61417_CH03_Smith.

fm Page 91 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

CONTROLLING FILES C HA P T E R

© Jones & Bartlett Learning, LLC

NOT FOR SALE OR DISTRIBUTION
3
© Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOTABOUT
FOR SALE
THIS OR DISTRIBUTION
CHAPTER NOT FOR SALE OR DISTRIBUTION

In this chapter, we look at access control mechanisms used to protect larger-scale

resources like files and folders. The chapter focuses on these topics:
© Jones & Bartlett •Learning,
Overview ofLLCfile system technology © Jones & Bartlett Learning, LLC
NOT FOR SALE OR• DISTRIBUTION
Structure of executable files and virusesNOT FOR SALE OR DISTRIBUTION
• Goals and basic policies for file protection and sharing
• File security controls based on “permission flags”

3.1 The © Jones

File & Bartlett Learning, LLC
System © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Data sharing poses a problem: If people can look at some information on a computer,
how do we prevent them from seeing all the information? This is the same problem as
RAM protection in Chapter 2. If any user can modify any information inside the com-
© Jones
puter, &weBartlett Learning,
can’t prevent users fromLLCreaching any of its contents. © Jones & Bartlett Learning, LLC
NOT FOR SALE
For most ORtheir
people, DISTRIBUTION
most important information assets reside NOTinFOR SALE
their files. OR DISTRIBUTION
Modern
file systems keep the hard drive organized and give us a way to reliably locate and save
our data.
All modern systems use a hierarchical directory to organize files into groups. The
directory forms an inverted tree growing from the topmost directory, called the root
© Jones & Bartlett Learning,
directory . Many LLC ©file
users think of files as living in Jones
folders&instead
Bartlett Learning,
of directories. LLC
In prac-
NOT FOR SALE OR tice, DISTRIBUTION
we use the terms interchangeably. NOT FOR SALE OR DISTRIBUTION
On Microsoft Windows, each drive has its own directory, starting at its own root.
Figure 3.1 shows the root folder for a Windows system drive. We can tell it’s the root
because the “Address” field of the window only contains the drive letter (“C:\”) and no
other names. © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
On Unix-based systems, the system
NOT FOR SALE OR DISTRIBUTION drive provides the root. The directories on all FOR SALE OR DISTRIBUT
NOT
other drives appear beneath it in the hierarchy. In OS-X, there is a Volumes subdirectory
that leads to the directories for individual drives.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

91
© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 92 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
92 CHAPTER 3 | Controlling Files

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

Figure 3.1
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
Root directory folder on Windows drive C:\.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
When we click on a folder icon within a folder on our desktop, we go “down” a level
in the directory hierarchy (Figure 3.2). On Windows, the “Address” field contains the
directory’s name following the “\” character.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
DIRECTORY PATH AND FILE NAMES NOT FOR SALE OR DISTRIBUTION
Each file on a hard drive has a unique identifier made of the file’s name and the list of
directories leading to it. If a file is in the root directory, then we don’t need a directory
name to find it. All we need is the “\” character, which by itself indicates the root direc-
tory. In Figure 3.1, we see a file named “[Link]” in the root directory. The file’s entire
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
name consists of the drive letter, a “\” character, and the file name:
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
C:\[Link]

If the file is in a subdirectory, then we need both the name and the directory path,
which leads us to the file’s directory starting from the root directory. We see from Figure
© Jones & Bartlett Learning,
3.2 that there LLC
is also a file © Jones &directory.
named “[Link]” in the “downloads” BartlettTo Learning,
choose LLC
NOT FOR SALE
this file,OR DISTRIBUTION
instead NOT FOR
of the one in the root directory, we include SALE
the path to its OR DISTRIBUTION
directory:
C:\downloads\[Link]

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 93 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.1 The File System 93

Controlling Files
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

Figure 3.2
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOTThe
FOR“downloads”
SALE OR subdirectory.
DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
If the file resides in a directory within the “downloads” directory, then we must
include that directory in the path. Each directory name is separated by a “\” and they
occur in order starting from the root directory. Not all systems use the same character to
© Jones & Bartlett Learning,
separate directoryLLC © Jonesused
names; Table 3.1 lists the commonly & Bartlett Learning, LLC
characters.
NOT FOR SALE ORFile DISTRIBUTION
systems, like operating systems, mostlyNOT FOR
fall into SALE
either OR
of two DISTRIBUTION
categories: Win-
dows systems and Unix-based systems. Apple’s Macintosh OS-X is based on a version of
Unix, but it uses a distinctive file system. Unless otherwise noted, like in Table 3.1,
OS-X has the features of a Unix-based system.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
TABLE 3.1 File and directory name formats
System Separator Character Example File Name with Path

Macintosh Colon : Mac:downloads:[Link]

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALEsystems
Other Unix-like OR DISTRIBUTION
Slash / NOT FOR SALE OR DISTRIBUTION
/downloads/[Link]

Windows and MS-DOS Back slash \ C:\downloads\[Link]

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 94 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
94 CHAPTER 3 | Controlling Files

3.1.1 File Ownership

© Jones & Bartlett and AccessLLC
Learning, Rights © Jones & Bartlett Learning, LL
NOT
Bob hasFOR
decidedSALE
to shareOR DISTRIBUTION
his tower NOTthe
computer with his suitemates. He has activated FOR
loginSALE OR DISTRIBUT
mechanism and constructed three logins: an administrator (“superbob”), one for his school-
work (“bob”), and one for his suitemates (“suitemates”). He established a password for the
first two accounts. The third account doesn’t need a password. Any suite mate or guest may
walk up to the computer and click on the “suitemates” name to log in.
© Jones & Bartlett Learning,
Bob has just typed upLLC © saved
an essay for his English class. He Jonesit on&theBartlett
hard [Link],
How LLC
NOT FOR SALE
can he OR DISTRIBUTION
protect it from injury by his suitemates? NOT FOR SALE OR DISTRIBUTION
Even though Bob shares the computer with his suitemates, he still needs to protect his
files. Some desktop operating systems allow us to run without the apparent need for
user identities or file protection, but most modern systems have those features built in.
© Jones & Bartlett Learning,
In olderLLC
systems, we need to activate©multiuser
Jones features
& Bartlett Learning,
before we can use LLC
them. Once
Bob
NOT FOR SALE OR DISTRIBUTION activated user identities, he needs to protect his files.
NOT FOR SALE OR DISTRIBUTION
Modern operating systems protect files according to user identity. When Bob logs in
as “bob” and presents his secret password, the system starts up a graphical interface
process so Bob can run programs and use his files (Figure 3.3).
The system associates Bob’s user identity with the processes he runs. When he edits
an© Jones
essay & Bartlett
for English Learning,
class, the LLC takes on his user identity.
word processor © Jones & Bartlett Learning, LL
It then creates
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
and modifies his files on his behalf. Since Bob created his essay file, the system naturally
grants him access rights to the file.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Inside Bob’s
Login Process
Computer
Owner: System

© Jones & Bartlett Learning,

Bob logsLLC
in and starts © Jones & Bartlett Learning, LLC
GUI Process
the word processor.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Owner: Bob

RW-

© Jones & Bartlett Learning,

Bob’sLLC © Jones & Bartlett Learning, LL
Word-Processing
Essay Process
NOT FOR SALE OR DISTRIBUTION
Owner: Bob Owner: Bob
NOT FOR SALE OR DISTRIBUT

Figure 3.3
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
Bob’s processes inherit his identity and access rights.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 95 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.1 The File System 95

Controlling Files
FILE ACCESS©RIGHTS
Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
When we looked
NOTatFORRAMSALE
access in
ORChapter 2, we focused on “read” and “write”
DISTRIBUTION NOT access
FOR SALE OR DISTRIBUT
permissions. An operating system provides four access rights for files and most other
resources:
• Create a new instance of the resource (for example, a new file).
© Jones & Bartlett
• Read Learning,
the contents LLC resource.
of a particular © Jones & Bartlett Learning, LLC
NOT FOR SALE
• Update OR DISTRIBUTION
or “write” or “modify” a particular resource. NOT FOR SALE OR DISTRIBUTION
• Delete or destroy an existing resource.
The names of these four rights form the acronym CRUD. While the four rights also
may apply to RAM and processes, it’s more common for programs to apply them to
© Jones & Bartlett Learning,
files. LLCtries to create or use a file,
When a process © Jones
it inherits&whatever
Bartlettrights
Learning,
belong toLLC
the
NOT FOR SALE OR user DISTRIBUTION
who started the process. NOT FOR SALE OR DISTRIBUTION
Some systems also provide a right to append to a file; that is, add data to the end of
the file without reading its contents. There also may be an execute right that we will
examine later.

INITIAL FILE P©ROTECTION

Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT
A modern personal computer easily may contain hundreds of thousands of files. ThisFOR SALE OR DISTRIBUT
multitude poses a real problem: How do we establish protections for all of them? It’s
not practical to set permissions individually. The system has to apply the correct permis-
sions automatically whenever a user creates a new file or directory. Systems tend to
© Jones & Bartlett
implement either of Learning, LLCto apply initial access rights:
two mechanisms © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR
1. Default rights. The system applies a standard set of permissions to all files a partic- DISTRIBUTION
ular user creates. This is common in Unix-based systems.
2. Inherited rights. The system applies permissions inherited from one or more
enclosing directories. We will see specific examples of this in Chapter 4.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR 3.1.2DISTRIBUTION
Directory Access Rights NOT FOR SALE OR DISTRIBUTION
Directories (folders) tie together files in different parts of the hard drive. A file exists
because it has a directory entry, and we must change that directory entry to delete it.
Thus, we don’t have full control over a file unless we have the right to change its direc-
tory entry. © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Figure 3.4 shows the directory structure
NOT FOR SALE OR DISTRIBUTION in which Bob’s essay file resides. The file FOR SALE OR DISTRIBUT
NOT
resides in Bob’s personal directory (named bob). His personal directory resides in the
system’s “root” directory. To find the file, Bob’s process starts at the root directory and
looks for Bob’s personal directory. The root directory entry leads the process to Bob’s
personal directory, then the process searches Bob’s personal directory. The entry in that
© Jones & Bartlett
directory Learning,
leads it, finally, LLC
to the file itself. © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 96 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
96 CHAPTER 3 | Controlling Files

© Jones
Root & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Owner:
NOT FORSystemSALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
bin
bob
etc
suitemates Learning, LLC bob
© Jones & Bartlett © Jones & Bartlett Learning, LLC
Owner: Bob
NOT FOR SALE ORdrive’s
The hard DISTRIBUTION
[Link]
NOT FOR SALE OR DISTRIBUTION
“root” directory
[Link]
----
----
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
Bob’s Essay
NOT FOR SALE OR DISTRIBUTION NOT
Bob’s personal FOR SALE OR
Owner: BobDISTRIBUTION
directory

Figure 3.4
Directory and file ownership.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT
Operating systems grant or deny rights in terms of containers. We may FOR
have SALE OR DISTRIBUT
the right
to change the file itself; we may even own the file, but we need rights to its directory in
order to change that directory entry.
The basic access rights to a directory are read, write, and seek. Bob has the right to
© Jones & Bartlett
read his ownLearning, LLC
directory, so © Jones
he can list the files in his directory and&look
Bartlett Learning, LLC
at file details
NOT FOR SALE OR DISTRIBUTION
stored in that directory. Bob also can write to his ownNOT FOR SALE OR
directory, so he can add,DISTRIBUTION
modify,
or delete files listed in it.
The seek right is separate from the read right; it allows the user’s process to search a
directory for a particular name in a file’s path, but not to examine the directory as a
whole. This allows other users to retrieve a file from a directory even if they don’t have
© Jones & Bartlett Learning,
the rightLLC
to read the entire directory.© Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
For example, the system could give NOTBobFOR SALE
the right OR
to seek fileDISTRIBUTION
names in the root direc-
tory but withhold the right to read that directory. Bob would be able to locate his own
directory by name. He would not be allowed to list the names of other files or directo-
ries in the root.
To Jones
© protect the directoriesLearning,
& Bartlett belonging toLLCother users, Bob does not have the right&toBartlett Learning, LL
© Jones
write to the root directory. Because of this, Bob does not have the right to delete his own
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
directory.
Some systems provide very specific rights for managing directories, while others pro-
vide minimal rights, like read, write, and seek. Here is a detailed listing of possible
rights a system could grant for access to a directory:
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
• Create a new directory—like the generic creation right.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 97 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.2 Executable Files 97

Controlling Files
• Delete©a Jones
directory—like the generic
& Bartlett deletion LLC
Learning, right. This operation can be ©
tricky
Jones & Bartlett Learning, LL
because directories contain files, and the process might not have delete rights for
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
all of its files.
• Seek a directory for an entry—the right doesn’t necessarily allow the process to list
the names of all directory entries, or to examine properties of individual entries.
• Read a directory—this right allows listing of the directory as well as seeking files
© Jonesin&[Link] Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
• Create new files in a directory—may be part of a generic “write” permission or a
separate right.
• Delete files in a directory—part of a generic “write” permission or a separate
right.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE ORWeDISTRIBUTION
can come close to implementing these distinct rights even if the system restricts us
NOT FOR SALE OR DISTRIBUTION
to read, write, and seek rights. The arrangement would not be able to distinguish
between creating or deleting files or directories.
If the system implements these six distinct rights, it can achieve a higher degree of
Least Privilege. This may or may not be important, depending on the security policy we
© Jones
need to enforce. & Bartlett
If the policy doesn’t Learning, LLC between files and directories,
need to distinguish © Jones & Bartlett Learning, LL
NOT
then the extra FOR
rights SALE
aren’t OR In
necessary. DISTRIBUTION NOT
either case, we want the system to apply FOR SALE OR DISTRIBUT
protec-
tions that enforce our policy objectives.

