Scribd
Upload
8 views27 pages

Security

The document discusses security threats to computer systems including unauthorized access, data modification, and denial of service attacks. It covers authentication, program threats like malware and backdoors, and system threats such as intrusion detection and encryption.

Uploaded by

Swathik Mamidi
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
8 views27 pages

Security

The document discusses security threats to computer systems including unauthorized access, data modification, and denial of service attacks. It covers authentication, program threats like malware and backdoors, and system threats such as intrusion detection and encryption.

Uploaded by

Swathik Mamidi
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd

Chapter 15: Security

Chapter 15: Security

 The Security Problem


 Authentication
 Program Threats
 System Threats
 Securing Systems
 Intrusion Detection
 Encryption
 Windows NT

Operating System Concepts 15.2 Silberschatz, Galvin and Gagne ©2005


INTRODUCTION TO SECURITY

 Protection: is strictly internal problem. How do we provide


controlled access to the programs and data stored in computer
system.
 Security: on the other hand, requires not only adequate protection
system but also consideration of external environment within which
the system operates.
 We say our system is secure if its resources are used and
accessed as intended under all circumstances.
 Computer resources must be guarded against unauthorized
access, malicious destruction or alteration.
 Total security can never be achieved.

Operating System Concepts 15.3 Silberschatz, Galvin and Gagne ©2005


The Security Problem

 Security must consider external environment of the system, and


protect it from:
 unauthorized access.
 malicious modification or destruction
 accidental introduction of inconsistency.

 Security violation can be categorized as intentional or accidental.


 Easier to protect against accidental than malicious misuse.

Operating System Concepts 15.4 Silberschatz, Galvin and Gagne ©2005


Some common Terms

1. Threat: is the potential to security violation.


2. Attack: attempt to break security.

3. Hacker:
 A person with a strong interest in computers who enjoys learning
and experimenting with them.

 Cracker/Intruder:
Someone who breaks into computers.
Crackers should not be confused with hackers.
The term cracker is usually connected to computer criminals.
Some of their crimes include ID theft and session hijacking
and intrusion in unauthorized areas.

Operating System Concepts 15.5 Silberschatz, Galvin and Gagne ©2005


Some security violations:

 Breach of confidentiality: Unauthorized reading of data. Theft of


information
 Breach of integrity: Unauthorized modification of data.
 Breach of availability: Unauthorized destruction of data/ website
defacement: A website defacement is an attack on a website that
changes the visual appearance of the site or a webpage. These are
typically the work of system crackers, who break into a web
server and replace the hosted website with one of their own. SQL
injections.
 Theft of service: unauthorized use of resources.
 Denial of service: Send invalid data to applications or network
services, which cause abnormal termination or behavior of the
applications or services.
 Flood a computer or the entire network with traffic until a shutdown
occurs because of the overload.

Operating System Concepts 15.6 Silberschatz, Galvin and Gagne ©2005


 Attackers use several standard methods in their attempts to breach
security:
Masquerading: pretend to be someone else.
Replay attack: repeat of valid data transmission
Man in the middle attack: attacker sits in the data flow of
communication. Masquerading as the sender to the receiver and
vice versa.
Session hijacking: active communication session is intercepted.

Operating System Concepts 15.7 Silberschatz, Galvin and Gagne ©2005


To protect our system, we must take security measures at 4 levels:

 Physical
 Human
 Operating system
 Network

Operating System Concepts 15.8 Silberschatz, Galvin and Gagne ©2005


Authentication

 User identity most often established through passwords.

 Passwords must be kept secret.


 Frequent change of passwords.
 Use of “non-guessable” passwords.
 Log all invalid access attempts.

 Passwords may also either be encrypted or allowed to be used


only once.

