A

PROJECT REPORT
ON

“Cryptography”

SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE AWARD

DIPLOMA IN

COMPUTER ENGINEERING

SUBMITTED TO
MAHARASHTRA STATE BOARD OF TECHNICAL EDUCATION, MUMBAI
SUBMITTED BY

Name of Student Enrollment No .

Dhangarmali Akash Ravindra 1909920098

GUIDED BY
([Link].V.R)

SAMARTH POLYTECHNIC, BELHE

 CERTIFICATE
This is to Certify that the project report entitled “Cryptography”
Was successfully completed by Student of Fifth semester Diploma in computer
engineering.

Dhangarmali Akash Ravindra

in partial fulfillment of the requirements for the award of the Diploma in

Computer engineering and submitted to the Department of Computer of Samarth
Polytechnic, Belhe work carried out during a period for the academic year 2020-21 as
per curriculum .

[Link].V.R Prof. Pokharkar M.S. Prof. Kapile A.S.

(Project Guide) (H.O.D) (Principle)

 ACKNOWLEDGMENT

This project is done as a semester project, as a part course

title”Cryptography”
.
We are really thankful to our course the Principal Prof. Kapile A. S. and
the HOD Mr. Pokharkar M.S. Samarth Polytechnic, Belhe for his invaluable
guidance and assistance, without which the accomplishment of the task would have
never been possible.

We also thanks [Link].V.R for giving this opportunity to explore

into the real world and realize the interrelation without which a Project can never
progress. In
our present project we have chosen the topic- “Cryptography”. We are also thankful
to parents, friend and all staff of Computer engineering department, for providing
us relevant information and necessary clarifications, and great support.

Dhangarmali Akash Ravindra

 Cryptography

ABSTRACT

One of the fundamental concerns in the security of cyberspace and e-commerce is the
security of operating systems that are the core piece of software running in all information systems,
such as network devices (routers, firewalls, etc ), Web servers ,customer desktops, PDAs, and so on.
Many of known vulnerabilities discovered so far are rooted from the bugs or deficiency of
underneath operating systems .
This paper discusses the security (or lack of security) of most commercial operating
systems like Microsoft Windows, and its effect to the overall security of Web based applications
and services. Here we also discusses various types of attacks can be perform on the operating
system.

Samarth polytechnic Belhe Page 4

 Cryptography

INDEX

[Link] Chapter Name Page No.

1 INTRODUCTION 6

2 AIM OBJECTIVE AND PROBLEM STATEMENT 8

3 REQUIREMENTS OF SECURE OS 9

4 COMPUTER SYSTEM ASSESTS 11

5 DESIGN PRINCIPLE AND PROTECTION 13

MECHANISM

6 AUTHENTICATION 16

7 PROGRAM AND SYSTEM THREATS 18

8 VARIOUS SECURITY THREATS 21

9 IMPLEMENTING SECURITY DEFENSES 26

10 CONCLUSION 28

11 REFERENCES 29

Samarth polytechnic Belhe Page 5

 Cryptography

Samarth polytechnic Belhe Page 6

 Cryptography

CHAPTER 1

INTRODUCTION
Every modern computer system, from network servers, workstation desktops, to
laptops and hand-held devices, has a core piece of software, called kernel or operating system,
executed on the top of a bare machine of hardware that allocates the basic resources of the system
(e.g., CPU, memory, device driver, communication port, etc),and supervises the execution of all
applications within the system. Some popular commercial and Open Source operating systems are
Microsoft Windows, different flavours of Unix (BSD, AIX, HP-UX, Solaris, etc), Mac OS, and
Linux .

Because of the crucial role of the operating system in the operation of any computer
systems, the security (or lack of security) of an operation system will have fundamental impacts to
the overall security of a computer system, including the security of all applications running within
the system. A compromise of the underneath operating system will certainly expose danger to any
application running in the system.