3.2 Executable Files

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOTWhen
FORweSALE
look inOR
ourDISTRIBUTION NOT
directories at the files, we must distinguish FORtwo
between SALE OR DISTRIBUTION
distinct
file types:
1. Data files, like a word-processing file containing an essay, a spreadsheet, or a con-
figuration file used by a program or the operating system.
© Jones & [Link],
ExecutableLLCfiles that contain application©programs
Jones or& Bartlett Learning, LLC
other programs.
NOT FOR SALE ORAnDISTRIBUTION
executable file contains instructions to NOT FOR by
be executed SALE ORWhen
the CPU. DISTRIBUTION
we load
those instructions into a control section in RAM, the CPU runs that program. This was
described in Section 2.1. The program’s instructions must be organized and formatted in
a special “executable” file format. Although the format varies with different operating
©are
systems, they Jones & Bartlett
all similar Learning,
to what we LLC
see in Figure 3.5. © Jones & Bartlett Learning, LL
Every executable file begins with a
NOT FOR SALE OR DISTRIBUTION “file header” that describes the structure and for-
NOT FOR SALE OR DISTRIBUT
mat of the program. The header contains these fields:
• Magic number—a standard data value that appears in the first location of the exe-
cutable file. Different operating systems and different CPUs typically use different
© Jones magic
& Bartlett
numbers Learning, LLC won’t accidentally run©aJones
so that the system program&thatBartlett
can onlyLearning, LLC
run correctly on a
NOT FOR SALE OR DISTRIBUTION different type of system. NOT FOR SALE OR DISTRIBUTION
• Program size—indications of the size of the block of machine instructions that
make up the program itself.
© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 98 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
98 CHAPTER 3 | Controlling Files

© Jones & Bartlett Learning,

File Header
Magic LLC Layout Information for© Jones & Bartlett Learning, LL
Program
NOT FOR SALE OR DISTRIBUTION
Number Size the Data Sections NOT FOR SALE OR DISTRIBUT
Starting instruction Machine instructions that make
of the program up this program

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

Figure 3.5
Executable file format.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT
• Layout information—addresses FOR SALE
and offsets OR
to be used to DISTRIBUTION
lay out variables and
stack locations in the program’s data section.
Following the header, the rest of the file consists primarily of machine instructions.
When we execute the program in a file, the operating system loads those instructions
© Jones
directly into a & Bartlett
control Learning,
section. LLCthe program, the operating
When starting © Jones & Bartlett
system sets the Learning, LL
NOT FOR
program counterSALE OR DISTRIBUTION
to the starting address of the control section. NOT FOR SALE OR DISTRIBUT

3.2.1 Execution Access Rights

Figure 3.6 shows what happens when Bob runs the word-processor program to edit his
© Jones & essay.
Bartlett
The Learning,
square boxes LLC © Jones
on the top left and right represent & Bartlett
files. The box with Learning,
the tab in LLC
NOT FOR SALE OR DISTRIBUTION
the left corner is a data file, owned by Bob, that NOT FOR SALE OR DISTRIBUTION
contains his essay. The plain box on the
right is an executable file owned by the system that contains the word-processor pro-
gram.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION Essay File NOT FOR SALE OR DISTRIBUTION
Word-Processor
Owner: Bob Executable File
Owner: System
RW-

© Jones & Bartlett Learning,Bob’s

LLC ©R-X
Jones & Bartlett Learning, LL
Process R-X
NOT FOR SALE OR DISTRIBUTION
RW- NOT FOR SALE OR DISTRIBUT

Bob’s Data Word-Processor

Section Control Section
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Figure 3.6
Bob executes the word processor to edit his essay.
© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 99 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.2 Executable Files 99

Controlling Files
When Bob © starts
Jones the& word processor,
Bartlett the systemLLC
Learning, reads the executable file into
© the
Jones & Bartlett Learning, LL
word-processor control section (lower right corner). As the process executes the pro-
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
gram, it uses the data section (lower left corner) to contain working variables and to
store the parts of the essay file being edited.
Bob has full ownership of his essay file and full read/write access to his data section.
The file containing the word-processor program is owned by the operating system. Bob
© Jones & Bartlett
has read-only accessLearning, LLC
to the file, and to its control section. When ©Bob
Jones
starts&the
Bartlett
program,Learning, LLC
NOTthe FOR SALE
operating OR itself
system DISTRIBUTION
copies the file’s instructions into theNOT FOR
control SALE OR DISTRIBUTION
section.
As before, we represent access rights with labeled arrows. Note that executable files
and control sections may have an “X” permission. In the case of the file, this indicates
the execute right. When present, a user may execute the file. Most modern systems pro-
vide this right. This helps implement Least Privilege; it allows a user to run a program,
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
but does not imply the right to copy it or visually examine the executable instructions.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
In practice, however, most systems provide both Read and Execute permissions, because
parts of the system might not respond well if they can’t actually read the program file.
The programmer who actually creates a program has all three rights, read, write, and
execute, which yields “RWX.”
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
TYPES OF EXECUTABLE
NOT FOR FILESSALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Application programs aren’t the only executable files on a typical operating system. The
first and most important executable file is the “kernel” of the operating system itself.
When we boot the system, the BIOS reads this file from the hard drive and loads it into
RAM. From there, the rest of the operating system starts up. Any part of the operating
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
system that may be added while the system is running must reside in its own executable
NOTfile.
FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Here is a list of common types of executable files:
• Application programs—the files we execute to run useful applications. Some “sys-
tem utility” programs, like those for managing and formatting hard drives, are
© Jones & Bartlett Learning,
applicationLLCprograms. © Jones & Bartlett Learning, LLC
NOT FOR SALE OR• DISTRIBUTION
Operating system kernel—the file the BIOS NOT FOR
reads intoSALE OR DISTRIBUTION
RAM during the bootstrap
process. This contains the machine instructions that make up the operating sys-
tem’s main procedures.
• Device drivers—custom procedures for using I/O devices.
• Shared©libraries—useful
Jones & Bartlett Learning,
functions LLC
that may be © Jones & Bartlett Learning, LL
shared among multiple programs
NOT
(dynamic linkFOR SALE
libraries OR DISTRIBUTION
in Windows). NOT FOR SALE OR DISTRIBUT
These files, like typical executable files, contain machine instructions. To run the pro-
gram, we load it into RAM and direct the CPU to execute the instructions. Some sys-
tems, however, notably those derived from Unix, also treat some text files as executable
© Jones & Bartlett
files. These are files Learning, LLC language. These include
written in a scripting © Jones & Bartlett
programming lan- Learning, LLC
NOTguages
FOR like
SALEPerl,OR DISTRIBUTION
Python, PHP, or Lisp. The CPU can’t executeNOTthese FOR SALE
programs OR DISTRIBUTION
directly,
but instead must execute the language’s interpreter program. This is also true of

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 100 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
100 CHAPTER 3 | Controlling Files

programs
© Jones written in versions
& Bartlett of the BasicLLC
Learning, language, including Visual Basic.
© JonesWe discuss
& Bartlett Learning, LL
scripting languages further when we discuss computer viruses in Section 3.2.3.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
A system’s security depends on protecting executable files, especially operating sys-
tem files. An attacker can break our Chain of Control by modifying an executable file,
especially if it is a critical operating system file.

© Jones & 3.2.2

Bartlett Learning,
Computer LLC
Viruses © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
By 1981, the Apple II had become an incredibly popular desktop computer. Introduced
at the West Coast Computer Faire in 1977, the Apple received a huge boost in sales with
the introduction of “Visicalc” in 1979, the first spreadsheet program. Visicalc justified
buying an Apple II for the office. Back then, hard drives were too expensive for small
© Jones & Bartlett Learning, LLCMost computers used removable
computers. © Jones & Bartlett
diskettes. Learning,
The operating systemLLC
and one or
NOT FOR SALE OR DISTRIBUTION
two applications could fit on a singleNOT FOR SALE OR DISTRIBUTION
diskette.
The computer software industry was in its infancy. People often borrowed software
from one another and often copied each others’ application programs. This behavior
was especially rampant with computer games. Bill Gates, then the young co-founder of
the tiny Microsoft Corporation, published articles urging computer users to pay for
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
their software and shun unauthorized copies, but the sharing (called piracy today) per-
NOT
sisted. FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
There was little to discourage computer users from sharing software until a few of
them noticed this odd phenomenon: Their application programs grew larger and started
more slowly. Closer investigation revealed that a small program attached itself to each
© Jones & ofBartlett Learning,
their application LLCfiles. When such a program
program © Jones & Bartlett
was executed, Learning,
it would attach LLC
NOT FOR SALE OR
a similar DISTRIBUTION
program to any other program files it found. NOT FOR SALE OR DISTRIBUTION
In 1983, researcher Fred Cohen performed a series of studies in which he constructed
programs that replicated themselves. He used the term computer virus to describe them.
At first, other researchers saw little relevance in this work, but soon viruses emerged as
the first widespread form of computer malware.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
VIRUS INFECTION NOT FOR SALE OR DISTRIBUTION
When a virus “infected” an application program, it added its own machine instructions
to the end of the program’s file (Figure 3.7).
By adjusting the file headers, the virus ensured that its instructions were loaded into
RAM along with the application program. The virus also modified the application itself
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
so that the virus program would run first.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
When the user started up an infected application, the operating system loaded the
program into RAM, including the virus. The system jumped to the start of the applica-
tion, which had been modified to make the virus program run first. Here is what a typi-
cal virus did:
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
1. The virus searched the operating system’s file directory to locate every file contain-
NOT FOR SALEingOR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
an application program. It would then inspect each application program file.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 101 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.2 Executable Files 101

Controlling Files
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
FILE HEADER
Program NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
starting point JUMP to Virus

Program’s Machine Instructions

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Virus
starting point
Virus Machine Instructions

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT
Moved Instruction FOR
JUMPSALE
Back OR DISTRIBUTION

Figure 3.7
A virus infection in an executable program file.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT
2. If the program file had already been infected by the virus, the virus skipped FOR SALE OR DISTRIBUT
to the
next file.
3. If the file was not infected, the virus copied its executable instructions to the end of
the file, “appending” to it. This reduced the risk of accidentally damaging the
© Jonesapplication.
& Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE
4. Next, OR DISTRIBUTION
the virus NOT FOR
modified the first instruction in the application SALEtoOR
to “Jump” the DISTRIBUTION
start of the virus program. The virus also saved that first instruction, so that it
would be the last instruction the virus executed itself before jumping back to
resume the application. Now the file was fully “infected” and would run the virus
the next time application started.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
5. Once the virus had checked every application program on the system, it executed
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
the instruction from the start of the application, and jumped back to the applica-
tion program.
The computer user might see a delay before the application started, while these steps
were performed—or not.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Biological viruses rely on particular techniques to infect other victims; some are air-
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
borne, some travel in food, and so on. In the case of computer viruses, infection only
occurs if the victim executes the virus code. In other words, the virus subverts the Chain
of Control to cause itself to be executed. There are often many ways this can happen. In
the early days, viruses most often spread by running an infected application.
© Jones & Bartlett
Originally, Learning,
viruses LLCEarly virus authors sought
seemed benign. © Jones & Bartlett
persistence Learning, LLC
and replica-
NOTtion.
FOR SALE
They foundOR DISTRIBUTION
their NOTinnocuous
viruses spread more effectively if they were FOR SALE OR DISTRIBUTION
and hard

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 102 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
102 CHAPTER 3 | Controlling Files

to ©detect.
JonesEven&so,Bartlett
viruses made assumptions
Learning, LLCabout executable files, and
© could
Jonesdamage a
& Bartlett Learning, LL
file if the assumptions were incorrect.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
MALICIOUS VIRUSES
By the late 1980s, however, some virus writers were inclined toward destruction. The
Jerusalem virus, which appeared in 1987 in the city of Jerusalem, contained a “destruc-
© Jones & tive
Bartlett Learning,
payload” that wouldLLC
delete all executable files on©the
Jones
system&onBartlett
Friday theLearning,
13th, LLC
NOT FOR SALEstartingOR DISTRIBUTION
in 1988. NOT FOR
This type of trigger was typical of destructive SALE
viruses: ORwould
They DISTRIBUTION
spread for some period of time, and then a calendar date would trigger a destructive
action. The Michelangelo virus (1991) was a famous example of this; it was pro-
grammed to reformat hard drives on March 6, Michelangelo’s birthday.
Michelangelo, like several later viruses, did not directly infect applications. Instead, it
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
infected the Master Boot Record (MBR) of diskettes and hard drives (Figure 3.8).
NOT FOR SALE OR DISTRIBUTION
Whenever a computer bootstrappedNOT from aFOR SALE
particular OR
disk, theDISTRIBUTION
BIOS would first read in
and execute the instructions stored on the MBR.
By that time, low-cost disk drives were common on desktop computers. The Miche-
langelo virus code ran whenever the system was booted from an infected disk, whether a
© drive
hard Jones & Bartlett
or diskette. Learning,
The virus LLC
would then modify the bootstrap data©on Jones & Bartlett
every disk on Learning, LL
theNOT
systemFOR SALE
so that ORexecute
it would DISTRIBUTION NOT
the virus code before it bootstrapped theFOR SALE OR DISTRIBUT
operating
system.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE
Figure OR
3.8 DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
A diskette infected with a virus, circa 1991.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 103 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.2 Executable Files 103

Controlling Files
Applications and bootstraps
© Jones were Learning,
& Bartlett not the only techniques
LLC used to spread viruses. Any & Bartlett Learning, LL
© Jones
time the virus writer can trick a victim into executing a program, the virus writer will
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
use it to spread a virus. There are several ways to automatically execute a program
when inserting a USB drive into a computer; several viruses use such techniques to
spread between computers.

