​

UNIT-V​ ​ OPERATING SYSTEM AND DATABASE SECURITY​​ 6

Operating System Security: Security Architecture, Analysis of Security in Linux/Windows-

Database Security: Security Architecture, Database Auditing
5.1 Operating System Security
Every computer system and software design must handle all security risks and implement the
necessary measures to enforce security policies. At the same time, it's critical to strike a balance
because strong security measures might increase costs while also limiting the system's usability,
utility, and smooth operation. As a result, system designers must assure efficient performance
without compromising security.

5.1.1 What is Operating System Security?

The process of ensuring OS availability, confidentiality, and integrity is known as operating

system security. OS security refers to the processes or measures taken to protect the operating
system from dangers, including viruses, worms, malware, and remote hacker intrusions.
Operating system security comprises all preventive-control procedures that protect any system
assets that could be stolen, modified, or deleted if OS security is breached.

Security refers to providing safety for computer system resources like software, CPU, memory,
disks, etc. It can protect against all threats, including viruses and unauthorized access. It can be
enforced by assuring the operating system's integrity, confidentiality, and availability. If an
illegal user runs a computer application, the computer or data stored may be seriously damaged.

5.1.2 System security may be threatened through two violations, and these are as follows:

1. Threat

A program that has the potential to harm the system seriously.

2. Attack

A breach of security that allows unauthorized access to a resource.

There are two types of security breaches that can harm the system: malicious and accidental.
Malicious threats are a type of destructive computer code or web script that is designed to cause
system vulnerabilities that lead to back doors and security breaches. On the other hand,
Accidental Threats are comparatively easier to protect against.
5.1.3 Security may be compromised through the breaches. Some of the breaches are as
follows:

1. Breach of integrity

This violation has unauthorized data modification.

2. Theft of service

It involves the unauthorized use of resources.

3. Breach of confidentiality

It involves the unauthorized reading of data.

4. Breach of availability

It involves the unauthorized destruction of data.

5. Denial of service

It includes preventing legitimate use of the system. Some attacks may be accidental.

5.1.4 The goal of Security System

There are several goals of system security. Some of them are as follows:

1. Integrity

Unauthorized users must not be allowed to access the system's objects, and users with
insufficient rights should not modify the system's critical files and resources.

2. Secrecy

The system's objects must only be available to a small number of authorized users. The system
files should not be accessible to everyone.

3. Availability
All system resources must be accessible to all authorized users, i.e., no single user/process
should be able to consume all system resources. If such a situation arises, service denial may
occur. In this case, malware may restrict system resources and preventing legitimate processes
from accessing them.

5.2 Security Architecture

The security of an organization is the greatest concern of the people working at the organization.
Safety and security are the pillars of cyber technology. It is hard to imagine the cyber world
without thinking about security. The architecture of security is thus a very important aspect of the
organization. The OSI (Open Systems Interconnection) Security Architecture defines a
systematic approach to providing security at each layer. It defines security services and security
mechanisms that can be used at each of the seven layers of the OSI model to provide security for
data transmitted over a network. These security services and mechanisms help to ensure the
confidentiality, integrity, and availability of the data. OSI architecture is internationally
acceptable as it lays the flow of providing safety in an organization.

Classification of OSI Security Architecture

OSI Security Architecture is categorized into three broad categories namely Security Attacks,
Security mechanisms, and Security Services. We will discuss each in detail:
5.2.1 Security Attacks:
A security attack is an attempt by a person or entity to gain unauthorized access to disrupt or
compromise the security of a system, network, or device. These are defined as the actions that
put at risk an organization’s safety. They are further classified into 2 sub-categories:
A. Passive Attack:
Attacks in which a third-party intruder tries to access the message/ content/ data being shared by
the sender and receiver by keeping a close watch on the transmission or eave-dropping the
transmission is called Passive Attacks. These types of attacks involve the attacker observing or
monitoring system, network, or device activity without actively disrupting or altering it. Passive
attacks are typically focused on gathering information or intelligence, rather than causing
damage or disruption.