Lack of proper control and containment of execution of individual applications in an

operating system may lead to attack or break-in from one application to other applications .With the
ever-growing connectivity and E-commerce through the Internet, application security is an ultimate
goal for millions of merchants and consumers who turn their business and service electronic and to
the public world of cyberspace. On the other hand, efforts to achieve total security of such systems
continue to be based on the flawed promise that adequate security can be achieved in applications
with the current security mechanisms of mainstream operating system.

The reality is that secure applications demand secure operating systems, and tackling
application compromises at the OS level by kernel-enforced controls should probably be considered
as an attractive and effective approach.

Samarth polytechnic Belhe Page 7

 Cryptography

In general, the concern of security in operating systems is with the problem of controlling access
to computer systems and the information stored in them. There have been identified four
types of overall protection policies of increasing order of difficulty

1. No sharing: processes are completely isolated from each other, and each process has
exclusive control over the resources statically or dynamically assigned to it. In this case,
processes often share a program or data file by making a copy of it and transferring the copy
into their own virtual memory.

2. Sharing originals of program or data files: with the use of reentrant code, a single
physical realization of a program can appear in multiple virtual address spaces, as can read-only
data files. To prevent simultaneous users from interfering with each other, special locking
mechanisms are required for the sharing of writable data files.

3. Confined, or memory-less, subsystems: In this case, processes are grouped into

subsystems to enforce a particular protection policy. For example, a client process calls a
server process to perform some task on data. The server is to be protected against the client
discovering the algorithm by which it performs the task, while the client is to be protected
against the server's retaining any information about the task being performed.

4. Controlled information dissemination: In some systems, security classes are defined to

enforce a particular dissemination policy. Users and applications are given security clearances of
a certain level, while data and other resources are given security classifications. The security
policy enforces restrictions concerning which users have access to which classifications. This
model is useful not only in the military context but in commercial applications as well.

Samarth polytechnic Belhe Page 8

 Cryptography

CHAPTEER 2
AIM , OBJECTIVE AND PROBLEM STSTEMENT

2.1 AIM :

OS Security and Study of various attacks.

2.2 OBJECTIVE :

To know the OS security and various security attacks.

2.3 PROBLEM STATEMENT :

Security refers to providing a protection system to computer system resources such as CPU,
memory, disk, software programs and most importantly data/information stored in the computer
system. If a computer program is run by an unauthorized user, then he/she may cause severe
damage to computer or data stored in it. So a computer system must be protected against
unauthorized access ,malicious access to system memory, viruses, worms etc.

Samarth polytechnic Belhe Page 9

 Cryptography

CHAPTER 3

REQUIREMENTS OF SECURE OS

Most current operating systems provide discretionary access control, that is, some
one who owns a resource can make a decision as to who is allowed to use (access) there source.
Moreover, because the lack of built-in mechanisms for the enforcement of security policies in such
systems, the access control is normally a one-shot approach:
either all or none privileges are granted, rarely supporting the “principle of least privilege” (without
limiting the privileges a program can inherit based on the
trustworthiness).

The basic philosophy of discretionary controls assumes that the users and the
programs they run are the good guys, and it is up to the operating system to trust them and protect
each user from outsiders and other users. Such perception could be extremely difficult to hold true
and no longer be considered as secure enough for computer systems of “information era” with
broad connectivity through the Internet and heavily commercialization of e-commerce services.

Systems with stronger security and protection will require evolving from the
approach of discretionary control towards the concept of mandatory (non-discretionary) control
where information is confined within a “security perimeter” with strict rules enforced by the system
about who is allowed access to certain resources, and not allow any information to move from a
more secure environment to a less secure environment.

Samarth polytechnic Belhe Page 10

 Cryptography

An understanding the types of threats to OS security that exist requires a definition of

security requirements. OS security addresses four requirements:

1. Confidentiality: requires that the information in a computer system be accessible only

for reading by authorized parties. This type of access includes printing, displaying,
and other forms of disclosure, including simply revealing the existence of an object.

