Презентация на тему Security. The goal

good enough that bad guys don’t break in very

often.
Police and courts good enough that bad guys that do break in get caught and punished often enough.
Less interference with daily life than value of loss.
Security is expensive—buy only what you need.

do?
Mechanism: Implementing security How does it do it?
Assurance: Correctness of

security Does it really work?

of money
Theft of information
Loss of privacy


integrity
availability
integrity
secrecy
secrecy

people giving instructions to good programs
Bad guy interfering with

communications

out
Code signing, firewalls
Let him in, but keep him from

doing damage
Sandboxing, access control
Catch him and prosecute him
Auditing, police

resources.




Reference
monitor
Object
Do
operation
Resource



Principal
Guard
Request
Source

servers, programs
Authorizing access.
Usually for groups of principals
Auditing


Assurance
Trusted computing

base

to work to ensure security
Ideally, TCB is small and

simple
Includes hardware and software
Also includes configuration, usually overlooked
What software has privileges
Database of users, passwords, privileges, groups
Network information (trusted hosts, …)
Access controls on system resources
. . .
The unavoidable price of reliability is simplicity.—Hoare

friends, others
Three places to put objects
Everything else done automatically

with policies
Administrators—keep it simple
Work by defining policies. Examples:
Each user has a private home folder
Each user belongs to one workgroup with a private folder
System folders contain vendor-approved releases
All executable programs are signed by a trusted party
Today’s systems don’t support this very well

with sandboxing
Basic OS (such as NT)
Higher-level OS (such as

Java)
Application that checks authorization directly

All need authentication

buy it:
Danger is small, so it’s OK to buy

features instead.
Security is expensive.
Configuring security is a lot of work.
Secure systems do less because they’re older.
Security is a pain.
It stops you from doing things.
Users have to authenticate themselves.

B. Systems are complicated, so they have bugs.

(without proof)
Authenticate user by local password
Assign local user and

group SIDs
Access control by ACLs: lists of SIDs and permissions
Reference monitor is the OS, or any RPC target
Domains: same, but authenticate by RPC to controller
Web servers: same, but simplified
Establish secure channel with SSL
Authenticate user by local password (or certificate)
ACL on right to enter, or on user’s private state