Chapter 3-Controlling Files Flashcards | Quizlet [Link]
Chapter 3-Controlling Files 21 terms by ashlynbagge
Chapter 3 Overview The le system and le access rights
Executable les
Computer viruses and malware
Policies for le protection
Security controls and le permission
flags
Information states
Security patching
The File System Modern computers keep les in a
hierarchy of names - a hierarchy of
"folders" or "directories"
Each le has a path name
Identies the directory entries to follow
to nd the le
The le name selects the right le in
the nal directory in the path
Files are owned by a user, usually the
creator
Access rights are tied to user identities
Example: Bob can read the le, but
Alice can't
File and Directory Access Rights CRUD" - Create, Read, Update, Delete
Many systems let us control those
rights
Dierent eects on les and directories
"Update" to directory = "delete" to its
les
Protecting a newly-created le: two
strategies
Use "Defaults" - apply the same access
rights to all new les
Use "Inheritance" - apply the access
rights based on the enclosing
directories
1 of 8 10/12/2016 10:49 PM
Chapter 3-Controlling Files Flashcards | Quizlet [Link]
Executable Files Files that contain applications or other
executable programs
"Binary executables" are stored in a
control section and executed by the
CPU
"Scripts" contain text interpreted by a
programming language interpreter
Execute Access Right
Helps distinguish data les from
programs
Must have the "Execute" right to
execute a le containing a program
Computer Viruses A type of malware that enters
computer systems.
Malware = malicious software
Viruses are carried by programs
When the program executes, the virus
spreads to other programs on the
computer
Types of virus infection
Application program infects when it is
run
Boot sector virus infects when
bootstrapped
USB virus infects when plugged in
Email virus infects if attachment is run
2 of 8 10/12/2016 10:49 PM
Chapter 3-Controlling Files Flashcards | Quizlet [Link]
Examples of Modern Malware Waledac - spreads through email -
creates a botnet that spreads spam
and more malware.
Concker or Downadup - spread
through Internet via Windows
vulnerabilities - created a botnet used
for spam and malware distribution.
Pushdo/ Cutwail - A botnet and spam
package that used to produce 7 million
messages a day.
ZeuS - creates botnet focused on
nancial fraud
Stuxnet - attacks control logic in
industrial plants; probable target was
Iranian nuclear sites
Sharing and Protecting Files Objectives for sharing les
Provide computing for authorized
users
Preserve the Chain of Control
Permit/prevent general sharing among
users
Risks - a generic set
Denial of service
Subversion
Masquerade
Disclosure
Forgery
3 of 8 10/12/2016 10:49 PM
Chapter 3-Controlling Files Flashcards | Quizlet [Link]
Policy Alternatives Global Policies - applied to all users by
default
Isolation Policy - keep users separate
Sharing Policy - let users share their
les
Tailored Policies
Modify rights for specic sets of les
Specic tailorings
Privacy - block some les from sharing
Shared reading - share some blocked
les
Shared updating - full rights for some
users
Underlying Policy on Shared System Our policy must make it possible for
users to share application programs.
Three policy statements below allow
this while defending against related
risks.
A Global Isolation Policy By default, all personal les are kept
private
Specic shared les are available
Addressed by the rst 3 policy
statements
Global policy requires one added rule:
Bob's Policy Bob perceives another risk:
6. Unauthorized access to client data
To address this, he adds this
requirement:
A Global Sharing Policy By default, all personal les are shared
Readable by others but not writeable
Application les are also shared
Addressed by the rst 3 policy
statements
Global policy requires two statements
Replaces #4 in the global isolation
policy
4 of 8 10/12/2016 10:49 PM
Chapter 3-Controlling Files Flashcards | Quizlet [Link]
Security Controls An operating system can protect les
as long as:
The OS protections are always applied
when we access our les, and
There is no way to bypass the OS
protections
Basic Principle: Deny by Default
We always start by granting no access
We add access rights
This makes it easier to assign the right
permissions and achieve Least Privilege
Managing Access Rights Access Matrix contains two dimensions
A full matrix is too large for practical
use
We can organize access rights by
clustering in one dimension or the
other
Cluster by Column = Capability-Based
Security
We associate rights with users,
processes, or other active entities
A key-ring is a set of capabilities:
ownership grants access to the locked
items
Tickets provide capabilities
Cluster by Row = File Permissions Currently the most popular strategy in
OSes
Access rights are associated with
resources like les, devices, storage
areas, etc.
The list of rights tells which
users/processes have which access
rights.
Implementations Today
File Permission Flags - Unix
Access Control Lists - Windows, OS X
Detailed examples - Next Chapter
5 of 8 10/12/2016 10:49 PM
Chapter 3-Controlling Files Flashcards | Quizlet [Link]
Permission Flags in General Sets of flags to specify access rights.
Example:
RWX = Read, Write, Execute access
rights
A set of flags for each type of process
Processes belonging to the le's owner
Processes belonging to the system
Processes belonging to others - the
world
Still too redundant: owner and system
often have full access to the les
anyway
Compact access rules specify world
rights only.
Compact access rules for Bob's Files A simple way to list le security
controls to enforce basic or global
security policies
Specify the les, their owners, and the
access rights for the other users on the
system.
States and State Diagrams A technique to illustrate a system's
behavior
Each state is a separate situation
Arrows between states show transitions
A transition indicates both cause and
eect
An event causes the transition
An action may take place at the
transition
A door may be Open or Closed - two
states
The events Opening or Closing cause
the transition between the states
6 of 8 10/12/2016 10:49 PM
Chapter 3-Controlling Files Flashcards | Quizlet [Link]
Information States Data or information may be in these
basic states
Storage state
Stored in a computer, not being
processed
"Data at rest"
Processing state
Being used by an active process
Usually stored in RAM
Transmission state
Being moved from one place to
another
"Data in motion"
The Security Patch Race A race begins when a security problem
arises
The software developer races to
develop a x to eliminate the problem
Attackers race to write software that
exploits the problem and lets them
attack computers
Attack software is called an exploit
Any computer that doesn't patch the
problem may be vulnerable to the
exploit
Window of vulnerability = time during
which an exploit exists but computers
aren't patched
Patching Security Flaws The Patching Process
Collect error reports
Prioritize errors and assign to
engineers
Engineer develops software to x the
error
Software xes are chosen for a patch
The patch is tested
The patch is released
This applies to all flaws including
security flaws
Security xes may have higher priority
7 of 8 10/12/2016 10:49 PM
Chapter 3-Controlling Files Flashcards | Quizlet [Link]
8 of 8 10/12/2016 10:49 PM