Operating System Concepts 15.9 Silberschatz, Galvin and Gagne ©2005


Program Threats

 Writing a program that creates a breach of security or causing a


normal process to change its behavior and create a breach is the
common goal of crackers
 Malware: A destructive program that masquerades as a benign
application.
 A back door is a means of access to a computer program that
bypasses security mechanisms. A programmer may sometimes
install a back door so that the program can be accessed for
troubleshooting or other purposes. However, attackers often use
back doors that they detect or install themselves, as part of
an exploit. In some cases, a worm is designed to take advantage of
a back door created by an earlier attack.

Operating System Concepts 15.10 Silberschatz, Galvin and Gagne ©2005


Trojan horse

 A Trojan horse, or Trojan, is software that appears to perform a


desirable function for the user, but (perhaps in addition to the
expected function) steals information or harms the system.
 Trojan horse is a program in which malicious or harmful code is
contained inside apparently harmless programming or data in such
a way that it can get control and do its chosen form of damage,
such as ruining the file allocation table on your hard disk.
 The Trojan Horse is a tale from the Trojan War about
the stratagem that allowed the Greeks finally to enter the city
of Troy and end the conflict. In the canonical version, after a
fruitless 10-year siege, the Greeks constructed a huge
wooden horse, and hid a select force of men inside. The Greeks
pretended to sail away, and the Trojans pulled the horse into their
city as a victory trophy. That night the Greek force crept out of the
horse and opened the gates for the rest of the Greek army, which
had sailed back under cover of night. The Greeks entered and
destroyed the city of Troy, decisively ending the war.

Operating System Concepts 15.11 Silberschatz, Galvin and Gagne ©2005


Spyware

 Spyware is a type of malware that can be installed on computers,


and which collects small pieces of information about users without
their knowledge.
 The presence of spyware is typically hidden from the user, and
can be difficult to detect.
 Sometimes, however, spywares such as key loggers are installed
by the owner of a shared, corporate, or public computer on purpose
in order to secretly monitor other users.
 While the term spyware suggests software that secretly monitors
the user's computing. Spyware programs can collect various types
of personal information, such as Internet surfing habits and sites
that have been visited, but can also interfere with user control of
the computer in other ways, such as installing additional software
and redirecting Web browser activity.
 Spyware is known to change computer settings, resulting in slow
connection speeds, different home pages, and/or loss
of Internet connection or functionality of other programs.

Operating System Concepts 15.12 Silberschatz, Galvin and Gagne ©2005


 In computer security, a covert channel is a type of
computer security attack that creates a capability to transfer
information objects between processes that are not
supposed to be allowed to communicate by the computer
security policy.
 A logic bomb is a piece of code intentionally inserted into
a software system that will set off a malicious function when
specified conditions are met. For example, a programmer
may hide a piece of code that starts deleting files (such as
a salary database trigger).

Operating System Concepts 15.13 Silberschatz, Galvin and Gagne ©2005


VIRUS

 VIRUS: Vital Information Resource Under Seize or Very


Important Resource Under Seize ..both are correct.
 Fragment of malicious code embedded in a legitimate
program.
 designed to “infect” other programs.
 Specific to architecture, operating systems and applications.
 Once a virus reaches a target machine, a program known as
virus dropper inserts virus onto system..
 Needs human intervention to move from host to host.
 Needs some one to actually take that program from one
device and run it onto other device

Operating System Concepts 15.14 Silberschatz, Galvin and Gagne ©2005


Main categories:
 FILE: infects system by appending itself to a file. Changes
start. Execution jumps to its code, returns control, executes
unnoticed.
 BOOT: infects boot sector, executing every time system is
booted. Infects other bootable media(Floppy disks).
 MACRO: these viruses are triggered when a program
capable of executing the macro is run.
 Source code: looks for source code and modifies it to
include the virus and to help spread the virus.
 Polymorphic: this virus changes every time it is installed to
avoid detection by antivirus software. Changes don’t change
its functionality but change virus functionality.
 Encrypted…

Operating System Concepts 15.15 Silberschatz, Galvin and Gagne ©2005


Worms

 Self propagating.
 If a device gets infected, it sends the copies of itself onto the
network to other devices.
 Sometimes more sinister, it might go into your email, find
your contacts, sends copies of itself to all the contacts.
 Made up of 2 programs:
 Grappling hook
 Main program.