2. Integrity: requires that only authorized parties can modify computer system assets.
Modification includes writing, changing, changing status, deleting, and creating.

3. Availability: requires that computer system assets are available to authorized parties.

4. Authenticity: requires that a computer system be able to verify the identity of a user.

Samarth polytechnic Belhe Page 11

 Cryptography

CHAPTER 4

COMPUTER SYSTEM ASSETS

The assets of a computer system can be categorized as hardware, software, and data. We
will consider each of these in turn.

Hardware :

The main threat to computer system hardware is in the area of availability. Hardware is the
most vulnerable to attack and the least amenable to automated controls. Threats include
accidental and deliberate damage to equipment as well as theft. The proliferation of personal
computers and workstations and the increasing use of local area networks increase the
potential for losses in this area.
Physical and administrative security measures are needed to deal with these threats.

Software :

The operating system, utilities, and application programs are what make computer system
hardware useful to businesses and individuals. Several distinct threats need to be considered.
A key threat to software is an attack on availability. Software, especially application
software, is surprisingly easy to delete.
Software also can be altered or damaged to render it useless. Careful software configuration
management, which includes making backups of the most recent version of software, can maintain
high availability.
A more difficult problem to deal with is software modification that results in a program that
still functions but that behaves differently than before. A final problem is software secrecy.

Data :

Hardware and software security are typically concerns of computing center professionals or
individual concerns of personal computer users. A much more widespread problem is data
security, which involves files and other forms of data controlled by individuals, groups, and
business organizations. Security concerns with respect to data are broad, encompassing
availability, secrecy, and integrity.
In the case of availability, the concern is with the of data files, which can occur either
accidentally or maliciously. The obvious concern with secrecy, of course, is the unauthorized
reading of data files or databases, and this area has been the subject of perhaps more research
and effort than any other area computer security.
A less obvious secrecy threat involves the analysis of data and manifests itself in the use of
statistical databases, which provide summary or aggregate information.
As a first impression, the existence of aggregate information does not threaten the privacy of
the individuals involved, but as the use of statistical databases grows, there is an increasing
Samarth polytechnic Belhe Page 12
 Cryptography

potential for disclosure of personal information. In essence, characteristics of constituent

individuals may be identified through careful analysis. To take a simple example, if one table
records the aggregate of the incomes of respondents X, Y, Z, and W and another records the
aggregate of the incomes of X, Y, Z, W, and K, the difference between the two aggregates would be
the income of K. Finally, data integrity is a major concern in most installations. Modifications
to data files can have consequences ranging from minor to disastrous.

Samarth polytechnic Belhe Page 13

 Cryptography

CHAPTER 5
DESIGN PRINCIPLES AND PROTECTION MECHANISMS

5.1 Design Principles :

Saltzer identifies a number of principles for the design of security measures for the various threats
to computer systems. These include:

1. Least privilege: Every program and every user of the system should operate using the
least set of privileges necessary to complete the job. Access rights should be acquired
by explicit permission only; the default should be ” no access.”

2. Economy of mechanisms: Security mechanisms should be as small and simple as

possible, aiding in their verification. This usually means that they must be an integral part
of the design rather than add-on mechanisms to existing designs.

3. Acceptability: Security mechanisms should not interfere unduly with the work of users,
while at the same time should meet the needs of those who authorize access. If the
mechanisms are not easy to use, they are likely to be unused or incorrectly used.

4. Complete mediation: Every access must be checked against the access-control

information, including those accesses occurring outside normal operation, as in recovery or
maintenance.

Open design: The security of the system should not depend on keeping the design of its
mechanisms secret. Thus, many experts can review the mechanisms, and users can have high
confidence in them.

Samarth polytechnic Belhe Page 14

 Cryptography

5.2 Protection Mechanisms :

The introduction of multiprogramming brought about the ability to share resources among
users.