Here, both the sender and receiver have no clue that their message/ data is accessible to some
third-party intruder. The message/ data transmitted remains in its usual form without any
deviation from its usual behavior. This makes passive attacks very risky as there is no
information provided about the attack happening in the communication process. One way to
prevent passive attacks is to encrypt the message/data that needs to be transmitted, this will
prevent third-party intruders to use the information though it would be accessible to them.

Passive attacks are further divided into two parts based on their behavior:

●​ Eavesdropping: This involves the attacker intercepting and listening to communications

between two or more parties without their knowledge or consent. Eavesdropping can be
performed using a variety of techniques, such as packet sniffing, or man-in-the-middle
attacks.
●​ Traffic analysis: This involves the attacker analyzing network traffic patterns and metadata
to gather information about the system, network, or device. Here the intruder can’t read the
message but only understand the pattern and length of encryption. Traffic analysis can be
performed using a variety of techniques, such as network flow analysis, or protocol analysis.
B. Active Attacks:
Active attacks refer to types of attacks that involve the attacker actively disrupting or altering
system, network, or device activity. Active attacks are typically focused on causing damage or
disruption, rather than gathering information or intelligence. Here, both the sender and receiver
have no clue that their message/ data are modified by some third-party intruder. The message/
data transmitted don’t remain in its usual form and shows deviation from its usual behavior. This
makes active attacks dangerous as there is no information provided of the attack happening in the
communication process and the receiver is not aware that the data/ message received is not from
the sender.

Active attacks are further divided into four parts based on their behavior:
●​ Masquerade is a type of attack in which the attacker pretends to be an authentic sender in
order to gain unauthorized access to a system. This type of attack can involve the attacker
using stolen or forged credentials, or manipulating authentication or authorization controls in
some other way.
●​ Replay is a type of active attack in which the attacker intercepts a transmitted message
through a passive channel and then maliciously or fraudulently replays or delays it at a later
time.
●​ Modification of Message involves the attacker modifying the transmitted message and
making the final message received by the receiver look like it’s not safe or non-meaningful.
This type of attack can be used to manipulate the content of the message or to disrupt the
communication process.
●​ Denial of service (DoS) attacks involve the attacker sending a large volume of traffic to a
system, network, or device in an attempt to overwhelm it and make it unavailable to
legitimate users.
5.2.2 Security Mechanism
The mechanism that is built to identify any breach of security or attack on the organization, is
called a security mechanism. Security Mechanisms are also responsible for protecting a system,
network, or device against unauthorized access, tampering, or other security threats. Security
mechanisms can be implemented at various levels within a system or network and can be used to
provide different types of security, such as confidentiality, integrity, or availability.

Some examples of security mechanisms include:

●​ Encipherment (Encryption) involves the use of algorithms to transform data into a form that
can only be read by someone with the appropriate decryption key. Encryption can be used to
protect data it is transmitted over a network, or to protect data when it is stored on a device.
●​ Digital signature is a security mechanism that involves the use of cryptographic techniques
to create a unique, verifiable identifier for a digital document or message, which can be used
to ensure the authenticity and integrity of the document or message.
●​ Traffic padding is a technique used to add extra data to a network traffic stream in an attempt
to obscure the true content of the traffic and make it more difficult to analyze.
●​ Routing control allows the selection of specific physically secure routes for specific data
transmission and enables routing changes, particularly when a gap in security is suspected.
5.2.3 Security Services:
Security services refer to the different services available for maintaining the security and safety
of an organization. They help in preventing any potential risks to security. Security services are
divided into 5 types:

●​ Authentication is the process of verifying the identity of a user or device in order to grant or
deny access to a system or device.
●​ Access control involves the use of policies and procedures to determine who is allowed to
access specific resources within a system.
●​ Data Confidentiality is responsible for the protection of information from being accessed or
disclosed to unauthorized parties.
●​ Data integrity is a security mechanism that involves the use of techniques to ensure that data
has not been tampered with or altered in any way during transmission or storage.
●​ Non- repudiation involves the use of techniques to create a verifiable record of the origin
and transmission of a message, which can be used to prevent the sender from denying that
they sent the message.