Operating System Concepts 15.16 Silberschatz, Galvin and Gagne ©2005


Threat Monitoring

 Check for suspicious patterns of activity – i.e., several incorrect


password attempts may signal password guessing.
 Audit log – records the time, user, and type of all accesses to an
object; useful for recovery from a violation and developing better
security measures.
 Scan the system periodically for security holes; done when the
computer is relatively unused.

Operating System Concepts 15.17 Silberschatz, Galvin and Gagne ©2005


Threat Monitoring (Cont.)

 Check for:
 Short or easy-to-guess passwords
 Unauthorized set-uid programs
 Unauthorized programs in system directories
 Unexpected long-running processes
 Improper directory protections
 Improper protections on system data files
 Changes to system programs: monitor checksum values

Operating System Concepts 15.18 Silberschatz, Galvin and Gagne ©2005


FireWall

 A firewall is a device or set of devices designed to permit or deny


network transmissions based upon a set of rules and is frequently
used to protect networks from unauthorized access while permitting
legitimate communications to pass.
 A firewall is placed between trusted and untrusted hosts.

 The firewall limits network access between these two security


domains.

Operating System Concepts 15.19 Silberschatz, Galvin and Gagne ©2005


Network Security Through Domain Separation Via Firewall

Operating System Concepts 15.20 Silberschatz, Galvin and Gagne ©2005


Encryption

 Encrypt clear text into cipher text.


 Substitution and transposition ciphers
 Properties of good encryption technique:
 Relatively simple for authorized users to encrypt and decrypt
data.
 Encryption scheme depends not on the secrecy of the
algorithm but on a parameter of the algorithm called the
encryption key.
 Extremely difficult for an intruder to determine the encryption
key.
 Data Encryption Standard substitutes characters and rearranges
their order on the basis of an encryption key provided to authorized
users via a secure mechanism. Scheme only as secure as the
mechanism.

Operating System Concepts 15.21 Silberschatz, Galvin and Gagne ©2005


Encryption (Cont.)

 Public-key cryptography refers to a cryptographic system


requiring two separate keys, one to lock or encrypt the plaintext,
and one to unlock or decrypt the cyphertext.
 Neither key will do both functions.
 One of these keys is published or public and the other is kept
private.
 Public key cryptography was invented in 1976 by Whitfield Diffie
and Martin Hellman. For this reason, it is sometime called Diffie-
Hellman encryption.
 It is also called asymmetric encryption because it uses two keys
instead of one key (symmetric encryption).

Operating System Concepts 15.22 Silberschatz, Galvin and Gagne ©2005


Private key encryption

 Symmetric encryption (also called private-key


encryption or secret-key encryption) involves using the same
key for encryption and decryption.

 Encryption involves applying an operation (an algorithm) to


the data to be encrypted using the private key to make them
unintelligible.

Operating System Concepts 15.23 Silberschatz, Galvin and Gagne ©2005


Computer Security Classifications

 U.S. Department of Defense outlines four divisions of computer


security: A, B, C, and D.
 D – Minimal security.
 C – Provides discretionary protection through auditing. Divided into
C1 and C2. C1 identifies cooperating users with the same level of
protection. C2 allows user-level access control.
 B – All the properties of C, however each object may have unique
sensitivity labels. Divided into B1, B2, and B3.
 A – Uses formal design and verification techniques to ensure
security.

Operating System Concepts 15.24 Silberschatz, Galvin and Gagne ©2005


15.01

Operating System Concepts 15.25 Silberschatz, Galvin and Gagne ©2005


15.07

Operating System Concepts 15.26 Silberschatz, Galvin and Gagne ©2005


End of Chapter 15

Common questions

Powered by AI

Security measures can be implemented across four levels: physical, human, operating system, and network. Physical security involves controlling access to the physical hardware. Human security includes policies and training to prevent social engineering attacks. Operating system security involves establishing permissions and managing user access to system resources. Network security, often managed through firewalls, involves protecting data as it travels across networks. Together, these measures create a comprehensive security strategy .