This sharing involves not just the processor but also

the following:

1. Memory

2. I/O devices, such as disks and printers

3. Programs

4. Data

The ability to share these resources introduced the need for protection. Pfleeger points out that
an OS may offer protection along the following spectrum:

[Link] protection: This is appropriate when sensitive procedures are being run at separate
times.

[Link]: This approach implies that each process operates separately from other processes,
with no sharing or communication. Each process has its own address space, files, and other
objects.

[Link] all or share nothing: The owner of an object (e.g., a file or memory segment) declares
it to be public or private. In the former case, any process may access the object; in the
latter, only the owner's processes may access the object.

[Link] via access limitation: The OS checks the permissibility of each access by a specific
user to a specific object. The OS therefore acts as a guard, or gatekeeper, between users
and objects, ensuring that only authorized accesses occur.

[Link] via dynamic capabilities: This extends the concept of access control to allow dynamic
creation of sharing rights for objects.

[Link] use of an object: This form of protection limits not just access to an object but the use
to which that object may be put. For example, a user may be allowed to view a sensitive document
but not print it. Another example is that a user may be allowed access to a database to
derive statistical summaries but not to determine specific data values.

CONSTANTINESCU Radu, ZOTA Razvan Daniel

Samarth polytechnic Belhe Page 15

 Cryptography

The preceding items are listed roughly in increasing order of difficulty to implement, but also
in increasing order of fineness of protection that they provide. A given OS may provide different
degrees of protection for different objects, users, or applications.
The OS needs to balance the need to allow sharing, which enhances the utility of the computer
system, with the need to protect the resources of individual users. This section considers some
of the mechanisms by which OSs have enforced protections for these objects.

Samarth polytechnic Belhe Page 16

 Cryptography

CHAPTER 6

AUTHENTICATION

AUTHENTICATION :
Authentication refers to identifying each user of the system and
associating the executing programs with those users. It is the responsibility of the Operating System
to create a protection system which ensures that a user who is running a particular program is
authentic. Operating Systems generally identifies/authenticates users using following three ways

 Username / Password : User need to enter a registered username and password

with Operating system to login into the system.

 User card / Key :User need to punch card in card slot, or enter key generated by
key generator in option provided by operating system to login into the system.

 User Attribute : User need to pass his/her attribute via designated input device
used by operating system to login into the system.

ONE TIME PASSWORDS (OTP) :

One-time passwords provide additional security along with
normal authentication. In One-Time Password system, a unique password is required every time
user tries to login into the system. Once a one-time password is used, then it cannot be used again.
One-time password are implemented in various ways.

 Random Numbers : Users are provided cards having numbers printed along
with corresponding alphabets. System asks for numbers corresponding to few
alphabets randomly chosen.

 Secret Key :User are provided a hardware device which can create a secret id
mapped with user id. System asks for such secret id which is to be generated
every time prior to login.

 Network Password :Some commercial applications send one-time passwords to

user on registered mobile/ email which is required to be entered prior to login.

Samarth polytechnic Belhe Page 17

 Cryptography

MULTIFACTOR AUTHENTICATION :

MULTIFACTOR AUTHENTICATION
(MFA) is a method of  computer access control in which a user is granted access only after
successfully presenting several separate pieces of evidence to an authentication mechanism

 typically at least two of the following categories: knowledge (something they know), possession
(something they have), and inherence (something they are).

A good example from everyday life is the withdrawing of money from a cash
machine; only the correct combination of a bank card(something that the user possesses) and a
PIN(personal identification number, something that the user knows) allows the transaction to be
carried out.

Samarth polytechnic Belhe Page 18

 Cryptography

CHAPTER 7

PROGRAM AND SYSTEM THREATS

PROGRAM THREATS
Operating system's processes and kernel do the designated task as instructed. If a user program
made these process do malicious tasks, then it is known as Program Threats. One of the
common example of program threat is a program installed in a computer which can store and
send user credentials via network to some hacker. Following is the list of some well-known
program threats.