© Jones
3.2.3 &Macro
Bartlett Learning, LLC
Viruses © Jones & Bartlett Learning, LLC
NOTWhenever
FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
we write a computer program, we write it in a programming language. For us
to use a particular language, we need a program that translates what we wrote into
actions performed by the CPU. These “programming language programs” fall into two
categories:
© Jones & [Link], LLC © Jones & Bartlett Learning, LLC
Compiler—a program that converts our program into machine language. The
NOT FOR SALE OR DISTRIBUTION
CPU executes the machine language. C,NOT
Java, FOR SALE
Fortran, OR DISTRIBUTION
and Cobol are examples of
compilers.
2. Interpreter—a program that “interprets” the text of our program a word at a
time, and performs the actions specified in the text. Python, Visual Basic, Java-
script,© Jones
PHP, Lisp, &
andBartlett
keyboardLearning, LLC are examples of interpreters.
command processors © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR
We called interpreted languages scripting languages earlier. A program in a scripting
SALE OR DISTRIBUT
language sometimes is called a script. For example, a file containing Unix shell com-
mands or MSDOS commands is often called a shell script. Today’s languages may even
straddle the line between compiling and interpreting. For example, Java usually com-
© Jones & program
piles the Bartlettinto
Learning, LLC
“bytecodes,” © Jones
which then are run by a highly & Bartlett
optimized inter- Learning, LLC
NOTpreter
FORthat SALE OR DISTRIBUTION
is customized to specific CPUs and operating [Link] FOR SALE OR DISTRIBUTION
Adobe’s Acrobat program and most web browsers understand scripts written in Java-
script. Typically, the script’s author ties each script to a particular event within the docu-
ment. In Acrobat, a file in Portable Document Format (PDF) may include a script that
executes when we open the document, when we reach a particular page, or when we fill
© Jones & Bartlett Learning,
in fields LLC
in a form. On a web page, the script © Jones
runs & Bartlett
when we Learning,
open the page or when LLCthe
NOT FOR SALE OR mouse DISTRIBUTION
moves or clicks on particular items onNOT FOR SALE OR DISTRIBUTION
the page.
Sometimes we call scripts macros, especially when we embed them in other docu-
ments. For example, many Microsoft Office applications will allow us to create a macro
by recording a sequence of operations. The Office application typically translates the
sequence into © aJones & Bartlett
Visual Basic programLearning,
and saves it LLC
with the file. We can tell the © Jones & Bartlett Learning, LL
applica-
tion to perform the macro when particular
NOT FOR SALE OR DISTRIBUTION events occur. NOT FOR SALE OR DISTRIBUT
While these programming capabilities provide some interesting features, they also
open users to attack. Most scripting languages can create files or modify other files and
execute other programs. A script-oriented or macro virus uses these features to propa-
gate the virus code.
© Jones & Bartlett
In the Learning,
early 1990s, a rumored LLC
macro virus infected Microsoft© Jones & Bartlett Learning, LLC
Word documents.
NOTWhenFORexecuted,
SALE OR the virus copied itself to other Word files it could find andSALE
DISTRIBUTION NOT FOR OR DISTRIBUTION
also posted

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 104 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
104 CHAPTER 3 | Controlling Files

the©document
Jones & to Bartlett
the UsenetLearning,
News [Link] published the document worldwide
© Jones & for
Bartlett Learning, LL
viewing by everyone who used the Usenet News system.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
While macro viruses posed a serious risk for some systems, vendors largely ignored
the problem until such viruses were widely distributed by email (see Chapter 16). To
reduce the risk of such viruses, Microsoft introduced “Macro Virus Protection.” In
2010, Adobe announced plans to reduce the risks of Javascript-based viruses embedded
© Jones & in
Bartlett
Acrobat Learning,
documents. LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
3.2.4 Modern Malware: A Rogue’s Gallery
Since the 1980s, antivirus researchers and vendors have identified thousands of viruses
and other forms of malware. In 2008, vendor Symantec announced that the total num-
© Jones & Bartlett Learning, LLC
ber passed © Jones
one million. Here is a selection & Bartlett
of malware Learning, LLC
packages:
NOT FOR SALE OR DISTRIBUTION
• Waledac NOT FOR SALE OR DISTRIBUTION
• Conficker, also called Downadup
• Pushdo/Cutwail
• ZeuS
© Jones & Bartlett Learning,
LLC © Jones & Bartlett Learning, LL
• Stuxnet
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Many of these packages propagate like viruses while others propagate across net-
works. Here is a summary of different propagation techniques used in modern malware:
• Infect USB drives—The malware copies itself to any plugged-in USB drives. The
© Jones & Bartlett
malwareLearning, LLC the drive to automatically
then configures © Jones
execute&the
Bartlett
malwareLearning,
when the LLC
NOT FOR SALEdrive ORisDISTRIBUTION
inserted in a computer. NOT FOR SALE OR DISTRIBUTION
• Drive-by downloads—This is a network-based attack in which a user visits a web
page or clicks on a pop-up window, and unintentionally downloads the malware.
• Worm propagation—The malware exploits a desktop or server vulnerability that
© Jones & Bartlett Learning,it LLC
can reach via a network connection. The vulnerability allows the malware to
© Jones & Bartlett Learning, LLC
install itself on the vulnerable computer (see Section 10.1.3).
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
• Trojan infection—A “Trojan” is a program that appears benign but in fact con-
tains malware. In a Trojan infection, the malware arrives on the computer and the
user is tricked into executing it. The term Trojan is derived from the story of the
Trojan horse (Section 3.7).
© Jones & Bartlett Learning,
• Email infection—Trojan LLC on the desktop via email,
malware arrives © Jones & Bartlett Learning, LL
and the user
NOT FORit,SALE
executes causingORthe DISTRIBUTION
infection (see Section 15.3.3). NOT FOR SALE OR DISTRIBUT
We examine the malware packages later and examine how they propagate and what
they do. Many packages construct botnets (see Section 10.1.3). The botnet controller
uses the network of subverted computers for malicious and often illegal purposes. We
© Jones & Bartlett
find severalLearning,
examples ofLLC
this. © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 105 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.2 Executable Files 105

Controlling Files
WALEDAC © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Waledac constructs
NOT FOR and manages
SALE OR a sophisticated and hard-to-trace botnet. The NOT
DISTRIBUTION malware
FOR SALE OR DISTRIBUT
then provides several ways to make money from the network. Waledac is a Trojan that
originally propagated primarily through email and drive-by downloads. An existing
botnet operator may also download Waledac into the network of bots.
Once the network is in place, the controller may use it to do any of the following:
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
• Deliver
NOT FOR SALE spam
ORemail (see Section 15.3.1).
DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
• Create pop-up windows that harass the computer’s owner. Waledac’s pop-ups usu-
ally warn of a virus infection and offers the sale of special antivirus software. The
software is sold by the botnet operator, and it contains additional malware.
• Harvest authentication credentials from the PC (see Section 6.2.2).
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
• Perform “distributed” denial of service attacks (see Section 10.1.3).
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
CONFICKER, ALSO CALLED DOWNADUP
The name “Conficker” is the popular name given to a worm often called “Downadup”
in the security community. Conficker propagated through millions of Windows comput-
ers in 2009;©infections
Jones subsided
& Bartlett
afterLearning, LLC
that. Conficker constructed a botnet, but©
didJones
not & Bartlett Learning, LL
NOT
itself contain FORtoSALE
software exploit OR DISTRIBUTION
the network. Instead, botnet operators wouldNOT
installFOR SALE OR DISTRIBUT
other malware, like Waledac, and use it to make money from the botnet.

PUSHDO/CUTWAIL
Starting in 2007, a malware organization constructed a botnet using Pushdo and Cut-
© Jones & Bartlett
wail malware. Learning,
Pushdo LLC
implements © Jonesof&additional
a botnet and supports downloading Bartlett Learning, LLC
NOTmalware.
FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Cutwail implements email spam campaigns. In early 2009, Symantec’s Mes-
sageLabs estimated that this botnet contained at least 1 million bots and averaged over
7 million spam messages per day.
Over the next 18 months, however, work by regulators and security researchers
© Jones & closed down most
Bartlett Learning, of the network computers used
LLC by the botnet
© Jones operators
& Bartlett to operateLLC
Learning, the
botnet. This yielded a dramatic decrease in worldwide spam traffic.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
ZEUS
ZeuS is a malware “product” in that its developers offer it for sale on the black market.
Criminal groups purchase the software as an easy-to-use package to create a botnet
© Jones
focused on financial & Bartlett Learning, LLC
fraud. © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION
ZeuS generally propagates via email or drive-by downloads. Email may NOT
often use FOR SALE OR DISTRIBUT
social engineering techniques that direct victims to spoofed versions of popular social
networking sites, like MySpace, Facebook, or LinkedIn.
When ZeuS infects a computer, it installs its “Zbot” malware, which connects the
infected machine to the botnet. Zbot then steals financial credentials from the infected
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
machine and transmits them to the botnet operator. Zbot also can use the victim’s com-
NOTputer
FORtoSALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
perform financial transactions using the victim’s credentials.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 106 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
106 CHAPTER 3 | Controlling Files

©ToJones
complete&the fraud, the
Bartlett botnet operator
Learning, LLC recruits individuals to visit banks and
© Jones & Bartlett Learning, LL
withdraw cash from looted accounts. These individuals, called “money mules,” then
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
forward the money to the controllers. In late 2010, the U.S. FBI announced over 100
arrests related to a ZeuS botnet, including dozens of money mules.

STUXNET
© Jones & Stuxnet
Bartlett is aLearning, LLC programmable logic controllers
worm that targets © Jonesor&PLCs.
Bartlett Learning,
Factories, refin- LLC
NOT FOR SALE
eries, oilOR DISTRIBUTION
pipelines, NOTtoFOR
and the electrical power grid use PLCs SALE
automate OR DISTRIBUTION
industrial and
utility systems. These devices are often connected to Windows computers on a network,
and Stuxnet propagates by attacking the Windows computers.
Stuxnet is the most sophisticated piece of malware ever found. It propagates via USB
drives so that it may infect a factory network even if the network isn’t connected to the
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
Internet. The worm uses several previously unknown Windows vulnerabilities to propa-
NOT FOR SALE OR DISTRIBUTION
gate on the network. Stuxnet seeks outNOT FORPLC
specific SALE OR
models DISTRIBUTION
that perform specific tasks,
and ignores all others. In particular, it seems to target PLCs often used to process ura-
nium and other nuclear materials. Stuxnet modifies the PLC software and then hides
itself from detection. The changes affect motor speeds in a hard-to-detect way, which
© Jones
would & Bartlett
ruin whatever Learning,
industrial LLC
process the motor performed. © Jones & Bartlett Learning, LL
NOT FOR
As of late SALE
2010, ORcould
experts DISTRIBUTION NOT
identify particular steps performed by FORbut
Stuxnet, SALE OR DISTRIBUT
could not conclusively identify its purpose nor its creators. Stuxnet’s features suggest
that it is a “cyber weapon” created by a government to attack another country’s nuclear
development facilities. It contains no mechanisms to make money, so it is unlikely to be
the product of a criminal gang. It required a lot of specific knowledge about factory con-
© Jones & trol
Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
systems and knowledge of previously unreported Windows vulnerabilities. It
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
required a team of very sophisticated software developers.