5.2.4 Benefits of OSI Architecture:

Below listed are the benefits of OSI Architecture in an organization:

1. Providing Security:
●​ OSI Architecture in an organization provides the needed security and safety, preventing
potential threats and risks.
●​ Managers can easily take care of the security and there is hassle-free security maintenance
done through OSI Architecture.
2. Organising Task:
●​ The OSI architecture makes it easy for managers to build a security model for the
organization based on strong security principles.
●​ Managers get the opportunity to organize tasks in an organization effectively.
3. Meets International Standards:
●​ Security services are defined and recognized internationally meeting international standards.
●​ The standard definition of requirements defined using OSI Architecture is globally accepted.

5.3 Analysis of Security in Linux/Windows

The main difference between Windows and Linux security systems is that Linux is an
open-source system with high-tech security. It has a robust user community with access to the
source code and can monitor for vulnerabilities, catching them earlier than hackers, unlike in
Windows, which is a closed-source system. While Windows has some open-source programs, the
operating system is closed. Therefore, users cannot fix any arising issues by themselves since
they do not have permission to modify the source code. If users encounter an error, they must
report it and wait for it to get fixed.

5.3.1 Admin Access

Windows allows users to have full admin access to their accounts, leaving the system vulnerable
to outward interference. For instance, if a virus attacks the system, it can quickly corrupt the
entire Windows system architecture. And because Windows is not modular, the entire Windows
operating system goes down when one part is affected. In contrast, Linux allows users limited
access (no root access). Thus, in the event of a virus attack, only part of this system is affected.
The virus/malware cannot affect the entire system since Linux doesn’t run as root by default,
which is needed to make significant changes.

5.3.2 Automated Functions

Windows accommodate automated functions. That means you can use Windows without
configuring files or solving technical issues. While it saves time, this arrangement allows the
malware to sneak into the system. For instance, executable malware can disguise itself as a Word
document. When you click to open this file, Windows will not run Word. Instead, it follows the
execution cues in the file. In contrast, Linux is pre-configured to run important system tasks that
keep the system updated only. However, you can configure other tasks to run automatically
within a specified time or on a specified date.

5.3.3 Application Security

Linux users get enhanced application security courtesy of firewalling built into the kernel.
Besides that, Snort is an excellent intrusion detection system. Linux added Ingo Molnar’s
exec-shield to the Linux kernel for x86-based systems.

This feature offers protection against attacks from buffer or function pointer overflows.
Additionally, it protects against other exploits that rely on overwriting data structures or putting
code into those structures.
While Microsoft is taking strides to redesign its security system and provide patches, it still
doesn’t match Linux. For instance, security issues in legacy Windows products persist and
complicate this task. As a result, Microsoft users are left exposed to security threats because
patches must be well-documented before deployment.

Furthermore, Microsoft tends to mix program code and data in its Apps, e.g., ActiveX. This can
allow untrusted data from outside the system and activate arbitrary code with data that is not
trustworthy.

5.3.4 Flexibility and Configurability

Linux has more configuration and control options for administrators than for Windows users.
These options can also be used to enhance security. For example, Linux sysadmins can use
AppArmor or SELinux to lock down their system with security policies offering granular access
controls. This offers an additional layer of security in the entire system, unlike in Windows.

While the two are different in structure and function, they are similar in certain aspects. The
include the following:

●​ Graphical user interfaces

●​ They are interfaces for activities and sharing of the computer
●​ They can run several different types of web services
●​ File systems can be corrupted in both

5.3.5 Specifications of Linux Security:

The specifications of Linux OS security includes file system security, built-in kernel security
defenses, data encryption and decryption tools, and a secure design. It has a somewhat different
layout. As a result, its security feature may slightly differ from Windows.