 Trojan Horse − Such program traps user login credentials and stores them to send to
malicious user who can later on login to computer and can access system resources.

 Trap Door − If a program which is designed to work as required, have a security hole
in its code and perform illegal action without knowledge of user then it is called to have
a trap door.

A Trap Door is when a designer or a programmer (or hacker) deliberately inserts a

security hole that they can use later to access the system.

Because of the possibility of trap doors, once a system has been in an untrustworthy
state, that system can never be trusted again. Even the backup tapes may contain a copy
of some cleverly hidden back door.

 Logic Bomb − Logic bomb is a situation when a program misbehaves only when certain
conditions met otherwise it works as a genuine program. It is harder to detect.

 Virus − Virus as name suggest can replicate themselves on computer system. They are
highly dangerous and can modify/delete user files, crash systems. A virus is generally a
small code embedded in a program. As user accesses the program, the virus starts
getting embedded in other files/ programs and can make system unusable for user

Samarth polytechnic Belhe Page 19

 Cryptography

Fig 7.1 :Program Threts

Samarth polytechnic Belhe Page 20

 Cryptography

SYSTEM THREATS
System threats refers to misuse of system services and network connections to put user in
trouble. System threats can be used to launch program threats on a complete network called as
program attack. System threats create such an environment that operating system resources/ user
files are misused. Following is the list of some well- known system threats.

 Worm − Worm is a process which can choked down a system performance by using
system resources to extreme levels. A Worm process generates its multiple copies where
each copy uses system resources, prevents all other processes to get required resources.
Worms processes can even shut down an entire network.

 Port Scanning − Port scanning is a mechanism or means by which a hacker can detects
system vulnerabilities to make an attack on the system.

 Denial of Service − Denial of service attacks normally prevents user to make legitimate
use of the system. For example, a user may not be able to use internet if denial of service
attacks browser's content settings.

Samarth polytechnic Belhe Page 21

 Cryptography

CHAPTER 8

VARIOUS SECURITY ATTACKS

1. DOS :

A Denial of Service (DoS) attack is an attempt to make a system unavailable to the intended
user(s), such as preventing access to a website. A successful DoS attack consumes all available
network or system resources, usually resulting in a slowdown or server crash. Whenever multiple
sources are coordinating in the DoS attack, it becomes known as a DDoS attack.

A Standard DDoS attack occurs when attackers send a substantial amount of malformed network
traffic directly to a target server or network. One of the ways an attacker can accomplish
this is by using a botnet to send the traffic. A botnet is a large number of victim
computers, or zombies, connected over the Internet, that communicate with each other
and can be controlled from a single location. When an attacker uses a botnet to
perform the DDoS attack, they send instructions to some or all of the zombie
machines connected to that botnet, thereby magnifying the size of their attack, making it
originate from multiple networks and possibly from multiple countries.

Fig 8.1 : Example Standard DDoS SYN Flood

Samarth polytechnic Belhe Page 22

 Cryptography

STANDARD DOS ATTACK TYPES :

i) SYN Flood

A SYN Flood is one of the most common forms of DDoS attacks observed by the
MSCISAC. It occurs when an attacker sends a succession of TCP Synchronize (SYN)
requests to the target in an attempt to consume enough resources to make the server
unavailable for legitimate users. This works because a SYN request opens network
communication between a prospective client and the target server. When the server
receives a SYN request, it responds acknowledging the request and holds the
communication open while it waits for the client to acknowledge the open connection.
However, in a successful SYN Flood, the client acknowledgment never arrives,
thus tying up the server’s resources until the connection times out. A large number
of incoming SYN requests to the target server exhausts all available server resources
and results in a successful DDoS attack.