3.3 Sharing and Protecting Files

© Jones & Bartlett Learning,
ComputerLLC © Jones
sharing happens all the time. Personal&computers
Bartlettmay
Learning,
be cheap LLC
enough to be
NOT FOR SALE OR DISTRIBUTION NOT FOR
treated as “personal property,” but computers SALEserver
running OR software
DISTRIBUTION
share their
resources continuously with countless users. Some desktops require controlled sharing,
like those in libraries or computer labs in schools. Physicians, attorneys, financial plan-
ners, and many consultants may use a home computer to process sensitive information
about patients&
© Jones orBartlett
clients; these professionals
Learning, LLC are obligated to keep this©information
Jones & Bartlett Learning, LL
away from family members.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Sharing always has its limits. In a shared kitchen, the household’s human residents
may be perfectly happy to share boxes of cereal and bins of sugar with one another, but
not with their pets or with ants and mice. We prevent “undesirable” sharing by enforc-
ing controls. In a kitchen, we control sharing by putting food in pet-proof and vermin-
© Jones & Bartlett Learning,
proof containers (FigureLLC
3.9). © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR
In a computer, the operating system controls the sharing. SALE
Files and ORprovide
folders DISTRIBUTION
the software equivalent of cabinets, boxes, and jars. The operating system controls

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 107 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.3 Sharing and Protecting Files 107

Controlling Files
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & BartlettFigure

Learning,
3.9
LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Controlled sharing in a kitchen.

program execution, controls RAM access, and controls access to files on the hard disk.
© Jones
This helps ensure & Bartlett
the orderly Learning,
and predictable LLCof the overall system. © Jones & Bartlett Learning, LL
behavior
ControlsNOT FORalso
on sharing SALE OR DISTRIBUTION
help prevent NOT
accidental and some malicious acts from FOR SALE OR DISTRIBUT
caus-
ing damage. If a person spills something in a cupboard filled with sealed containers, the
mess won’t contaminate other food. If a mouse can’t chew into a container of raisins,
then the raisins remain safe for people to eat. If a user runs a virus-infested application
but lacks the rights to modify application programs, then the virus can’t infect other
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
applications.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
As with all security, the challenge is to find a balance between safety and meeting the
users’ needs. It’s not reasonable to block a user from fixing broken software simply
because the same restriction might prevent a virus infection. On the other hand, there’s no
sense in granting access to modify applications if the user has no business modifying them.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
OBJECTIVES
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
To create policies for sharing files, we start by identifying potential risks. To identify
risks, we start with a list of objectives:
a. Provide computing facilities for authorized users
© the
b. Preserve Jones
Chain&ofBartlett
Control Learning, LLC © Jones & Bartlett Learning, LL
c. Either NOT
permitFOR SALE
or prevent general sharing of information among the users NOT FOR SALE OR DISTRIBUT
OR DISTRIBUTION
The third objective reflects two alternatives for file sharing: either users share their
files by default or they are kept isolated by default. We develop two different policies to
reflect this choice.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 108 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
108 CHAPTER 3 | Controlling Files

THREATS
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
ToNOT
develop our SALE
FOR list of risks,
ORwe consult the list of threats in Section 1.4
DISTRIBUTION and focus
NOT FORon SALE OR DISTRIBUT
those that we can address through file protection. This eliminates people who won’t be
logged into the computer and people who simply pose a physical threat, like theft. This
leaves the following threats:
• ScriptLearning,
© Jones & Bartlett kiddy—sharing
LLC a computer at a school, or
© possibly
Jones at& work, with Learning,
Bartlett people LLC
who have too
NOT FOR SALE OR DISTRIBUTIONmuch time and curiosity. NOT FOR SALE OR DISTRIBUTION
• Embezzler—sharing with a coworker who is motivated to steal from the company.
• Suite/room/family/housemate—sharing with someone in our living space.
• Malicious acquaintances—sharing with someone who visits our living space, get-
© Jones & Bartlett Learning,ting
LLCphysical access to the computer.
© Jones & Bartlett Learning, LLC
Administrators—sharing
NOT FOR SALE OR DISTRIBUTION
• a computer
NOT FORat school
SALEor work
ORwhere an administrator
DISTRIBUTION
might be inclined to eavesdrop on our work or perhaps even meddle with our files.

RISKS
Now we make a list of attacks based on Figure 1.6. There are six attacks in the complete
list;©we
Jones & Bartlett
can omit Learning,
the first attack: physicalLLC
theft. We can generalize the © Jonesones
remaining & Bartlett
to Learning, LL
NOTthe
capture FOR SALE
essence ORthe
of what DISTRIBUTION NOT
threats might do on an isolated computer. FOR
This yieldsSALE
the OR DISTRIBUT
following list of risks:
1. Denial of service—someone deletes some of our files or damages software, making
all or part of the computer unusable.
© Jones & Bartlett Learning,
2. Subversion—a LLC gets a virus infection or©suffers
program Jones & Bartlett
some Learning,
other malware dam- LLC
NOT FOR SALEage. OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
3. Masquerade—one user logs in, trying to pretend to be another.
4. Disclosure—some of our personal data is disclosed.
5. Forgery—someone modifies one of our files without our knowledge, so their state-
© Jones & Bartlett Learning,ments
LLCare presented as our own.© Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
This list of risks is comprehensiveNOT FOR
enough SALE
to use when OR DISTRIBUTION
developing our file protection
policies. It is short enough to make it unnecessary to prioritize the risks.

3.3.1 Policies for Sharing and Protection

© Jones
When we look&atBartlett Learning,
policies for sharing on aLLC
computing system, we see two © Jones
general & Bartlett Learning, LL
types
of NOT FOR
policies: SALE
global OR
policies andDISTRIBUTION NOT file
tailored policies. A global policy establishes FOR SALE OR DISTRIBUT
permis-
sions to apply by default and, in particular, determines the permissions to apply when
we create a new file. Typically, there are two global policies:
1. Isolation policy—no access granted to other users’ files
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
2. File-sharing policy—read access granted to other users’ files
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 109 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.3 Sharing and Protecting Files 109

Controlling Files
User files© aren’t
Jonesthe only ones in the
& Bartlett system. There
Learning, LLCare system files that might© notJones
even & Bartlett Learning, LL
be visible to user programs. Most important for users, the system contains application
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
programs and those are stored in files. To use these programs, the system must grant
users the necessary rights. However, the system also must maintain the Chain of Con-
trol, so it should not grant the right to modify those programs.
Systems rarely grant both read and write access to other users’ files, at least by
© Jones
default.&Even
Bartlett Learning,
if people LLC
are working © Jones
together on the same project, & Bartlett
it is much safer to Learning, LLC
NOTlimit
FOR theSALE
files theyOR DISTRIBUTION
share NOT
completely. We need tailored policies to handleFOR SALE
special cases OR
like DISTRIBUTION
those. Here are examples:
• Privacy—block all access to certain files in a sharing environment.
• Shared reading—grant read-only access to certain files in an isolation environ-
© Jones & Bartlett Learning,
ment. LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR• DISTRIBUTION NOT files
Shared updating—grant full access to certain FOR in SALE OR DISTRIBUTION
either environment.
For now, however, we focus on global policies.

UNDERLYING SYSTEM POLICY

©the
Regardless of Jones &we
policies Bartlett
establish,Learning, LLC policy statements in all©ofJones
we will use certain them. & Bartlett Learning, LL
NOTform
These statements FOR anSALE ORsystem
underlying policy that address Objectives a andNOT
DISTRIBUTION FOR SALE OR DISTRIBUT
b intro-
duced in Section 3.3, and the risks associated with them. We won’t make policy state-
ments for user file protection, since that depends on the choice posed by Objective c.
The policy statements appear in Table 3.2. These statements apply to both user isola-
© Jonesand
tion & user sharing
Bartlett situations. LLC
Learning, © Jones & Bartlett Learning, LLC
This fundamental policy addresses the first three risks. The first statement addresses
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
denial of service. The second statement addresses masquerade. That statement also
addresses disclosure and forgery indirectly, but we will address those more directly with
additional policy statements. The third policy statement directly addresses denial of ser-
vice and subversion.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR USERDISTRIBUTION
ISOLATION POLICY NOT FOR SALE OR DISTRIBUTION
Let’s return to Bob’s predicament. He has a computer that he shares with his suite-
mates. He will let them use the computer but he needs to protect his own information
assets.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

TABLE 3.2 NOT FORsystem
Underlying SALE ORforDISTRIBUTION
policy a shared computer NOT FOR SALE OR DISTRIBUT
# Policy Statement Risks

1 All users shall be able to execute customary application programs and operating system 1
service programs.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
2 Each user shall have a separate login and, optionally, a password.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE3 OR DISTRIBUTION
3 Programs shall be protected from damage or other modifications by regular users. 1, 2

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 110 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
110 CHAPTER 3 | Controlling Files

© Jones
TABLE & Bartlett
3.3 Policy Learning,
LLC
for user isolation © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
# Policy Statement Risks

1 All users shall be able to execute customary application programs and operating sys- 1
tem service programs.

© Jones & Bartlett

2 EachLearning,
user shall haveLLC
a separate login and, optionally, a © Jones & Bartlett Learning,
password. 4 LLC
NOT FOR SALE
3 OR DISTRIBUTION NOT FOR SALE OR
Programs shall be protected from damage or other modifications by regular users. DISTRIBUTION
1, 3

4 Files belonging to one user shall be protected from any access (read or write) by other 1, 2, 5
users.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Bob is looking for a policy in which we adjust Objective c to isolate users from one
another. We create the basic policy by adding one statement to the fundamental system
policy. The statement directly addresses the risks of disclosure and forgery. It also
addresses
© Jones the risk of denial of
& Bartlett service if one
Learning, LLCuser accidentally damages ©
a file belonging
Jones to
& Bartlett Learning, LL
another user. This yields the policy in Table 3.3.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
However, Bob had a specific risk in mind:
6. A suite mate tampering with Bob’s files.
To protect against that specific risk, we can add some more specific security policy
© Jones & statements
Bartlett Learning, LLCpolicy. In particular, we ©
to Bob’s security canJones & Bartlett
add policy statementsLearning,
to talk LLC
NOT FOR SALE OR about
specifically DISTRIBUTION
how Bob and his suitemates will use NOT FOR SALE
the computer. TheseOR DISTRIBUTION
additional
statements appear in Table 3.4.
If Bob configures Windows in a friendly fashion, it will display a login screen that
lists all users on the computer. If a suite mate clicks on “Suitemates,” the computer will
log in without a password. If a suite mate clicks on “Bob,” the computer asks for the
© Jones &Bartlett Learning,
password. LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

TABLE 3.4 Policy additions for Bob’s particular situation

#© Jones & Bartlett Learning, LLC
Policy Statement © JonesRisks
& Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
5 The system shall have two regular users: Bob and Suitemates. 4, 6

6 Bob shall have a password to protect his login. 2, 4, 5, 6

7 Suitemates shall not need to type in a password to log in. 1

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 111 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.4 Security Controls for Files 111

Controlling Files
TABLE 3.5 © Jones
Policy & sharing
for file Bartlett
Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
# Policy Statement Risks

1 All users shall be able to execute customary application programs and operating 1
system service programs.

© Jones
2 &Each
Bartlett
user shallLearning,
have a separateLLC
login and, optionally, a password. © Jones & Bartlett4 Learning, LLC
NOT 3FOR Programs
SALE shallORbeDISTRIBUTION NOT FOR
protected from damage or other modifications by regular users. SALE
1, 3OR DISTRIBUTION
4 Files belonging to one user shall be readable by other users. 1

5 Files belonging to one user shall be protected from writing by other users. 1, 3, 5
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
This arrangement provides Bob with the safety he needs and the suitemates with
access to his computer. The suitemates can’t log in as Bob unless they somehow guess
his password. On the other hand, they don’t have to remember a password to log in as
“Suitemates.” When they
© Jones log in as such,
& Bartlett they won’t
Learning, have access to his files (per© Jones
LLC & Bartlett Learning, LL
Policy 4).
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
USER FILE-SHARING POLICY
When people hide things, others get suspicious. There are some environments where it’s
more common to share information than to hide it. For example, many families want to
© Jones & Bartlett
share their Learning,
information LLC Files may consist of ©
among members. Jones
letters, & Bartlett
homework, familyLearning, LLC
NOTphotos,
FOR SALE ORand
and so on, DISTRIBUTION
there may be bona fide reasons to share NOT FORand
anything SALE
every-OR DISTRIBUTION
thing. In engineering projects, it is fairly common to share information.
If we assume sharing is the norm, then Risk 2, disclosure, is no longer considered a
risk. Instead, it becomes a “denial of service” if we can’t read each others’ files. This
yields the policy in Table 3.5.
© Jones & Bartlett As
Learning, LLC
with user separation, © Jones
there are some systems & Bartlett
that provide sharing Learning, LLC
by default. This is
NOT FOR SALE OR DISTRIBUTION
a tradition of Unix-based systems, which createNOT FOR SALE
file directories OR DISTRIBUTION
for individual users and, by
default, grant other users access to those files. The resulting policy does not, of course,
provide unrestricted sharing. A typical user-sharing policy provides read-only sharing, but
protects files from writing except by the owner.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOTControls
3.4 Security FOR SALE
forOR DISTRIBUTION
Files NOT FOR SALE OR DISTRIBUT

In Section 2.5, we introduced the access matrix to describe access controls for processes
in RAM. We can use the same matrix to describe access controls for files and other
© Jones & Bartlett
resources Learning,
in an operating [Link]
In general, the access matrix©describes
Jones three
& Bartlett
things: Learning, LLC
NOT FOR SALE
• What ORsharing
we are DISTRIBUTION
(objects) NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 112 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
112 CHAPTER 3 | Controlling Files

© With whom
• Jones we share Learning,
& Bartlett them (subjects)
LLC © Jones & Bartlett Learning, LL
• What rights each subject has to each object
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
If we make very precise statements about the subjects, objects, and rights we wish to
implement, then the sharing is easy to implement. If we trust the system to block all
accesses except those we specifically allow, then it’s easy to verify the system’s correct
© Jones & behavior.
BartlettThe more specific
Learning, LLC and mechanical we can be © inJones
our specification
& Bartlett of subjects,
Learning, LLC
objects, and rights,
NOT FOR SALE OR DISTRIBUTION the more effectively we can implement and verify our policy.
NOT FOR SALE OR DISTRIBUTION
In practice, however, a realistic policy statement is more abstract than that. We want
our policy to associate people with data; however, that is not the same as associating
user identities with files. We build mechanisms to relate the two as closely as possible,
but they just aren’t the same. We want to protect what is in the files, and not just the
© Jones & Bartlett Learning,
computerLLCfiles themselves. © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
This is a security problem we alsoNOT FORboundaries,
have with SALE OR DISTRIBUTION
fences, and other containers
in general: The security mechanism controls what happens to the container, not the con-
tents. For example, we could try to protect some valuables with a high fence, border
alarms, and a strongly locked gate. Still, a helicopter could drop in and steal some items,
bypassing
© Jones the &fence and raising
Bartlett no [Link]
Learning, © Jones & Bartlett Learning, LL
We rely on a computer’s operating system to protect its files. If an attacker starts the
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
computer normally, our operating system will start up and protect our files. We still,
however, face a Chain of Control risk. A system booted from a CD-ROM bypasses the
hard drive’s own operating system and allows unrestricted access to our files. We can
rely only on operating system protections as long as two properties remain true:
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
1. The operating system’s protections are always invoked when accessing our pro-
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
tected files, and
2. There is no way to bypass the operating system to access our protected files.
The terms subject and object are well-known in the information security community.
They most often appear in highly formalized security specifications and aren’t used rou-
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
tinely. We will use more specific terms like process or user instead of subject, and terms
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
like file or resource instead of object.