Viruses and worms differ primarily in their propagation mechanisms. A virus requires human intervention to propagate; it needs to attach itself to a host program or file and relies on user actions such as downloading and running an infected file to spread. In contrast, worms are self-propagating; they can spread across networks independently by exploiting vulnerabilities. Worms do not need a host program and can initiate transfers through networks or emails without user intervention .

Intrusion Detection Systems (IDS) play a critical role in cybersecurity by monitoring network traffic for suspicious activities and potential threats. IDS can identify and alert administrators to unauthorized access attempts, unusual patterns of activity, and policy violations. They contribute to threat mitigation by allowing timely intervention before a breach occurs. However, the effectiveness of IDS depends on the accuracy of threat detection and the response measures in place. Thus, while they provide a valuable layer of security, IDS should be part of a broader, integrated security strategy .

Public-key cryptography differs from symmetric key encryption primarily in the number and nature of keys used. Public-key cryptography, also known as asymmetric encryption, uses two separate keys: a public key to encrypt the plaintext and a private key to decrypt the ciphertext. Each key can only perform one of the functions. This method is significant because it enables secure communications even over unsecured channels, as the private key remains confidential. Symmetric key encryption, on the other hand, uses the same key for both encryption and decryption, requiring secure distribution of the key to all parties involved .

Encryption significantly enhances data security by converting clear text into cipher text, making information unreadable to unauthorized users. A good encryption technique possesses several characteristics: it should be easy for authorized users to encrypt and decrypt data while being extremely difficult for intruders to determine the encryption key. The strength of encryption does not rely on the secrecy of the algorithm but on the robustness of the encryption key. This ensures that even if the algorithm is public, the data remains secure as long as the key is kept confidential .

A firewall functions by regulating network traffic between trusted and untrusted hosts based on predefined rules, effectively separating security domains. Its importance lies in preventing unauthorized access to protected resources while allowing legitimate communications. By analyzing incoming and outgoing traffic, it acts as a barrier against malicious intrusions and ensures that sensitive data is not exposed to external threats. This makes firewalls a crucial component in safeguarding network infrastructure and maintaining the integrity of data exchanges .

Spyware can have significant impacts depending on its use. Maliciously, spyware invades privacy by collecting personal information without consent, affecting user control over devices by altering settings or installing additional software covertly. This can lead to identity theft and unauthorized data collection. In legitimate contexts, spyware may be used by organizations to monitor employees' activities on company devices, potentially raising ethical concerns over privacy and consent. The challenge lies in ensuring transparency and obtaining explicit user consent to balance monitoring needs with privacy rights .

Securing an operating system is more contained as it involves setting controlled access to programs and data stored on the system. It is an internal security issue. However, total system security is broader, requiring not only protection within the system but also consideration of the external environment in which the system operates. Total security includes guarding against unauthorized access, malicious destruction or alteration, and accidental introduction of inconsistency, which is a far more complex challenge .

Strong password policies are crucial in user authentication as they help prevent unauthorized access to systems. Policies that enforce frequent password changes, the use of complex and non-guessable passwords, and the logging of invalid access attempts enhance security by reducing the likelihood of successful password guessing and brute force attacks. Additionally, using methods such as encrypted passwords or one-time passwords further strengthens the authentication process, making it challenging for intruders to gain unauthorized access .

Hackers are individuals with a strong interest in computers who enjoy learning and experimenting with them. In contrast, crackers, also known as intruders, are individuals who break into computer systems with malicious intent. Crackers commit crimes such as identity theft, session hijacking, and intrusion into unauthorized areas, distinguishing them from hackers who may not engage in illegal activities .

You might also like