Recommendations for SYN flood :

To identify a SYN Flood, investigate network logs and locate the TCP SYN flag. Tcpdump or
Wireshark may work for this purpose. TCP SYN packets are normal and are not necessarily
indicative of malicious activity. Look for a large number of SYN packets coming from multiple
sources over a short period. To help minimize the impact of successful SYN Flood attacks,
define strict “TCP keep alive” and “maximum connection” rules on all perimeter devices, such as
firewalls and proxy servers.

ii) UDP Flood

A UDP Flood is very similar to a SYN Flood in that an attacker uses a botnet to
send a significant amount of traffic to the target server. The difference is that this
attack is much faster, and rather than attempting to exhaust server resources, it seeks to
consume all of the available bandwidth on the server’s network link, thereby
denying access to legitimate users. The attack works because a server that receives
a UDP packet on a network port, such as 50555/UDP, checks for an application
that is listening on that port. If nothing is listening on that port, it replies to the
sender of the UDP packet with an Internet Control Message Protocol (ICMP)
Destination Unreachable packet. During an attack, a large number of UDP packets
arrive, each with various destination ports. This forces the server to process each
one, and in most cases, respond to each one. This type of attack can quickly lead to
Samarth polytechnic Belhe Page 23
 Cryptography

the consumption of all available bandwidth.

Samarth polytechnic Belhe Page 24

 Cryptography

Recommendations for UDP flood :

To identify a UDP Flood, investigate network logs and look for a large number of inbound UDP
packets over irregular network ports coming from a large number of source IP addresses. To
minimize the effect of UDP Flood attacks, define strict rules on your perimeter network
devices, like firewalls, to allow only inbound traffic on ports that are required.

iii) ICMP Flood

An ICMP Flood occurs when an attacker uses a botnet to send a large number of
ICMP packets to a target server in an attempt to consume all available bandwidth and
deny legitimate users access. This attack works when a large number of sources
can send enough ICMP traffic to consume all available bandwidth of the
target’s network. An example of this could be the “ping” command. This command
is primarily used to test network connectivity between two points on a network.
However, it is possible to supply this command with different variables to make the
ping larger in size and occur more often. By using these variables correctly, and with
enough source machines initiating the traffic, it is possible to consume all of the
available bandwidth.

Recommendations for ICMP flood :

To identify an ICMP Flood, investigate network logs and look for a significant amount of
inbound ICMP traffic from a large number of sources. If you identify an attack, try to leverage
your upstream network service provider in order for them to mitigate the activity before it
reaches your network.

iv) HTTP GET Flood

An HTTP GET Flood occurs when an attacker, or attackers, generates a

significant number of continuous HTTP GET requests for a target website in an
attempt to consume enough resources to make the server unavailable for legitimate
users. In this case, the attacking IP addresses never wait for a response from the
target server, despite the server attempting to respond to all incoming requests.

Samarth polytechnic Belhe Page 25

 Cryptography

Samarth polytechnic Belhe Page 26

 Cryptography

Recommendations for http get flood:

To identify an HTTP GET Flood, investigate network
logs and look for a large number of inbound traffic from a significant number of source IP
addresses with a destination port of 80 and a protocol of TCP. The packet data should also begin
with “GET”. We recommend using either Tcpdump or Wireshark.

2. HACKER’S ATTACKS :

The term "hacker attacks" to indicate hacker attacks that are not automated by programs such as
viruses, worms, or Trojan horse programs. There are various forms that exploit weaknesses in
security. Many of these may cause loss of service or system crashes.

 IP spoofing - An attacker may fake their IP address so the receiver thinks it is sent from a
location that it is not actually from. There are various forms and results to this attack.

o The attack may be directed to a specific computer addressed as though it is from

that same computer. This may make the computer think that it is talking to itself.
This may cause some operating systems such as Windows to crash or lock up.

 Man in the middle attack -

o Session hijacking - An attacker may watch a session open on a network. Once
authentication is complete, they may attack the client computer to disable it, and
use IP spoofing to claim to be the client who was just authenticated and steal the
session. This attack can be prevented if the two legitimate systems share a secret
which is checked periodically during the session.