3.4.1 Deny by Default: A Basic Principle

In a clean kitchen, everything has its proper place and everything is put away. Boxes and
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
jars are closed and stored in cabinets. A few items may remain out if they are to be used
NOT
soon, or ifFOR SALE
they are OR DISTRIBUTION
not going NOT FOR SALE OR DISTRIBUT
to draw insects, rodents, or other vermin.
In essence, the “default” is to deny access to vermin, at the very least. This arrange-
ment also denies access to legitimate users (members of the household) to a small
degree, because a person must take specific steps to gain access to the desired item: open
© Jones & Bartlett
a cabinet andLearning, LLC
a box or jar. © explicit
A padlock provides a more Jonesexample:
& Bartlett Learning,
We can’t open LLC
NOT FOR SALE
the doorOR DISTRIBUTION
unless we have the key (Figure 3.10). NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 113 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.4 Security Controls for Files 113

Controlling Files
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

Figure 3.10
Deny by Default--a padlocked door.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Deny by Default provides the foundation for strong security. In computing, NOT
NOT FOR SALE OR DISTRIBUTION FOR SALE OR DISTRIBUT
it means:
No access is allowed to anyone unless specifically granted.
As we saw in Section 2.4, every process starts out as an “island.” A process has no
© Jones &
access to Bartlett Learning,
resources unless LLCgives the process a way to
the system © request
Jonesthem & Bartlett
and reachLearning, LLC
NOT FOR SALE OR DISTRIBUTION
them. It isn’t easy to show that processes are truly isolated, NOT FOR SALE OR DISTRIBUTION
but it is a fundamental
design goal of every secure system. We need confidence that a system only grants access
rights when told to do so. Otherwise we can’t fully trust a system to enforce the permis-
sions and restrictions we want.

© Jones & Bartlett

THELearning,
OPPOSITE OF LLC
DENY BY DEFAULT © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
This may sound contradictory, but we can’t NOTa system
trust FOR SALE
to shareOR DISTRIBUTION
things correctly
unless it starts by blocking access to everything. This makes sense when we consider the
opposite: a system that allows all accesses except the ones we specifically tell it to block.
We’re now faced with the challenge of listing everyone we might need to block. How
can we possibly tell if that list is complete? Do we start a list of every person on the
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
planet and remove the names of permitted users? This isn’t practical.
NOT FOR SALE OR DISTRIBUTION
For example, content control software (also called censorware) classifies Internet
NOT FOR SALE OR DISTRIBUT
websites according to content, and then blocks access to types of content the customer
finds unacceptable. Some private organizations use this software to discourage employ-
ees from visiting personal, shopping, and entertainment sites with their workplace com-
© Jones
puters.&ABartlett Learning,
few countries, LLC and Saudi Arabia, apply
notably China © Jones & Bartlett
such filtering to all Learning, LLC
NOTInternet
FOR SALE ORenters
traffic that DISTRIBUTION
and leaves the country. We examineNOT FOR in
this further SALE OR DISTRIBUTION
Chapter 15.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 114 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
114 CHAPTER 3 | Controlling Files

Content
© Jones control softwareLearning,
& Bartlett often followsLLC
a policy of default permit: ©Everything
Jones & is Bartlett Learning, LL
allowed except sites on the prohibited list. This doesn’t really block access to all “unac-
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
ceptable” sites, it only blocks access to sites that have existed long enough to find their
way onto the list of banned sites. Such systems can’t be 100 percent effective, though
they work well enough in practice to satisfy certain customers.
Islands, vaults, and other physical boundaries often implement a Deny by Default
© Jones & policy.
Bartlett Learning,
People LLC a physical fence that’s©too
can’t go through Jones
tall or & Bartlett
risky Learning,
to climb. The LLC
NOT FOR SALE OR DISTRIBUTION
fence’s gateway NOTfences
implements the permission to pass. Some FORare SALE ORtoDISTRIBUTION
designed restrict
animals while others are intended to restrict people. The intended policy of a well-built
fence is reflected in the structure of the fence and the lock on the gate. A fence intended
to restrict animals may have a gate that people can easily operate.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
3.4.2 Managing Access Rights
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
In order to enforce the correct access rights, the operating system needs to maintain a
list of access rights. In theory, the system could maintain an access matrix. In practice,
this isn’t efficient.
For example, a typical Windows desktop contains over 13,000 separate files just for
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
operating system components, and may contain five to ten times as many files for pro-
NOT FOR SALE OR DISTRIBUTION
grams, media, and user-created documents. The complete access matrix NOT FOR
might SALE OR DISTRIBUT
contain
100,000 rows, plus one column per user, or even one column per process. This is too
large to manage.
Access rights follow well-known patterns in most systems. When one process starts
© Jones & BartletttheLearning,
another, child processLLC © Jones
often inherits the parent’s access &especially
rights, BartletttoLearning,
files. LLC
NOT FOR SALEWhen thisORhappens,
DISTRIBUTION
we can apply the same set of accessNOT FOR
rights SALE
to both OR DISTRIBUTION
the parent and its
children. If we look at individual resources, particularly files, we find that the rights tend
to cluster into three distinct groups: those granted to the owner, those granted to “the
system” (including system administrators), and those granted to “everyone else.” Files
also may have a cluster of similar permissions granted to a “group” of users working on
© Jones & Bartlett Learning,
a sharedLLCproject. © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
In other words, the access matrixNOT FOR
contains a lotSALE OR DISTRIBUTION
of redundant information. We can
eliminate this redundancy by taking advantage of patterns in the access rights. When the
system combines matching access rights, it yields a smaller set of rules that is easier to
manage and enforce. Starting from the access matrix, there are two obvious strategies
for©combining
Jones & access rights:Learning, LLC
Bartlett © Jones & Bartlett Learning, LL
NOT
1. FOR
Cluster by SALE
column:OR DISTRIBUTION
associate access rights with users or processes NOT FOR SALE OR DISTRIBUT
2. Cluster by row: associate access rights with resources like files.
When we cluster the rights by column, we implement capability-based security.
This is common in physical, real-world security situations: Bob, for example, carries
© Jones & Bartlett
keys to letLearning,
him in to hisLLC
suite, start his car, and open©the
Jones & Bartlett
front door Learning,
back home. Bob’s LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
access rights are embodied in the keys, and the keys stay with the owner (the subject).

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 115 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.4 Security Controls for Files 115

Controlling Files
If Alice attends a concert,
© Jones she buys tickets,
& Bartlett and the
Learning, tickets themselves impart ©
LLC access to
Jones & Bartlett Learning, LL
the concert.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
3.4.3 Capabilities
The Atlas system at Manchester and CTSS at MIT demonstrated that a computer could
run many separate users at once, keeping them safely separated. Researchers at MIT,
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
notably Earl Van Horn and Jack Dennis, tried to identify the essential features of such
NOTsystems.
FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Van Horn coined the term capability to describe the access rights a particular
subject had for a particular object: the information in a single cell of an access matrix.
Because operating systems always kept a list of resources belonging to each process,
Dennis and Van Horn suggested that access control information be kept in that list.
© Jones & Bartlett When
Learning, LLC system implements capability-based
an operating © Jones & security,
Bartlettit Learning,
keeps the list LLC
of
NOT FOR SALE OR DISTRIBUTION
access rights on a per-process basis. If a processNOT hasFOR
accessSALE
rights toOR DISTRIBUTION
particular files or
other resources, it carries those rights with it. The process also may be able to share or
transfer its access rights to other processes. To print a file, for example, Bob’s word-pro-
cessing program passes the right to read his file to the printer’s device driver.
This approach seemed reasonable because capability-based security seems to com-
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
bine both the “island” and the “vault” access control strategies. A process can only
locate a resource if it is on its capability list. If the resource appears on the list,NOT
NOT FOR SALE OR DISTRIBUTION FOR SALE OR DISTRIBUT
then the
system controls its access even further by including or omitting the individual access
rights. When Butler Lampson introduced the access matrix in 1971, he predicted that
capability-based access control would be less “cumbersome” than the column-based
© Jones & Bartlett Learning, LLC
alternative. © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
CAPABILITIES IN PRACTICE
Despite Lampson’s prediction, capability-based security is not an obvious feature in
major modern operating systems. The access controls that most of us see—those for
protecting files and folders—rarely use capability lists. Several research systems were
© Jones & Bartlett Learning,
developed in theLLC © Joneslists,
1960s and 1970s that used capability & Bartlett Learning,
but very few LLC
commercial
NOT FOR SALE OR DISTRIBUTION
systems adopted them. The only really successfulNOTcommercial
FOR SALE OR
system DISTRIBUTION
that used capabil-
ity-based security was the IBM System/38 and its descendent, the AS-400.
We see capability-based security in more subtle places. For example, a process page
table provides capabilities to use specific RAM areas. Network-based systems also use
capabilities. For example, the Kerberos system (Section 13.4.2) distributes “tickets” to
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
its users that in turn give those users access to particular resources. Microsoft Windows
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
uses Kerberos to distribute user access rights between host computers on Windows net-
works. The U.S. government issues “public-key certificates” (Section 8.6) to members of
the defense community. Each certificate identifies the individual and specifies certain
access rights, like security clearances.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 116 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
116 CHAPTER 3 | Controlling Files

RESOURCE
© Jones-ORIENTED PERMISSIONS
& Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Most operating systems,
NOT FOR SALE OR however, use the row-oriented approach: They
DISTRIBUTION NOTstore access
FOR SALE OR DISTRIBUT
rights with files and other resources. This is a less-common approach in real-world secu-
rity; we mostly see it used for handling reservations in hotels and restaurants. If Bob
takes his date to a popular restaurant, the maitre d’ checks his name against the list of
reservations, and only grants access if Bob is on the list. To take a typical airplane flight,
© Jones & Alice
Bartlett
presentsLearning, LLC
a photo ID © Jones
at the airport, and the airline uses it to&generate
Bartletther Learning,
boarding LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE
pass. Her access to the plane is based on her identity, not on possessing a ticket. OR DISTRIBUTION
Within operating systems, the obvious example of this approach is in the file system.
The system stores details about access rights along with other administrative data it
maintains about a file. If we wish to find out about access rights to a particular file, we
© Jones & Bartlett Learning,
look at LLC © Jones
the file’s properties. On Windows, & Bartlett
we select Learning,
the file and then select LLC
“Properties”
from
NOT FOR SALE OR DISTRIBUTION the file’s menu. The “Security” tab lists the access rights.
NOT FOR SALE OR DISTRIBUTION On Macintosh OS-X, we
select the file and select “Information” from the menu. A section at the bottom of the
Information window lists the access rights (Figure 3.11).
OS-X provides a specific permission (“Read Only” or “Read/Write”) associated with
the user who owns the file and a separate permission for the rest of the world. OS-X
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
Figure 3.11 NOT FOR SALE OR DISTRIBUTION
Resource-oriented permissions OS-X and Windows.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 117 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.5 File Security Controls 117

Controlling Files
doesn’t display any rights
© Jones if the world
& Bartlett has no rights.
Learning, LLC The display also shows if ©
there are
Jones & Bartlett Learning, LL
rights granted to a particular “group” of users.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
3.5 File Security Controls

Let us look
© Jones at the access
& Bartlett permissions
Learning, LLCrequired by users on Bob’s©system
Jones to implement
& Bartlett theLearning, LLC
policy for Bob’s tower computer. The policy appears in Tables 3.3 and 3.4. First, let us
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
look at access rights for executable programs. Figure 3.12 illustrates the appropriate
access rights, using two executable files as examples. Regular users receive Read and
Execute access. The “System” user receives full access to the file.
Figure 3.13 uses a slightly different approach to show access rights to user files.
© Jones & Bartlett Learning,
Instead of showingLLC © Jones
example files, it shows a “pile” &toBartlett
of files representLearning, LLC
those belonging
NOT FOR SALE OR DISTRIBUTION
to the two regular users. NOT FOR SALE OR DISTRIBUTION
The two diagrams represent all of the users on Bob’s system. In larger systems, we
might use a single oval to represent all “regular” users and present permissions in those
terms. We also could represent permissions with separate ovals to represent “the file
owner,” the© “system,”
Jones and “other users.”
& Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
3.5.1 File Permission Flags
Real systems rarely use diagrams to establish access rights; instead, there is a notation or
a tabular format to use. The simplest approach is to provide a set of permission flags to
identify rights for a specific set of users.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

