02-02-2013, 10:39 AM
OPERATING SYSTEM / OS AND SECURITY
1OPERATING SYSTEM.pdf (Size: 85.39 KB / Downloads: 41)
OS and Security
Computers, with their ubiquitous presence, have ceased to be a wonder they once were.
Their usage is pervasive. Information access and delivery from, and to, a remote location
via internet is common. Today many societal services like railway time-table or election
results are rendered through computers. The notion of electronic commerce has given
fillip to provisioning commercial services as well. Most individuals use computers to
store private information at home and critical professional information at work. They also
use computers to access information from other computers anywhere on the net. In this
kind of scenario, information is the key resource and needs to be protected.
The OS, being the system's resource regulator, must provide for security mechanisms. It
must not only secure the information to protect the privacy but also prevent misuse of
system resources. Unix designers had aimed to support large-scale program development
and team work. The main plank of design was flexibility and support tools. The idea was
to promote creation of large programs through cooperative team efforts. All this was long
before 9/11. Security has become a bigger issue now. Much of Unix provisioning of
services was with the premise that there are hardly, if any, abuses of system. So, Unix
leaves much to be desired in respect of security. And yet, Unix has the flexibility to
augment mechanisms that primarily protect users resources like files and programs. Unix
incorporates security through two mechanisms, user authentication and access control.
We shall elaborate on both these aspects and study what could be adequate security
measures. We begin with some known security breaches. That helps to put security
measures in proper perspective.
Security Breaches
We first need to comprehend the types of security breaches that may happen. Breaches
may happen with malicious intent or may be initiated by users inadvertently, or
accidentally. They may end up committing a security breach through a mis-typed
command or ill understood interpretation of some command. In both these instances the
OS must protect the interest of legitimate users of the system. Unix also does not rule out
a malicious access with the intent to abuse the system. It is well known that former
disgruntled employees often attempt access to systems to inflict damages or simply
corrupt some critical information.
Examples of Security Breaches
Here we shall discuss a few well known attacks that have happened and have been
recorded. Study of these examples helps us to understand how security holes get created.
Besides, it helps us to determine strategies to plug security holes as they manifest. Next
we describe a few attack scenarios. Not all of these scenarios can be handled by OS
control mechanisms. Nonetheless, it is very revealing to see how the attacks happen.
Logic Bomb: A logic bomb is usually a set-up like the login spoof described
earlier. The attacker sets it up to go off when some conditions combine to happen.
It may be long after the attacker (a disgruntled employee for instance) has quit the
organization. This may leave no trail. Suppose we use an editor that allows setting
of parameters to OS shell, the command interpreter. Now suppose one sets up a
Unix command rm *.* and puts it in a file called EditMe and sends it over to the
system administrator. If the system administrator opens the file and tries to edit
the file, it may actually remove all the files unless he opens it in a secure
environment.
User Authentication
First let us consider how a legitimate user establishes his identity to the system to access
permitted resources. This is achieved typically by username/password pair. When the
system finishes booting, the user is prompted for a username and then a password in
succession. The password typed is not echoed to the screen for obvious reasons. Once the
password is verified the user is given an interactive shell from where he can start issuing
commands to the system. Clearly, choosing a clever password is important. Too simple a
password would be an easy give away and too complex would be hard to remember.