Samarth polytechnic Belhe Page 27

 Cryptography

Fig 8.2 : Hacker Attacks

Samarth polytechnic Belhe Page 28

 Cryptography

 DNS poisoning - This is an attack where DNS information is falsified. This attack
can succeed under the right conditions, but may not be real practical as an attack
form. The attacker will send incorrect DNS information which can cause traffic to
be diverted. The DNS information can be falsified since name servers do not verify
the source of a DNS reply. When a DNS request is sent, an attacker can send a false
DNS reply with additional bogus information which the requesting DNS server may
cache. This attack can be used to divert users from a correct web server such as a
bank and capture information from customers when they attempt to logon.

Samarth polytechnic belhe Page 29

 Cryptography

CHAPTER 9

IMPLEMENTING SECURITY DEFENSES

Security Policy

 A security policy should be well thought-out, agreed upon, and contained in a

living document that everyone adheres to and is updated as needed.
 Examples of contents include how often port scans are run, password requirements,
virus detectors, etc.

Vulnerability Assessment

 Periodically examine the system to detect vulnerabilities.

o Port scanning.
o Check for bad passwords.
o Unauthorized programs in system directories.
o Incorrect permission bits set.
o Program checksums / digital signatures which have changed.
o Unexpected or hidden network daemons.
o New entries in startup scripts, shutdown scripts, cron tables, or other system
scripts or configuration files.
o New unauthorized accounts.

Virus Protection

 Modern anti-virus programs are basically signature-based detection systems, which

also have the ability ( in some cases ) of disinfecting the affected files and
returning them back to their original condition.

Auditing, Accounting, and Logging

 Auditing, accounting, and logging records can also be used to detect anomalous
behavior.

Firewalling to Protect Systems and Networks

 Firewalls are devices ( or sometimes software ) that sit on the border between two
security domains and monitor/log activity between them, sometimes restricting the
traffic that can pass between them based on certain criteria.
 For example a firewall router may allow HTTP: requests to pass through to a web
server inside a company domain while not allowing telnet, ssh, or other traffic to
pass through.

Firewalls themselves need to be resistant to attacks, and unfortunately have several

vulnerabilities:

Samarth polytechnic belhe Page 30

 Cryptography

 Tunneling, which involves encapsulating forbidden traffic inside of packets that

are allowed.
 Denial of service attacks addressed at the firewall itself.
 Spoofing, in which an unauthorized host sends packets to the firewall with the
return address of an authorized host.

Samarth polytechnic belhe Page 31

 Cryptography

CHAPTER 10

CONCLUSION

OS security attacks are on the rise from both the outside and the inside. In
fact, a recent study found that DNS attacks grew by 600 in 2011 alone! With this massive
growth, it appears that the current infrastructure is under unremitting and escalating attacks,
and IT organizations must find a better way to deal with this risk.

Although, the approach of using secure operating systems will not be a panacea
for all the dangers of current cyber space, and the security of individual applications may still
suffer from the vulnerabilities of their own, with the strong containment of a secure operation
system, the damages caused from a compromise within one application would be much
localized, and the impacts among various applications could be much well controlled.

In this paper we listed the primitive security services that are provided in
general by operating systems. The services are: memory protection, file protection,
general object access protection and user authentication.

If those services are provided in a consistent and efficient way, the system
in considered being trusted which means that the system meets the security
requirements, is of high enough quality and justifies the user’s confidence in that quality.
The underpinnings of a trusted operating system are: policy, model, design and trust.

Samarth polytechnic belhe Page 32

 Cryptography

CHAPTER 11
REFERENCES

1. [Link]
operatingsystems/104723

2. [Link]
df

3. [Link]

4. [Link]

5. [Link]
_Study_of_Various_Attacks

6. [Link]
Security

7. [Link]
systems/104723

8. [Link]

Samarth polytechnic belhe Page 33