User
R-X “Bob”
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
Spreadsheet R-X
NOT FOR SALE OR DISTRIBUTION
Executable File
NOT FOR SALE OR DISTRIBUTION
Owner: System R-X
User
R-X “Suitemates”
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Word-Processor
ExecutableNOT
File FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
RWX
Owner: System RWX
“System”
User
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT Figure
FOR3.12
SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Access rights to executable files.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 118 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
118 CHAPTER 3 | Controlling Files

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION
RW- User NOT FOR SALE OR DISTRIBUT
Bob’s Files
Bob’s Files “Bob”
Owner: Bob
Bob’s
Owner: Files
Bob
Owner: Bob

© Jones & Bartlett Learning, LLC RW- © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
“System”
RW- User

Suitemates’
Suitemates’
Files
© Jones & Bartlett Learning, Suitemates’
LLC
Files © RW-
Jones & Bartlett Learning, LLC
Owner:
Owner:Files
NOT FOR SALE OR DISTRIBUTION
Suitemates
Owner:
Suitemates
NOT FOR SALEUser
OR DISTRIBUTION
“Suitemates”
Suitemates

Figure 3.13
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Access
NOTrights
FOR to SALE
personalOR
[Link] NOT FOR SALE OR DISTRIBUT

In Figure 3.14, we have three sets of flags. Each set specifies the basic rights of Read,
Write, and Execute (or Seek for directories), and associates the rights with one of three
specific classes of users:
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
• Owner NOT FOR SALE OR DISTRIBUTION
rights—the user who owns the file in question
• System rights—privileged processes run by the system
• World rights—all users other than the owner and the system
This allows us to define access rights with a compact set of nine flags, along with the
© Jones & Bartlett Learning, LLC of the file’s owner.
user identity © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
Because the operating system NOTkeeps
already FOR SALE
track of theOR DISTRIBUTION
owner of every file and other
major resources, our solution doesn’t need to explicitly identify users. All it needs to do

©Owner
JonesRights
& Bartlett Learning, LLC
System Rights © Jones & Bartlett Learning, LL
World Rights
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

Read Write Execute Read Write Execute Read Write Execute

© Jones & Bartlett
Figure 3.14
Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
A set of file permission flags.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 119 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.5 File Security Controls 119

Controlling Files
World©Rights
Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

R--
Read Write Execute in text form
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOTFigure
FOR3.15
SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Flags for compact access rules.

is identify the rights granted to the owner, the system, and the rest of the user commu-
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
nity (the “world”). A user with administrative rights receives “System” access rights to
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
files and resources. Most systems also can grant access rights to predefined “groups” of
users; we will discuss that in Chapter 4.
Although we’ve reduced the rights to a very compact set, they still carry a great deal
of redundancy. Typically, owners get full access to their files. Administrators and privi-
© Jones
leged user identities & Bartlett
associated Learning,
with system LLC like a “System” user, typically
operations, © Jones & Bartlett Learning, LL
NOT
get full access FOR SALE
to everything. The OR DISTRIBUTION
important NOT
differences in access rights arise when weFOR SALE OR DISTRIBUT
specify access rights for the rest of the user community.
In most examples and exercises in this chapter, we use a simplified set of rights called
compact access rules. Figure 3.15 illustrates such a rule.
Compact access rules reflect two common assumptions. First, they assume that the
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
owner of a file or folder has full access rights to it. Second, they assume that system pro-
NOTcesses,
FORorSALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
those running under a “System” user ID, have full access rights to all files and
folders on the computer. We may safely use these assumptions while working problems
in this chapter.
We abbreviate a compact access rule with three letters. As shown in Figure 3.15, the
© Jones & Bartlett Learning,
letters represent LLC © Jones
read, write, and execute rights. Thus, the&permission
Bartlett R-E
Learning, LLC
allows read
and execute
NOT FOR SALE OR DISTRIBUTION to other users, while --- allows no access to other users.
NOT FOR SALE OR DISTRIBUTION
SYSTEM AND OWNER ACCESS RIGHTS IN PRACTICE
If our examples omit owner and system access rights, we should ask some obvious ques-
tions: Why would any system allow us to specify owner and system access rights? Why
would we ever © Jones
want to & Bartlett
restrict accessLearning, LLCor by the system? The answer
by a file’s owner © Jones
is, & Bartlett Learning, LL
NOTPrivilege.
of course, Least FOR SALE Access OR DISTRIBUTION
restrictions NOT
sometimes make sense for individual FOR SALE OR DISTRIBUT
own-
ers or for the overall system.
For example, some owners explicitly set valuable files to be read only simply to pro-
tect the files from accidental damage. If the owner edits the file by mistake or runs a pro-
gram that
© Jones might change
& Bartlett it somehow,
Learning, LLCthe file system will deny ©access.
Jones & Bartlett Learning, LLC
Operating systems are large and complex, so Least Privilege helps keep components
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
from injuring one another. Early versions of the Unix system, for example, ran most

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 120 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
120 CHAPTER 3 | Controlling Files

system processes
© Jones with the “root”
& Bartlett user identity.
Learning, LLC As we saw in Section 2.3, this led &
© Jones to Bartlett Learning, LL
disaster when the Morris worm hit. Modern Unix systems, and their derivatives like
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
OS-X and Linux, run as few processes as possible using the “root” user identity.
When we create a new file on Microsoft Windows, it will, by default, be accessible by
the “SYSTEM” user identity and by administrators. We can remove those permissions
and still, as the owner, read and write the file. The access permissions apply to any pro-
© Jones & cesses
Bartlett
that Learning,
belong to the LLC
“SYSTEM” user identity, while© Jones
the true& Bartlett
“kernel” Learning,
of the operat- LLC
NOT FOR SALE ORisDISTRIBUTION
ing system not really restricted by such rules. Thus,NOT
we canFOR SALE
still read and OR
writeDISTRIBUTION
our file
even though “SYSTEM” processes cannot.
On some high-security systems, the security policy forbids administrators to look at
certain types of sensitive information stored on the computer. Such systems should
block access to that information, even when using a “SYSTEM” user identity, unless the
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
specific individual is allowed to use the sensitive data. Thus, some administrators may
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
be able to look at the highly sensitive data while others are blocked from that data.
In this chapter, we focus on simple cases and assume that both the file’s owner and
the system have full access rights to it. The only access rights we need to specify are for
“world” access to files.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOTSecurity
3.5.2 FOR SALE OR DISTRIBUTION
Controls to Enforce Bob’s Policy NOT FOR SALE OR DISTRIBUT
The diagrams are useful to illustrate how users can (or can’t) share information on the
system. To actually implement a policy, we produce a more detailed list of security con-
trols. Bob’s isolation policy, described in Tables 3.3 and 3.4, requires some general secu-
© Jones & rity
Bartlett Learning,
controls LLC access rules. These appear
and some specific © Jones & Bartlett
in the following Learning, LLC
tables.
NOT FOR SALE First,OR DISTRIBUTION
we specify NOT3.6.
the general security controls in Table FOR
TheseSALE ORestablish
controls DISTRIBUTION
user identities and passwords on Bob’s computer. These controls follow the format
introduced in Section 2.6.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT Bob’s
TABLE 3.6 Security controls to implement FORisolation
SALEpolicy
OR DISTRIBUTION
# Control Description Policy Statement
Category

1 Logical Bob has a personal user identity on the computer. 2, 5, 6

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
2 NOTLogical
FOR SALE OR
Bob must useDISTRIBUTION
a password to log in. NOT
6 FOR SALE OR DISTRIBUT
3 Logical Suitemates have a single user identity on the computer that 2, 7
they all share.

4 Logical Suitemates do not need to use a password to log in. 7

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 121 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.5 File Security Controls 121

Controlling Files
TABLE 3.7 © Jonesaccess
Compact & Bartlett Learning,
rules for Bob’s isolationLLC
policy © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
# File Type File Owner World Access Policy Statement

6 Executable programs System R-X 3, 4

7 Bob’s data files Bob --- 5

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
8 Bob’s directory Bob --- 5
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
9 Suitemates’ data files Suitemates --- 5

10 Suitemates’ directory Suitemates --- 5

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
To specify access rules, we need a different format. We will use a simple format that
makes use of compact access rules; it lists the three-letter abbreviation for the “World”
access rights, and also identifies the file’s owner.
© Jones
To simplify & Bartlett
matters further, we listLearning, LLC
“types” of files © Jones & Bartlett Learning, LL
instead of listing all files individu-
NOTthat
ally. We assume FOR SALE OR
the specified DISTRIBUTION
access NOT
rights are associated with all files of each FOR SALE OR DISTRIBUT
speci-
fied type and owner. The resulting table of compact access rules appears in Table 3.7.
Note that the “File owner” column does not consistently refer to Bob even though he
is the owner of the computer. The column indicates the computer user that owns the
particular
© Jones file. TheseLearning,
& Bartlett rules assumeLLC
Bob logs in as the user “Bob” and that &
© Jones hisBartlett
suitematesLearning, LLC
NOTlogFORin as “Suitemates.” If Bob always logs in as an administrator, then he gets “System”
SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
access rights, which gives him access to every file on his computer.

3.5.3 States and State Diagrams

States and state diagrams give us a different way of organizing and looking at parts of a
© Jones & Bartlett Learning,
complex [Link]
While we can always look at©aJones & breaking
system by Bartlettit Learning, LLC
into pieces and
NOT FOR SALE OR DISTRIBUTION
examining NOT
individual parts, a state diagram gives us FOR
a way SALE OR DISTRIBUTION
to systematically break up its
behavior.
Engineers apply state diagrams to all kinds of systems. At the circuit level, engineers
can implement a diagram directly in hardware. At the system level, states and state dia-
grams provide© Jones
a way to&break
Bartlett Learning,
complicated systemLLC © Jones & Bartlett Learning, LL
behavior into separate and more
comprehensible activities.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
The individual “states” reduce the system’s behavior into a manageable number of
separate situations. The state diagram gives us a simple image of how the system
behaves. For example, Figure 3.16 presents a state diagram for a door.
To create a state diagram, we look at the system and divide its behavior into a small
© Jones
number& of
Bartlett Learning,
completely LLC
separate conditions. © Jones
Each condition becomes & Bartlett
a “state.” Then weLearning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 122 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
122 CHAPTER 3 | Controlling Files

© Jones
Knock & Bartlett Learning,
on the door Open the doorLLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

State: State:
Closed Open
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

Close the door

Figure 3.16
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
State diagram showing a door’s operation.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

identify events that take place, especially those that cause the system to change from one
state into another.
©
In Jones & Bartlett
Figure 3.16, Learning,
we have two LLCa door can only be “Open”
states because © Jones & Bartlett Learning, LL
or “Closed.”
WeNOThave three possible events: knocking,
FOR SALE OR DISTRIBUTION opening, and closing. The door actually
NOT FOR SALE OR DISTRIBUT
changes state when we open or close it. Knocking causes no change at all.
For the state diagram to be useful, it must capture all relevant and possible events,
especially those that change states. Figure 3.16 presents a very limited view of a door,
because it says nothing about locking or unlocking, or even about responses to knock-
© Jones & ing.
Bartlett
In fact,Learning,
knocking is LLC
clearly unnecessary, because © theJones
diagram&shows
Bartlett Learning,
the door opens LLC
NOT FOR SALE OR DISTRIBUTION
and closes regardless of whether knocking took place. NOT FOR SALE OR DISTRIBUTION

INFORMATION STATES
We also talk about data or information as having states. Here are the fundamental
information states:
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
• Storage state—the NOT
information FOR
is stored andSALE OR DISTRIBUTION
is not currently being processed. We
also call this state “data at rest.”
• Processing state—the information is being used by an active process to make deci-
sions or to transform the information into another form. This is “data in use.”
© Transmission
• Jones state—the
& Bartlett information
Learning, is being moved from one storage
LLC © Jonesarea &
to Bartlett Learning, LL
another. This is “data in motion.”
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Figure 3.17 shows a state diagram for Bob’s essay file. We initially create files in an
application program, so Bob creates it in the Processing state. When he saves the file, he
puts it into the Storage state. If he moves it onto a removable drive, it enters the Trans-
mission state.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
In this diagram, we process either new or stored data. We save the result as stored
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
data. We don’t use processing to transport data; we simply move the data to a portable

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 123 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.6 Patching Security Flaws 123

Controlling Files
© Jones & Bartlett
SaveLearning,
the file LLC © Jones & Bartlett Learning, LL
NOT
Create the file FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

State: State:
Processing Storage

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR
Open the DISTRIBUTION
file NOT FOR SALE OR DISTRIBUTION
for editing

Retrieve from Move to

removable removable
© Jones & Bartlett Learning, LLC drive © State:
Jones& Bartlett
drive Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR
Transmission SALE OR DISTRIBUTION

Figure 3.17
Information states of the essay file.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
medium. In this environment, data never moves directly from the Processing state to the
Transmission state.
A closed door has different security implications than an open one. The same is true
for information states. Each reflects a different access control environment. The storage
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
state involves files and their access rights. The processing state refers to the world of
NOTprocesses
FOR SALE OR DISTRIBUTION
and RAM-based access control.
NOT FOR SALE OR DISTRIBUTION
When we transmit information between programs or processes inside an operating
system, the storage and processing controls protect those operations. When we move a
file to removable storage, like a USB drive, we move it away from the protections
© Jones & Bartlett Learning,
enforced by our LLC © Jones
operating system. This also happens when& Bartlett
we transmit Learning,
informationLLC
NOT FOR SALE OR DISTRIBUTION
across a network, as we will see in Chapter NOT FOR SALE OR DISTRIBUTION
10.

