing requires knowing something about the intended target in specific, or about people and commonly used passwords in general. • Brute-force guessing involves trying ...

Cryptography as a Security Tool * Within a given computer the transmittal of messages is safe, flexible and secure, because the OS knows exactly where each one is coming from and where it is going. * On a network, however, things aren't so straightforward - A rogue computer ( or e-mail sender ) may spoof their identity, and outgoing packets are delivered to a lot of other computers besides their ( intended ) final place, which brings up two big questions of security: •  Trust  - How can the system be sure that the messages received are really from the  source that they say they are, and can that source be trusted? • Confidentiality - How can one ensure that the messages one is sending are  received only by the intended recipient? * Cryptography can help with both of these problems, through a system of secrets and keys. In the former case, the key is kept by the sender, so that the recipient knows that only the authentic author could have sent the message; In the lat...

System and Network Threats * Most of the threats described above are termed program threats, because they attack particular programs or are carried and divided in programs. The threats in this section attack the operating system or the network itself, or leverage those systems to start their attacks. Worms * A worm is a process that uses the fork / spawns process to make copies of itself in order to wreak havoc on a system. Worms consume system resources, often blocking out other,legitimate processes. Worms that spread over networks can be especially problematic, as they can tie up vast amounts of network resources and bring down large-scale systems. * One of the most well-known worms was started by Robert Morris, a graduate student at Cornell, in November 1988. Targeting Sun and VAX computers running BSD UNIX version 4, the worm spanned the Internet in a matter of a few hours, and taken enough resources to bring down many systems. * This worm consisted of two parts: 1. A small program...

Program Threats * There are many familiar threats to modern systems. Only a few are discussed here. Trojan Horse * A Trojan Horse is a program that secretly performs some maliciousness in extra to its visible actions. * Some Trojan horses are deliberately written as such, and others are the result of legitimate programs that have become infected with viruses, (see below.) * One dangerous opening for Trojan horses is long search paths, and in specific paths which include the current directory (“.”) as part of the path. If a dangerous program having the same name as a authorized program (or a common mis-spelling, such as "sl" instead of "ls”) is placed anywhere on the path, then an unsuspecting user may be fooled  into running the wrong program by mistake. * Another classic Trojan Horse is a login imitator, which records a users account name and password, problems a "password incorrect" message, and then logs off the system. The user then tries again (with a prop...

Security The Security Problem * Protection give out with protecting files and other resources from accidental misuse by cooperating users sharing a system, generally using the computer for normal purposes. * Security compact with protecting systems from deliberate attacks, either internal or external, from individuals intentionally attempting to steal information, damage information, or otherwise deliberately wreak havoc in some manner. * Some of the most normal types of violations include: • Breach of Confidentiality - Theft of private or confidential information, such as credit-card numbers, trade secrets, patents, secret formulas, manufacturing  procedures, medical information, financial information, etc. • Breach of Integrity - illegal modification of data, which may have serious indirect outcomes. For example a popular game or other program's source code could be modified to open up security holes on users systems before beingreleased to the public. • Breach of Availability ...

Performance ( Optional ) * The I/O system is a main factor in overall system performance, and can place heavy loads on other main components of the system ( interrupt handling, process switching, bus contention, memory access and CPU load for device drivers just to name a few. ) * Interrupt handling can be relatively costly ( slow ), which causes programmed I/O to be faster than interrupt driven I/O when the time spent busy waiting is not excessive. * Network traffic can also loads a heavy load on the system. Consider for example the sequence of events that occur when a single character is typed in a telnet session, as shown in figure( And the fact that a similar group of events must happen in reverse to echo back the character that was typed. ) Sun uses in-kernel threads for the telnet daemon, improving the supportable number of simultaneous telnet sessions from the hundreds to the thousands.   fig: Intercomputer communications. * Rather systems use front-end processor...