When you search Linux vs. Windows security Reddit, you will have remarkable differences in
the structure. Here are the key Linux security features:

[Link] File System Security

Everything is a file in Linux OS. If not, then it is a process. All files require permission since a
user and a group user own them. Remember, for each file in a Linux system, permissions are
assigned to the owner of the file, the group owner, and others. If you don’t own these files, you
will need read, write, and execute permissions, which can be granted or denied. You can list
permission of a file with the ls command with the -la flags. File permissions are essential as they
create a secure environment. For instance, people will not change your files, and your system file
can be kept safe from damage, whether deliberate or accidental.

[Link] Built-in Kernel Security Defenses

Linux has security built into its core design. Apart from the open-source design, it uses a strict
user privilege model and provides a selection of built-in kernel security defenses to safeguard
against vulnerabilities and attacks. Such tools include:

●​ ArpON (MitM defense tool): It is a host-based tool to improve the Address Resolution
Protocol (ARP) security.
●​ Fail2ban (log parser and blocking utility): An intrusion prevention programs framework
that protects computer servers from brute-force attacks through network traffic filtering
and security monitoring.
●​ MongoSanitizer (defense against MongoDB injection attacks): It is used as an extra
defense layer to prevent injection attacks from reaching the database. It is essential for
application security and database security
●​ hBlock (ad blocking and tracker/malware protection): It helps block malicious domains,
advertisements, malware, and trackers. Trackers could be pixels added to sites to track
the pages you visited, invading your privacy.
●​ nixarmor (Linux hardening script): This hardening tool has shell scripts to harden Linux
systems and help promote security automation. It configures the entire system to improve
its security level.

[Link] Data Encryption/Decryption Tools

The Linux operating system offers tools to help you encrypt and decrypt files easily. Encryption
allows only authorized individuals to access your file on Linux. Here are the most common tools:

●​ GnuPG: GnuPG is a part of the default GNU package and comes preinstalled, making it
the most used encryption tool on Linux. The tool has a public key (can be sent to anyone)
and a private key (stays with you). Files encrypted with a public key can be decrypted
with a private key, so you must set up the keys first before using them.
●​ ccrypt: This replacement of UNIX crypt is a utility for files and streams encryption and
decryption. It uses 256-AES for encryption and is pretty straightforward, making it ideal
for the less important files.
[Link] Secure Design

Linux system is meticulously designed to give it maximum security. For example, it has multiple
levels of authorization preventing the installation of malware and malicious codes.

Furthermore, the Linux system has no open ports by default. Unlike Windows, no external
devices or programs can access your device without opening ports. Viruses and malware made
for Linux are extremely rare because Linux OS is the least popular OS. This makes it
unprofitable for cyber attackers to attack it.

Linux Distros such as Qubes OS provide security by isolating the user’s files to protect them
from malware. Kali Linux has penetration testing tools and applications, which are ideal for
advanced security engineering.

5.3.6 Essential Features of Windows Security:

The essential features of Windows Security offers the latest antivirus protection, actively
protecting your devices from the moment you start Windows. It continually scans for malware
viruses and security threats. In addition, it automatically downloads updates to keep your devices
safe.

[Link] Windows Defender Smart Screen

The Windows Defender Smart Screen protects against malware and phishing websites and
applications. Furthermore, it blocks the downloading of potentially malicious files. According to
Microsoft, it can “block at first sight.” However, this feature applies to Windows 10, 11, and
Microsoft Edge.

Typically, it protects employees when they visit websites previously reported as having malware
or phishing and stops them from downloading anything malicious. Since it can detect fake ads,
scam sites, and drive-by attacks, it ensures that employees remain protected.

[Link] Windows Defender Application Guard

Microsoft Defender Application Guard prevents both emerging and old threats allowing
employees to remain productive. Application Guard isolates enterprise-defined untrusted sites on
Microsoft Edge, protecting your company while your employees browse the Internet.
Enterprise administrators define what is among trusted websites, cloud resources, and internal
networks. Anything not on the list is considered untrusted. If an employee visits an untrusted site
through Microsoft Edge or Internet Explorer, the browser opens the site in an isolated
Hyper-V-enabled container.

[Link] Windows Defender Antivirus (WDA)

Microsoft Defender Antivirus is a component of protection in Microsoft Defender for Endpoint.

It combines machine learning, in-depth threat resistance research, big-data analysis, and the
Microsoft cloud infrastructure to protect your organization’s devices (or endpoints).

Windows defender antivirus is compatible with other antiviruses, so you can run it passively
alongside other antimalware products on your device. However, this depends on the operating
system type and whether the device is onboarded to Defender for Endpoint.

It has a built-in firewall and a safe browsing environment to protect your device from common
threats. The firewall supports Domain, Private and Public configurations.

[Link] Windows Defender Device Guard

Device Guard is equipped with enterprise-grade application whitelisting to protect kernel

processes and drivers from threats like zero-day attacks. This feature embraces the mode where
apps are authorized by an enterprise/Admin. It has two modes of operations:

●​ Kernel mode code integrity (KMCI): Protests the kernel mode and drivers from
vulnerabilities such as zero-day attacks using HVCI.

●​ User mode code integrity (UMCI): A whitelisting technique that achieves PC lockdown
for enterprises using only trusted apps.

[Link] Microsoft Bitlocker

Bitlocker is a drive encryption tool in-built into Windows 10 Professional and Enterprise to
address threats of data exposure or theft from lost, stolen, or inappropriately
decommissioned/commissioned computers. Therefore, it can mitigate unauthorized data access
by enhancing file and system protections and rendering data inaccessible if the PC is
decommissioned or recycled.
However, it offers maximum protection when used with a Trusted Platform Module (TPM)
version 1.2 or later versions. BitLocker can still be used on PCs without TPM v1.2 or later, but
the user needs to insert a USB startup key to start the computer or resume hibernation.

5.4 Database Security

Database security refers to the range of tools, controls, and measures designed to establish and
preserve database confidentiality, integrity, and availability. This article will focus primarily on
confidentiality since it’s the element that’s compromised in most data breaches.

Database security must address and protect the following:

●​ The data in the database​

●​ The database management system (DBMS)​

●​ Any associated applications​

●​ The physical database server and/or the virtual database server and the underlying
hardware​

●​ The computing and/or network infrastructure used to access the database

Database security is a complex and challenging endeavor that involves all aspects of information
security technologies and practices. It’s also naturally at odds with database usability. The more
accessible and usable the database, the more vulnerable it is to security threats; the more
invulnerable the database is to threats, the more difficult it is to access and use.

5.5 Security Architecture

Database security architecture refers to the design and implementation of security

measures to protect a database system from unauthorized access, modification, or destruction. It
involves the integration of various security components, such as access control, encryption,
auditing, and monitoring, into a comprehensive security framework.

5.5.1 Key components of database security architecture include:

Access Control. Access control is the process of limiting access to sensitive data to authorized
individuals or entities. This can be achieved through the use of user authentication, authorization,
and privilege management mechanisms.

Encryption. Encryption is the process of converting plain text into cipher text to prevent
unauthorized access or disclosure. This can be achieved through the use of symmetric or
asymmetric encryption algorithms.

Auditing. Auditing is the process of monitoring and recording database activities to detect and
investigate security breaches or compliance violations. This can be achieved through the use of
audit trails, logs, and alerts.

Monitoring. Monitoring involves the continuous observation of database activities to detect and
respond to security threats in real-time. This can be achieved through the use of intrusion
detection and prevention systems, security information and event management (SIEM) systems,
and other monitoring tools.

Disaster Recovery. Disaster recovery is the process of restoring database operations after a
security incident or system failure. This can be achieved through the use of backup and recovery
mechanisms, redundant systems, and failover mechanisms.

Fig: 5.5.1 Database Security Architecture

Figure 5.5.1 shows Database system architecture and a well-designed database security
architecture should be able to provide comprehensive protection for sensitive data, maintain data
integrity and availability, and ensure regulatory compliance.
5.5.2 System-Level Security for Database Management

System-level security for database management refers to the various measures and
techniques used to protect database management systems (DBMS) from unauthorized access,
modification, or destruction. Some key security measures at the system level include: Access
Control. Access control is the process of limiting access to sensitive data to authorized
individuals or entities. It involves the use of user authentication, authorization, and privilege
management mechanisms to ensure that only authorized users can access the database.

Encryption. Encryption is the process of converting plain text into cipher text to prevent
unauthorized access or disclosure. It can be used to encrypt data at rest and in transit to provide
an additional layer of protection.

Database Auditing. Database auditing is the process of monitoring and recording database
activities to detect and investigate security breaches or compliance violations. It involves the use
of audit trails, logs, and alerts to track user activity and detect unauthorized access.

Backup and Recovery. Backup and recovery mechanisms are used to protect data from loss or
damage due to hardware failures, natural disasters, or cyber attacks. Regular backups and
recovery procedures should be implemented to ensure that data can be restored in case of an
incident.

Database Monitoring. Database monitoring involves the continuous observation of database

activities to detect and respond to security threats in real-time. It can be achieved through the use
of intrusion detection and prevention systems, security information and event management
(SIEM) systems, and other monitoring tools.

Database Patching and Updates. Regular patching and updating of the DBMS are necessary to
fix vulnerabilities and improve security. It is essential to keep the DBMS up-to-date with the
latest security updates and patches to stay protected against the latest threats.

System-level security for database management is critical for protecting sensitive data
from unauthorized access, modification, or destruction. It is essential to implement a layered
security approach that combines multiple security measures to provide robust protection against
various types of attacks.

5.6 Database Auditing

 Database auditing is used to track database access and user activity. Auditing can be used
to identify who accessed database objects, what actions were performed, and what data was
changed. Database auditing does not prevent security breaches, but it does provide a way to
identify if breaches have occurred. Common categories of database auditing include monitoring
database access attempts, Data Control Language (DCL) activities, Data Definition Language
(DDL) activities, and Data Manipulation Language (DML) activities (Yang, 2009).

5.6.1 Auditing Environment

Monitoring access attempts includes retaining information on successful and

unsuccessful logon and logoff attempts. DCL audits record changes to user and role privileges,
user additions, and user deletions. DDL audits record changes to the database schema such as
changes to table structure or attribute datatypes. DML audits record changes to data. In addition,
database errors should be monitored. Figure 5.6.1 shows Auditing Environment.

Fig: 5.6.1 Auditing Environment

5.6.2 Database Audit Sub-module: Monitoring User Logins

Database auditing is implemented via log files and audit tables. The real challenge of
database auditing is deciding what and how much data to retain and how long to keep it. Several
options exist. A basic audit trail usually captures user access, system resources used, and changes
made to the structure of a database. More complete auditing captures data reads as well as data
modifications.

The ADbC auditing sub-module provides step-by-step examples for creating audits of
user sessions, changes to database structure, and modifications to data. Figure 5.6.2 shows an
example of code required to implement and trigger an audit of a user login. Data recorded
includes the username and the date and time of the user login and audit trail provides a more
complete trace recording of not only user access but also user actions.

Fig: 5.6.2 ADbC Database Audit Sub-module: Monitoring User Logins

5.6.3 Database Audit Sub-module: Example Database Audit Trail

This type of facility is included with many database management systems. The most
common items that are audited include login attempts, data read and data modifications
operations, unsuccessful attempts to access database tables, and attempts to insert data that
violates specific constraints.
 Figure 5.6.3 shows an example audit trail of user access and user actions as demonstrated
in the Audit Command animation in the ADbC Database Audit sub-module. The SQL
Commands window displays the SQL statement used to retrieve data from the audit table.

Fig: 5.6.3 ADbC Database Audit Sub-module: Example Database Audit Trail

Auditing plays a central role in a comprehensive database security plan. The primary
weakness of the audit process is the time delay between when data is recorded and when analysis
is performed. Consequently, breaches and other unauthorized activities are identified after the
fact, making it difficult to mitigate adverse effects in a timely manner.

However, solutions are being introduced that allow for real-time monitoring of database
activity looking for patterned events indicative of potential breaches and enacting real-time
notification to database administrators when such actions occur. Whatever the case, database
auditing is a necessary process, and students must be made aware of the need for continuous
monitoring of database log files.