3.6 Patching Security Flaws

© Jones
Technical systems & have
always Bartlett
[Link], LLC telegraph and telephone
In the 19th century, © Jones
tech- & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION
nicians spoke of “bugs in the wire” as the source of unexplained buzzing NOT FOR SALE OR DISTRIBUT
noises and
other hard-to-fix problems. We still chase bugs in technical hardware and in software.
Although system developers would like to build error-free software, this has proven
impractical. Social and economic reasons encourage people to buy lower quality soft-
ware at lower prices. Software vendors then provide bug fixes when existing flaws cause
© Jones & Bartlett Learning, LLC
too much trouble, or worse, open customer computers to attack.
© Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 124 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
124 CHAPTER 3 | Controlling Files

THE©PJones PROCESS
ATCHING & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Most
NOT FOR developers
software SALE OR useDISTRIBUTION
a carefully designed process to handle bug
NOT fixes.
FOR TheSALE
pro- OR DISTRIBUT
cess collects problem reports and eventually develops a software patch to fix the prob-
lem. A patch is a piece of binary data that modifies the instructions in a program to
correct a problem. Most modern computing systems have special software to apply
patches to existing software.
© Jones & Bartlett Learning,
The alternative LLC is to reinstall a new copy
to patching © Jones & Bartlett
of the original Learning,
software. Mod- LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
ern software packages often grow quite large. It is more efficient to distribute a patch,
even if it contains several million bytes of data, than to replace a 100-million byte pro-
gram.
There are always more problems to fix than resources to fix them. Developers use the
© Jones & Bartlett Learning, LLC
process © Jones
to prioritize flaws, develop fixes, & Bartlett
and distribute [Link], LLCfollows
A typical process
these
NOT FOR SALE OR DISTRIBUTION steps: NOT FOR SALE OR DISTRIBUTION
1. Collect error reports. These may come directly from individual customers, from
companies that use the software, or from news reports of problems. In the worst
case, error reports may come from national flaw reports, like the Common Vulner-
abilities and
© Jones Exposures
& Bartlett database. LLC
Learning, © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION
2. Prioritize errors and assign for investigation. A team of softwareNOT FOR
engineers SALE OR DISTRIBUT
reviews
the error reports and assigns the highest priority ones to engineers to investigate
and to try to fix.
3. The engineer develops a fix for the software problem. This yields a change to the
software containing the flaw.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
4. Another team of engineers reviews proposed bug fixes for release in an upcoming
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
patch. The team selects the fixes to include, and integrates those fixes into a new
patch.
5. Test the patch. A test team applies the patch to different versions of the software
and tests them for correctness and stability. The vendor doesn’t want to release a
© Jones & Bartlett Learning,bug
LLC © Jones & Bartlett Learning, LLC
fix that makes matters worse.
NOT FOR SALE OR DISTRIBUTION NOT FOR
6. Release the patch. Software engineers SALE
package the OR
bug DISTRIBUTION
fixes into a patch file for
automatic installation. They place the patch on the vendor’s website and ensure
that automatic patching software can find and install it.
Many bugs may take weeks or months to work their way through this process.
© Jones
Higher priority&bugs,
Bartlett Learning,
like those that poseLLC
a serious security risk, may ©
be Jones & Bartlett Learning, LL
fixed sooner.
NOT
Given FOR SALE
a sufficiently ORbug,
serious the process may only take a matter ofNOT
DISTRIBUTION [Link] SALE OR DISTRIBUT

SECURITY FLAWS AND EXPLOITS

In the ideal case, a small number of people in the security community find out about a
software security flaw and the vendor develops a patch for it. The general public doesn’t
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
really learn about the flaw until the patch appears. Then a race begins between black-
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 125 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.6 Patching Security Flaws 125

Controlling Files
© Patch
Jones & Exploit
Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Released Created
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Number
of
Attacks

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Time Jan - Feb - Mar - Apr - May - Jun - Jul - Aug - Sep - Oct - Nov

Figure 3.18
© Jones & Bartlett Learning,
Time LLC unpatched flaws.
line for attacking © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

hat hackers who want to use that vulnerability to attack systems, and end users who
want to patch their systems.
Many end users fail to patch their computers, even when patches are available for
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
known vulnerabilities. Figure 3.18 summarizes the typical patching experience in the
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
late 1990s. The vendor issues a patch in January. By March, black hats have reverse-
engineered the patch to figure out the vulnerability, and they construct an exploit: mal-
ware that uses the vulnerability in an attack. The black hats then search out and attack
the unpatched systems.
© Jones & network
Using Bartlettscanning
Learning, LLCblack hats could search ©
software, theJones
Internet&
andBartlett
identify Learning, LLC
NOTunpatched
FOR SALE OR DISTRIBUTION
computers. The exploit software then successfully NOT
attacksFOR
those SALE
[Link] DISTRIBUTION
Matters may have improved somewhat in recent years, since the patching process has
become more efficient, reliable, and automatic. Technophobic users can set their com-
puters to update software automatically. Even so, countless computers often go
unpatched.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
WINDOWS OF VULNERABILITY NOT FOR SALE OR DISTRIBUTION
Today, every potential vulnerability represents a race between the white-hat and black-
hat communities. White hats, including responsible security researchers and vendors, try
to find security flaws and deploy patches before exploits arise. Black hats try to identify
flaws and construct
© Jones exploits before the
& Bartlett patches appear.
Learning, LLCThe ideal goal for a black hat is & Bartlett Learning, LL
© Jones
to construct a zero-day exploit: one for which no patch yet exists.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Figure 3.19 illustrates this race between black hats and white hats using a state dia-
gram. The diagram follows the history of a security vulnerability, relative to a particular
piece of software installed by a particular end user. The software starts out in the Hard-
ened state, which means that the user has patched it for all known weaknesses. The soft-
© Jones & Bartlett
ware enters Learning,
the Flawed state whenLLC © Jones a&flaw.
someone—white hat or black—finds Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 126 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
126 CHAPTER 3 | Controlling Files

© Jones & Bartlett Learning,

Flaw State:LLC Exploit © Jones & Bartlett Learning, LL
NOT FOR
FoundSALE OR DISTRIBUTION
Flawed Created NOT FOR SALE OR DISTRIBUT

Patch
Released

© Jones & Bartlett Learning,

FlawLLC © Jones & Bartlett Learning, LLC
NOT FOR SALEState:
OR DISTRIBUTION
Patched State: NOT FORState:
SALE OR DISTRIBUTION
Hardened Patchable Unprotected

Exploit
Created
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Flaw State: Patch
Patched Vulnerable Released

Figure 3.19
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
Software vulnerability state diagram.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

If matters progress as shown in Figure 3.18, then the vendor releases a patch and the
software enters the Patchable state. If the user immediately patches the software, it
© Jones & returns
Bartlett Learning,
to the HardenedLLC state. Otherwise, it moves to©theJones & Bartlett
Vulnerable Learning,
state when an LLC
NOT FOR SALE OR DISTRIBUTION
exploit appears. NOT FOR SALE OR DISTRIBUTION
The software remains vulnerable while an exploit exists and the software remains
unpatched. We call this the window of vulnerability: the period of time during which a
system is unprotected from an exploit. As long as the software remains unpatched in the
face of a possible exploit, it is vulnerable to attack.
© Jones & Bartlett Learning, LLC we face a zero-day exploit,
If, however, © Jonesthen &theBartlett Learning,
software moves to the LLC
Unprotected
NOT FOR SALE OR DISTRIBUTION
state. The user has no choice but to NOT FOR
be stuck in a SALE
windowOR DISTRIBUTION
of vulnerability until the ven-
dor releases the patch. The only alternative is to stop using the vulnerable software.
The Unprotected state also may arise when we install new software from a CD or
other distribution media. The distribution disk may contain an older version of the soft-
ware that lacks&the
© Jones latest patches.
Bartlett Thus, the
Learning, LLC newly installed software may start out
© Jones & in
Bartlett Learning, LL
the Unprotected state.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
This was a particular problem with Windows XP, the version used in the early 2000s.
Various estimates in 2005 suggested that an unpatched Windows XP machine would
only last a matter of minutes before being attacked on the Internet. When a user
installed Windows XP from a distribution CD, the system would remain Unprotected
© Jones & Bartlett Learning,
while it connected to theLLC
Internet and downloaded the © patches
Jonesneeded
& Bartlett Learning,
to reach a Hard- LLC
NOT FOR SALE OR
ened state. DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 127 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.7 Process Example: The Horse 127

Controlling Files
© Jones
3.7 Process & Bartlett
Example: Learning, LLC
The Horse © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Helen eyed the horse suspiciously. She accompanied Husband Number Three, who was
known as Deiphobus, Prince of Troy.
Following Helen’s kidnapping 10 years earlier (or was it an elopement—no one knew
for
© Jones sure), the Greeks
& Bartlett had been making
Learning, LLC war on the city of Troy.© Jones & Bartlett Learning, LLC
Now the Greek camp was empty and burned. Their ships were gone. All that
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
remained was a huge wooden statue of a horse (Figure 3.20). The Greeks also had left a
messenger; he claimed the horse was an offering to the goddess Athena for their safe trip
home.
The people of Troy already had dragged the huge statue through the gates and into
© Jones & Bartlett
theLearning,
city. LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE ORHelenDISTRIBUTION NOT FOR
walked around the horse with her prince, SALE
examining OR DISTRIBUTION
it closely. Were warriors
hidden inside? Helen called out the names of famous Greek warriors, trying to mimic
the sound of their wives’ voices. No Greek voices responded. Perhaps she suspected
what Odysseus told her later; he was keeping the Greeks silent while she tried to trick
them into speaking.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

Figure 3.20
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT Drawing
FOR SALEof the OR
Trojan horse. From The Children’s Hour, Tappan,
DISTRIBUTION ed., 1907.
NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 128 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
128 CHAPTER 3 | Controlling Files

Like
© Helen,&many
Jones Trojans
Bartlett saw the horse
Learning, as a menace. They said it ©
LLC should
Jones be broken
& Bartlett Learning, LL
up, burned, or dragged to the city’s heights and pushed off, letting it fall to its ruin.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Others argued that the statue should be kept as an offering to the gods while the city
celebrated its victory against the Greeks. This argument was enough to satisfy most peo-
ple and the celebrations began in earnest.
Helen’s suspicions were, of course, correct.
© Jones & Bartlett Learning,
Hours later, a force ofLLC © Jones
Greeks emerged from the statue. They & Bartlett
found the cityLearning,
asleep LLC
NOT FOR SALE
after theOR DISTRIBUTION
night NOT
of festivities. The soldiers opened the city FOR
gate SALE
to admit the OR DISTRIBUTION
rest of the
Greek army. Troy soon fell, as the Greeks defeated the Trojans inside the city walls.

3.7.1 Troy: A High-Level Analysis

© Jones & Bartlett Learning,
AlthoughLLC © Jones
the technology of the Trojan & Bartlett
horse might Learning,
not directly LLC com-
apply to modern
NOT FOR SALE OR DISTRIBUTION NOT security.
puting, it is a popular symbol in computer FOR SALE When OR DISTRIBUTION
a computer program contains
secret, malicious behavior that may injure its unsuspecting user, we call it a Trojan
horse. For some experts, a “Trojan” virus is one that performs a damaging act in addi-
tion to spreading itself around. Other experts consider the spreading process itself to be
damaging, and classify all viruses as Trojan horse programs.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
However, this terminology is not relevant to this particular section: we will apply the
NOT FOR SALE OR DISTRIBUTION
six-part security process to the original Trojan horse. NOT FOR SALE OR DISTRIBUT
Assets: For this discussion, we will focus on a single Trojan asset: their city. For the
city to thrive, the people need food and trade, and conquerors must be kept away.
Risks: During the war, the Trojans were at risk of attack from the Greeks. The
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
ancient city of Troy was protected by high walls that made it invulnerable to direct
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
assaults by soldiers on foot or on horseback. Primitive weapons of the time could not
breach those walls while defenders fought back.
The remaining weakness was at the city gates, which needed to be opened for trade
and provisioning, and closed when the Greek army moved to attack the city.
© Jones & Bartlett Learning, LLC
Policy: Since we are focusing on the © safety
Jones of &
theBartlett Learning,
city of Troy LLC policy
itself, the security
NOT FOR SALE OR DISTRIBUTION
would simply forbid enemy warriors NOT FOR
from SALE
entering the OR DISTRIBUTION
city. The policy would further
specify the boundary to be the city’s defensible walls. If the Greeks were kept outside,
the Trojan defenders could rely on strong gates and high walls.
Implementation: We have specified the policy in terms of the city’s boundary, and the
© Jonesis&implemented
boundary Bartlett Learning,
by the city’s LLC
defensive walls. © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION
The city has a main gate. Just like a door has two states, the city’s NOT FOR
defenses SALE OR DISTRIBUT
had two
states, based on the condition of the main gate.
In the first state, the city gates were closed. We assume that the city does not contain
enemy warriors. If that is true, then as long as the gate remain closed, no enemy war-
riors canLearning,
© Jones & Bartlett invade the city.
LLC However, the gate cannot©remain
Jones closed indefinitely.
& Bartlett It must LLC
Learning,
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 129 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.7 Process Example: The Horse 129

Controlling Files
be opened ©occasionally to allow traffic
Jones & Bartlett for tradeLLC
Learning, and provisions, or the population
© Jones & Bartlett Learning, LL
would starve.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
In the second state, the gate was opened to allow food and traders to enter the city.
Enemy warriors, however, were not allowed in the city. If any were spotted, they
were captured. If an enemy army approached the city while the gate was opened, the
city switched to its other state by closing its gate.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
Monitoring: Trojan warriors guarded the city against the entry of Greek warriors
NOT FOR SALE OR DISTRIBUTION NOT FOR
and, in general, the Greeks stayed out. On one occasion, however, SALEOdys-
the warrior OR DISTRIBUTION
seus himself dressed as a beggar and snuck into the city. Small incidents like that did
not lead to disaster.
The Trojan horse allowed a team of Greek warriors into the city. Helen clearly sus-
© Jones & Bartlett pected
Learning, LLC
this, but © Jones
her security analysis was not & Bartlett
convincing to the rest Learning, LLC
of the city. The
NOT FOR SALE ORhorse DISTRIBUTION NOT FOR
was left unguarded as the city prematurely SALE
celebrated OR DISTRIBUTION
its victory.
Recovery: Unfortunately for Troy, the final Greek attack was thoroughly successful.
The archeological site attributed to Troy was destroyed in the 13th century BC and
another city did not develop there for over 1200 years.
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
3.7.2 Analyzing the Security Failure
Let us examine the fall of Troy in terms of the process just described. The Trojans suf-
fered failures in monitoring, in implementation, and in policy.

© Jones & Bartlett

Monitoring: Learning,
Despite LLC by Helen and her prince
the care shown © in
Jones & Bartlett
examining the horse,Learning, LLC
NOT FOR SALE
they did OR DISTRIBUTION
not detect the warriors hidden inside. They did notNOT
post aFOR
guardSALE
aroundOR
the DISTRIBUTION
horse, despite their suspicions.
Implementation: There was no process in place to prevent the unusual Greek gift, the
wooden horse, from being dragged into the city by the city’s populace. Once the
© Jones & horse was in the
Bartlett Learning, LLCcity, it remained unguarded
© while
Jones the &
cityBartlett
celebrated victory overLLC
Learning, the
Greeks.
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
Policy: The Greeks had burned their camp and their ships were gone. Many Trojans
believed that the Greek threat was over and that wartime security policies no longer
applied. No lookouts on the walls or guards at the city gates sounded the alarm when
the Greeks marched up to the city. The populace had, in effect, nullified the policies
© Jones & Bartlett Learning, LLC
by ignoring them.
© Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
Failures teach important lessons about security, even when the event doesn’t involve
computers or technology.

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 130 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
130 CHAPTER 3 | Controlling Files

3.8 Chapter Resources

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

IMPORTANT TERMS INTRODUCED

capability hierarchical directory software patch
© Jones & Bartlett
capability-based security Learning, information
LLC states © Jones & Bartlett Learning, LLC
state diagrams
NOT FOR SALE OR DISTRIBUTION
censorware interpreter NOTstates
FOR SALE OR DISTRIBUTION
compact access rules isolation policy storage state
content control software macro subject
default permit objects system rights
Deny by Default owner rights tailored policy
directory path permission flags transmission state
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
drive-by download processing state Trojan
NOT FOR SALEexecute
OR DISTRIBUTION
right rights NOT FOR SALE OR
windowDISTRIBUTION
of vulnerability
exploit root directory world rights
file folder scripting language zero-day exploit
file-sharing policy seek right
global policy shell script
© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
ACRONYMS INTRODUCED
CRUD—Create, read, update, delete access rights
MBR—Master boot record
© PDF—Adobe
Jones portableLearning,
& Bartlett document format
LLC © Jones & Bartlett Learning, LLC
RWX—Read, write, execute access rights
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

3.8.1 Review Questions

R1. Explain the role of a file name and path in R7. What is “Seek” access and how is it dif-
© Jones & Bartlett locating a file
Learning, LLC on a hard drive. © Jonesferent from “Read”
& Bartlett access? LLC
Learning,
NOT FOR [Link]
DISTRIBUTION
the four basic access rights for NOT
[Link] SALE
Describe theOR DISTRIBUTION
format of an executable file.
files and other resources in general. R9. Why would we restrict access to execut-
R3. Give reasons why a user would protect a able files?
file from read or write access by other R10. Describe how a virus operates and
users. © Jones & Bartlett Learning, LLCspreads. © Jones & Bartlett Learning, LL
NOT
R4. How does FOR SALE
the operating OR
system DISTRIBUTION
decide NOT FOR
R11. Explain the difference between SALE
a virus, a OR DISTRIBUT
what permissions to apply when a user worm, and a Trojan.
creates a new file? R12. Summarize the policy for enforcing isola-
R5. Explain how the four basic access rights tion among users.
© Jones & Bartlett
of files Learning,
and directories LLC
interact. © Jones & Bartlett Learning, LLC
R13. Summarize the policy to provide file shar-
NOT
R6. FOR
WhatSALE
does it OR
meanDISTRIBUTION
to have “Execute” NOT FOR SALE OR DISTRIBUTION
ing among users.
access to a file?

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 131 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.8 Chapter Resources 131

Controlling Files
R14. When© weJones
wish to&specify file-access
Bartlett Learning, LLCR20. Summarize the information
© Jones needed to
& Bartlett Learning, LL
rights,NOT
whichFOR
elements serve as subjects
SALE OR DISTRIBUTION specify a file’s access rights using permis-
NOT FOR SALE OR DISTRIBUT
and objects in the access matrix? sion flags.
R15. Explain the difference between a default R21. Describe the differences between listing
permit policy and one that enforces Deny customary security controls (Table 3.6)
and compact access rules (Table 3.7).
© Jonesby &Default.
Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOTR16.
FOR SALE
Name ORrequirements
the two DISTRIBUTION that must R22. Describe
NOTtheFOR differences
SALEbetween an
OR DISTRIBUTION
remain true in order for an operating sys- access matrix and a table of compact
tem to enforce its policy. access rules.
R23. Explain how the Morris worm took
R17. Why do we say that “capabilities” repre-
advantage of a failure to use Least Privi-
© Jones & Bartlett Learning, LLC of access rights “by © Jones &
sent the clustering Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION
column”? NOT FORlege.
SALE OR DISTRIBUTION
R24. Describe the components of a state dia-
R18. Give examples of systems that use capa-
gram.
bility-based security.
R25. List the typical steps a vendor follows to
R19. Do most modern operating systems spec-
© Jones & Bartlett Learning, LLC release a software patch.
ify file permissions with a “cluster by
© Jones & Bartlett Learning, LL
NOT FOR SALE OR DISTRIBUTION
row” or “cluster by column” strategy?
R26. Explain two differentNOT FORin SALE
situations which OR DISTRIBUT
a window of vulnerability might arise.

3.8.2 &Exercises
© Jones Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOTE1.
FOR SALE
Search the OR DISTRIBUTION
directory on your computer. E2. Can NOT FOR
you create SALE
files ORdirectory
in the root DISTRIBUTION
of
Locate the root folder. From there, locate your system? If so, create a file or folder
the following files and provide the full and then delete it. If the attempt fails,
path and file name for each: describe the error message displayed.
a. The word-processing
© Jones & Bartlett Learning, LLC program you © Jones
E3. & Bartlettwhether
Determine Learning, LLCyou use
the system
typically use.
NOT FOR SALE OR DISTRIBUTION NOT FORimplements
SALE ORanDISTRIBUTION
isolation policy or a user-
b. A text or word-processing file in your sharing policy. Describe the steps you
“documents” directory (the directory took to verify your conclusion.
in which programs typically save files
Determine whether the system you use
E4.
for ©
you).
Jones & Bartlett Learning, LLC © to
will allow a file’s owner Jones & Bartlett
block access to Learning, LL
NOT FOR SALE OR DISTRIBUTION
c. A file containing your “preferences” an owned file. Create NOT FOR SALE OR DISTRIBUT
a file and try to
for a program like a web browser or remove the owner’s Read or Write per-
word processor. mission from the file. Did the system
d. A file you downloaded from the Inter- remove the right or not? How could you
© Jones & Bartlett Learning, LLC
net using your browser. tell?© Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 132 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
132 CHAPTER 3 | Controlling Files

Find out©
E5. about
Jonesantivirus softwareLearning,
& Bartlett on the LLCCreate a table of compact
E10. access rules
© Jones & Bartlett Learning, LL
computer you use.
NOT FOR SALE OR DISTRIBUTION that enforces the file-sharing
NOTpolicy
FOR SALE OR DISTRIBUT
described in Table 3.5. The compact
a. Is antivirus software installed?
access rules should use the same format
b. What kind is it?
as Table 3.7.
c. Can you tell if it works? Why or why
© Jones not?& Bartlett Learning, LLC © Joneswas
E11. Alice’s computer & Bartlett
infected byLearning,
Virus X, LLC
[Link] SALE OR DISTRIBUTION
Has it ever reported a virus to you? If so,
NOT
which attached FOR
itselfSALE
to all ofOR
her DISTRIBUTION
applica-
tions. Bob lent her a file-searching utility,
describe how it handled the virus.
which was stored on a USB stick. This
E6. Using the story of the Trojan horse as an utility, however, was infected by Virus Y,
analogy, give two examples of “Trojan”
© Jones & Bartlett Learning, LLC © Joneswhich then infected
& Bartlett all of Alice’s
Learning, LLCapplica-
attacks in computer systems. Explain why tions, too. Thus, each application con-
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
the examples fit the analogy of the Trojan tained two virus infections. Draw a
horse. diagram based on Figure 3.7 to show
E7. Search the Internet for information on both infections in a single application file.
different©malware
Jonespackages, like those
& Bartlett Learning, LLC © Jones & Bartlett Learning, LL
discussedNOT
in theFOR
text. Find a description of Riko is writing a program. Bob’s computer
SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT
contains a compiler that will take Riko’s source
a malware package not described in the
code (the program she’s written) and produce
text. Provide the following information
an executable program file (with a “.exe” suf-
about the malware:
fix). Thus, we have three users of interest: Bob,
a. What is the malware
© Jones & Bartlett Learning, LLCcalled? © Jonesand
Riko, and Suitemates, & Bartlett
these files: Learning,
the com- LLC
NOT FOR
b. HowSALE
does OR DISTRIBUTION
it propagate? piler, Riko’s NOT
writtenFOR SALE
program, andOR DISTRIBUTION
the execut-
c. What does it do to the computers it able program built by the compiler. We need to
infects? implement the policy in Table 3.8.

E8. Bob would like to be able to look at files in

© Jones & Bartlett the
Learning, LLC
“Suitemates” folders without having to © Jones
TABLE &
3.8Bartlett
Policy forLearning, LLCcustom
protecting Riko’s
program
NOT FOR SALE ORlog DISTRIBUTION
in as Suitemates. Take these steps to NOT FOR SALE OR DISTRIBUTION
create a security plan to achieve this goal. # Policy Statement Risks
a. Create a revised policy to reflect this 1 Everyone shall have execute access 1, 2
objective. to the compiler program.
b. Draw © Jones illustrating
a diagram & Bartlett Learning, LLC
access 2
© Jones 2,&4,Bartlett
Riko shall have full access to the 5
Learning, LL
rights NOT FOR SALE
that implement OR DISTRIBUTIONprogram’s source code. NOT FOR SALE OR DISTRIBUT
this policy.
c. Create a table of compact access rules 3 Riko shall have full access to the 2, 5
that implements the revised policy. Use program’s executable file.
the format shown in Table 3.7. 4 Bob shall have read and execute 1, 2,
© Jones & Bartlett Learning, LLC access©toJones & Bartlett
the program’s executable Learning,
4, 5 LLC
E9. Create a diagram portraying access rules
NOT FOR SALE OR DISTRIBUTION file. NOT FOR SALE OR DISTRIBUTION
that enforces the file-sharing policy
described in Table 3.5.

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 133 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 3

3.8 Chapter Resources 133

Controlling Files
Answer the ©following
Jonesquestions based
& Bartlett on the
LLC Indicate access rights©
Learning, with arrows&and
Jones Bartlett Learning, LL
scenario just described. labels (RWX). Be sure
NOT FOR SALE OR DISTRIBUTION NOT FORrights
the access SALE OR DISTRIBUT
E12. Draw a diagram showing the user and file allow the work just described and still
access rights that implement the file-shar- achieve Least Privilege.
ing policy in Table 3.8. Create a diagram E13. Construct an access matrix that provides
© Jonessimilar to Figure
& Bartlett 3.12 that includes
Learning, LLC the © Jones
the user and file & Bartlett
access rights Learning,
needed to LLC
correct users, files,
NOT FOR SALE OR DISTRIBUTION and permissions. NOT FOR
implement SALE
the policy OR 3.8.
in Table DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION
 61417_CH03_Smith.fm Page 134 Wednesday, September 21, 2011 1:54 PM

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LL

NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUT

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION

© Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION. 3723

© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC
NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION