UNIT - 5

PART – I

System protection

• Goals of protection
• Principles and domain of protection
• Access matrix
• Access control
• Revocation of access rights.
 PROTECTION
• The processes in an operating system must be protected from one another’s activities.
• To provide such protection, we can use various mechanisms to ensure that only processes
that have gained proper authorization from the operating system can operate on the files,
memory segments, cpu, and other resources of a system.
• Protection refers to a mechanism for controlling the access of programs, processes, or users
to the resources defined by a computer system.
• This mechanism must provide a means for specifying the controls to be imposed, together
with a means of enforcement
 GOALS OF PROTECTION
• To prevent malicious misuse of the system by users or programs. See chapter 15 for a more
thorough coverage of this goal.
• To ensure that each shared resource is used only in accordance with system policies, which
may be set either by system designers or by system administrators.
• To ensure that errant programs cause the minimal amount of damage possible.
• Note that protection systems only provide the mechanisms for enforcing policies and
ensuring reliable systems. It is up to administrators and users to implement those
mechanisms effectively.
 PRINCIPLES OF PROTECTION
• The principle of least privilege dictates that programs, users, and systems be given
just enough privileges to perform their tasks.
• This ensures that failures do the least amount of harm and allow the least of harm to
be done.
• For example, if a program needs special privileges to perform a task, it is better to
make it a sgid program with group ownership of "network" or "backup" or some
other pseudo group, rather than suid with root ownership. This limits the amount of
damage that can occur if something goes wrong.
• Typically each user is given their own account, and has only enough privilege to
modify their own files.
• The root account should not be used for normal day to day activities - the system
administrator should also have an ordinary account, and reserve use of the root
account for only those tasks which need the root privileges
 DOMAIN OF PROTECTION

• A computer can be viewed as a collection of processes and objects ( both HW & SW ).

• The need to know principle states that a process should only have access to those objects it
needs to accomplish its task, and furthermore only in the modes for which it needs access
and only during the time frame when it needs access.
• The modes available for a particular object may depend upon its type.
 Domain Structure
• A computer can be viewed as a collection of processes and objects ( both HW &
SW ).
• The need to know principle states that a process should only have access to
those objects it needs to accomplish its task, and furthermore only in the modes
for which it needs access and only during the time frame when it needs access.
• The modes available for a particular object may depend upon its type.

Fig. System with three protection domains.

• The association between a process and a domain may be static or dynamic.
• If the association is static, then the need-to-know principle requires a way of changing the
contents of the domain dynamically.
• If the association is dynamic, then there needs to be a mechanism for domain switching.

• A domain can be realized in a variety of ways:

• Each user may be a domain. In this case, the set of objects that can be accessed depends on the
identity of the user. Domain switching occurs when the user is changed—generally when one user
logs out and another user logs in.
• Each process may be a domain. In this case, the set of objects that can be accessed depends on the
identity of the process. Domain switching occurs when one process sends a message to another
process and then waits for a response.
• Each procedure may be a domain. In this case, the set of objects that can be accessed corresponds
to the local variables defined within the procedure. Domain switching occurs when a procedure
call is made.
 ACCESS MATRIX

• The model of protection that we have been discussing can be viewed as an access matrix, in
which columns represent different system resources and rows represent different protection
domains. Entries within the matrix indicate what access that domain has to that resource.

Access matrix
• Domain switching can be easily supported under this model, simply by
providing "switch" access to other domains:

 Access matrix with domains as objects.

• The ability to copy rights is denoted by an asterisk, indicating that processes in that domain
have the right to copy that access within the same column, i.E. For the same object. There
are two important variations:
• If the asterisk is removed from the original access right, then the right is transferred, rather than
being copied. This may be termed a transfer right as opposed to a copy right.

• If only the right and not the asterisk is copied, then the access right is added to the new domain,
but it may not be propagated further. That is the new domain does not also receive the right to
copy the access. This may be termed a limited copy right, as shown in figure  below
Access matrix with copy rights.
• Copy and owner rights only allow the modification of rights within a column. The addition
of control rights, which only apply to domain objects, allow a process operating in one
domain to affect the rights available in other domains.

• For example in the table below, a process operating in domain d2 has the right to control any
of the rights in domain d4.

Modified access matrix

 Implementation of Access Matrix:
1. Global table
• The simplest approach is one big global table with < domain, object, rights > entries.
• Unfortunately this table is very large ( even if sparse ) and so cannot be kept in memory ( without
invoking virtual memory techniques. )
• There is also no good way to specify groupings - if everyone has access to some resource, then it
still needs a separate entry for every domain.

2. Access lists for objects

• Each column of the table can be kept as a list of the access rights for that particular object,
discarding blank entries.
• For efficiency a separate list of default access rights can also be kept, and checked first.
3. Capability lists for domains
• In a similar fashion, each row of the table can be kept as a list of the capabilities of that domain.

• Capability lists are associated with each domain, but not directly accessible by the domain or any
user process.

• Capability lists are themselves protected resources, distinguished from other data in one of two
ways:
• A tag, possibly hardware implemented, distinguishing this special type of data. ( Other types may be
floats, pointers, booleans, etc. )

• The address space for a program may be split into multiple segments, at least one of which is
inaccessible by the program itself, and used by the operating system for maintaining the process's access
right capability list.
4. A lock-key mechanism
• Each resource has a list of unique bit patterns, termed locks.

• Each domain has its own list of unique bit patterns, termed keys.

• Access is granted if one of the domain's keys fits one of the resource's locks.

• Again, a process is not allowed to modify its own keys.

5. Comparison
• Each of the methods here has certain advantages or disadvantages, depending on the particular
situation and task at hand.

• Many systems employ some combination of the listed methods.

 ACCESS CONTROL
• Role-based access control, RBAC, assigns privileges to users, programs, or roles as
appropriate, where "privileges" refer to the right to call certain system calls, or to use certain
parameters with those calls.

• Rbac supports the principle of least privilege, and reduces the susceptibility to abuse as
opposed to suid or sgid programs.
 Revocation of Access Rights
• The need to revoke access rights dynamically raises several questions:
• Immediate versus delayed - If delayed, can we determine when the revocation
will take place?
• Selective versus general - Does revocation of an access right to an object
affect all users who have that right, or only some users?
• Partial versus total - Can a subset of rights for an object be revoked, or are all
rights revoked at once?
• Temporary versus permanent - If rights are revoked, is there a mechanism for
processes to re-acquire some or all of the revoked rights?
• With an access list scheme revocation is easy, immediate, and can be
selective, general, partial, total, temporary, or permanent, as desired.
• With capabilities lists the problem is more complicated, because access rights are distributed
throughout the system. A few schemes that have been developed include:
• Reacquisition - Capabilities are periodically revoked from each domain, which must then re-acquire them.
• Back-pointers - A list of pointers is maintained from each object to each capability which is held for that
object.
• Indirection - Capabilities point to an entry in a global table rather than to the object. Access rights can be
revoked by changing or invalidating the table entry, which may affect multiple processes, which must then
re-acquire access rights to continue.
• Keys - A unique bit pattern is associated with each capability when created, which can be neither
inspected nor modified by the process.
• A master key is associated with each object.
• When a capability is created, its key is set to the object's master key.
• As long as the capability's key matches the object's key, then the capabilities remain valid.
• The object master key can be changed with the set-key command, thereby invalidating all current capabilities.
• More flexibility can be added to this scheme by implementing a list of keys for each object, possibly in a
global table.
 PART - II
System security
• Introduction
• program threats
• system and network threats
• cryptography as a Security
• user authentication
• implementing security defenses
• firewalling to protect systems and Networks
• computer security classification.
• security deals with protecting systems from deliberate attacks, either internal or external, from
individuals intentionally attempting to steal information, damage information, or otherwise
deliberately wreak havoc in some manner.
• Some of the most common types of violations include:
• Breach of confidentiality - theft of private or confidential information, such as credit-card
numbers, trade secrets, patents, secret formulas, manufacturing procedures, medical
information, financial information, etc.
• Breach of integrity - unauthorized modification of data, which may have serious indirect
consequences. For example a popular game or other program's source code could be
modified to open up security holes on users systems before being released to the public.
• Breach of availability - unauthorized destruction of data, often just for the "fun" of causing
havoc and for bragging rites. Vandalism of web sites is a common form of this violation.
 • Theft of service - unauthorized use of resources, such as theft of cpu cycles, installation of
daemons running an unauthorized file server, or tapping into the target's telephone or
networking services.
• Denial of service, dos - preventing legitimate users from using the system, often by
overloading and overwhelming the system with an excess of requests for service.
• One common attack is masquerading, in which the attacker pretends to be a trusted third party. A
variation of this is the man-in-the-middle, in which the attacker masquerades as both ends of the
conversation to two targets.
• A replay attack involves repeating a valid transmission. Sometimes this can be the entire attack, (
such as repeating a request for a money transfer ), or other times the content of the original
message is replaced with malicious content.
Standard Security Attacks
• There are four levels at which a system must be protected:
1. Physical - the easiest way to steal data is to pocket the backup tapes. Also, access to
the root console will often give the user special privileges, such as rebooting the system as
root from removable media. Even general access to terminals in a computer room
offers some opportunities for an attacker, although today's modern high-speed
networking environment provides more and more opportunities for remote attacks.
2. Human - there is some concern that the humans who are allowed access to a system be
trustworthy, and that they cannot be coerced into breaching security. However more
and more attacks today are made via social engineering, which basically means fooling
trustworthy people into accidentally breaching security.
• Phishing involves sending an innocent-looking e-mail or web site designed to fool
people into revealing confidential information. E.G. Spam e-mails pretending to be
from e-bay, paypal, or any of a number of banks or credit-card companies.
 • Dumpster diving involves searching the trash or other locations for passwords that are written down.
( Note: passwords that are too hard to remember, or which must be changed frequently are more likely to
be written down somewhere close to the user's station. )
• Password cracking involves divining users passwords, either by watching them type in their passwords,
knowing something about them like their pet's names, or simply trying all words in common dictionaries.
( Note: "good" passwords should involve a minimum number of characters, include non-alphabetical
characters, and not appear in any dictionary ( in any language ), and should be changed frequently. Note
also that it is proper etiquette to look away from the keyboard while someone else is entering their
password. )
3. Operating system - the os must protect itself from security breaches, such as runaway processes ( denial
of service ), memory-access violations, stack overflow violations, the launching of programs with
excessive privileges, and many others.
4. Network - as network communications become ever more important and pervasive in modern
computing environments, it becomes ever more important to protect this area of the system. ( Both
protecting the network itself from attack, and protecting the local system from attacks coming in through the
network. ) This is a growing area of concern as wireless communications and portable devices become more
and more prevalent.
 PROGRAM THREATS
• There are many common threats to modern systems. Some of them are:
1. Trojan horse
• A trojan horse is a program that secretly performs some maliciousness in addition to its visible
actions.
• Some trojan horses are deliberately written as such, and others are the result of legitimate
programs that have become infected with viruses, ( see below. )
• One dangerous opening for trojan horses is long search paths, and in particular paths which
include the current directory ( "." ) as part of the path. If a dangerous program having the same
name as a legitimate program ( or a common mis-spelling, such as "sl" instead of "ls" ) is placed
anywhere on the path, then an unsuspecting user may be fooled into running the wrong program
by mistake.
• Another classic trojan horse is a login emulator, which records a users account name and
password, issues a "password incorrect" message, and then logs off the system. The user then
tries again ( with a proper login prompt ), logs in successfully, and doesn't realize that their
information has been stolen.
• Two solutions to trojan horses are to have the system print usage statistics on logouts, and to
require the typing of non-trappable key sequences such as control-alt-delete in order to log in.
( This is why modern windows systems require the control-alt-delete sequence to commence
logging in, which cannot be emulated or caught by ordinary programs. I.E. That key sequence
always transfers control over to the operating system. )
• Spyware is a version of a trojan horse that is often included in "free" software downloaded off
the internet. Spyware programs generate pop-up browser windows, and may also accumulate
information about the user and deliver it to some central site. ( This is an example of covert
channels, in which surreptitious communications occur. ) Another common task of spyware is
to send out spam e-mail messages, which then purportedly come from the infected user.
2. Trap door
• A trap door is when a designer or a programmer ( or hacker ) deliberately inserts a security hole
that they can use later to access the system.
• Because of the possibility of trap doors, once a system has been in an untrustworthy state, that
system can never be trusted again. Even the backup tapes may contain a copy of some cleverly
hidden back door.
• A clever trap door could be inserted into a compiler, so that any programs compiled with that
compiler would contain a security hole. This is especially dangerous, because inspection of the
code being compiled would not reveal any problems.
3. logic bomb
• A logic bomb is code that is not designed to cause havoc all the time, but only when a certain set
of circumstances occurs, such as when a particular date or time is reached or some other
noticeable event.
• A classic example is the dead-man switch, which is designed to check whether a certain person
( e.G. The author ) is logging in every day, and if they don't log in for a long time ( presumably
because they've been fired ), then the logic bomb goes off and either opens up security holes or
causes other problem
4. Stack and buffer overflow
• This is a classic method of attack, which exploits bugs in system code that allows buffers to
overflow.
#include
#define BUFFER_SIZE 256
int main( int argc, char * argv[ ] )
{
char buffer[ BUFFER_SIZE ];
if( argc < 2 ) return -1;
else
{
strcpy( buffer, argv[ 1 ] );
return 0;
}
}

C program with buffer-overflow condition.

• The "bottom" of the stack is actually at a high memory address, and the stack grows towards
lower addresses.
• However the address of an array is the lowest address of the array, and higher array elements
extend to higher addresses. ( I.E. An array "grows" towards the bottom of the stack.
• In particular, writing past the top of an array, as occurs when a buffer overflows with too
much input data, can eventually overwrite the return address, effectively changing where the
program jumps to when it returns.

The layout for a typical stack frame.

5. Viruses
• A virus is a fragment of code embedded in an otherwise legitimate program, designed to replicate
itself ( by infecting other programs ), and ( eventually ) wreaking havoc.
• Viruses are more likely to infect pcs than unix or other multi-user systems, because programs in
the latter systems have limited authority to modify other programs or to access critical system
structures ( such as the boot block. )
• Viruses are delivered to systems in a virus dropper, usually some form of a trojan horse, and
usually via e-mail or unsafe downloads.
• Viruses may take several forms

A boot-sector computer virus.

• Some of the forms of viruses include:
• File - A file virus attaches itself to an executable file, causing it to run the virus code first
and then jump to the start of the original program. These viruses are
termed parasitic, because they do not leave any new files on the system, and the original
program is still fully functional.
• Boot - a boot virus occupies the boot sector, and runs before the os is loaded. These are
also known as memory viruses, because in operation they reside in memory, and do not
appear in the file system.
• Macro - these viruses exist as a macro ( script ) that are run automatically by certain
macro-capable programs such as ms word or excel. These viruses can exist in word
processing documents or spreadsheet files.
• Source code viruses look for source code and infect it in order to spread.
• Polymorphic viruses change every time they spread - not their underlying functionality, but just
their signature, by which virus checkers recognize them.
• Encrypted viruses travel in encrypted form to escape detection. In practice they are self-decrypting,
which then allows them to infect other files.
• Stealth viruses try to avoid detection by modifying parts of the system that could be used to detect it. For
example the read( ) system call could be modified so that if an infected file is read the infected part gets
skipped and the reader would see the original unadulterated file.
• Tunneling viruses attempt to avoid detection by inserting themselves into the interrupt handler chain, or
into device drivers.
• Multipartite viruses attack multiple parts of the system, such as files, boot sector, and memory.
• Armored viruses are coded to make them hard for anti-virus researchers to decode and understand. In
addition many files associated with viruses are hidden, protected, or given innocuous looking names such
as "...".
 SYSTEM AND NETWORK THREATS

• Most of the threats described above are termed program threats, because they attack specific
programs or are carried and distributed in programs. System and network threats attack the
operating system or the network itself, or leverage those systems to launch their attacks.
• 1.  Worms
• A worm is a process that uses the fork / spawn process to make copies of itself in order to
wreak havoc on a system. Worms consume system resources, often blocking out other,
legitimate processes. Worms that propagate over networks can be especially problematic, as
they can tie up vast amounts of network resources and bring down large-scale systems.
• One of the most well-known worms was launched by robert morris, a graduate student at
cornell, in november 1988. Targeting sun and VAX computers running BSD UNIX version 4,
the worm spanned the internet in a matter of a few hours, and consumed enough resources to
bring down many systems.
• This worm consisted of two parts:
• A small program called a grappling hook, which was deposited on the target system
through one of three vulnerabilities, and
• The main worm program, which was transferred onto the target system and launched by
the grappling hook program.

The Morris Internet worm.

• The three vulnerabilities exploited by the morris internet worm were as follows:
• Rsh ( remote shell ) is a utility that was in common use at that time for accessing remote
systems without having to provide a password. If a user had an account on two different
computers ( with the same account name on both systems ), then the system could be
configured to allow that user to remotely connect from one system to the other without
having to provide a password.
• Finger is a utility that allows one to remotely query a user database, to find the true name
and other information for a given account name on a given system. Unfortunately the
finger daemon ( which ran with system privileges ) had the buffer overflow problem, so by
sending a special 536-character user name the worm was able to fork a shell on the remote
system running with root privileges.
• Sendmail is a routine for sending and forwarding mail that also included a debugging
option for verifying and testing the system. The debug feature was convenient for
administrators, and was often left turned on. The morris worm exploited the debugger to
mail and execute a copy of the grappling hook program on the remote system.
2. Port scanning
• Port scanning is technically not an attack, but rather a search for vulnerabilities to attack. The
basic idea is to systematically attempt to connect to every known ( or common or possible )
network port on some remote machine, and to attempt to make contact. Once it is determined that
a particular computer is listening to a particular port, then the next step is to determine what
daemon is listening, and whether or not it is a version containing a known security flaw that can
be exploited.
• Because port scanning is easily detected and traced, it is usually launched from zombie
systems, i.E. Previously hacked systems that are being used without the knowledge or permission
of their rightful owner. For this reason it is important to protect "innocuous" systems and
accounts as well as those that contain sensitive information or special privileges.
Denial of service
• Denial of service ( DOS ) attacks do not attempt to actually access or damage systems, but merely to clog
them up so badly that they cannot be used for any useful work. Tight loops that repeatedly request system
services are an obvious form of this attack.
• Dos attacks can also involve social engineering, such as the internet chain letters that say "send this
immediately to 10 of your friends, and then go to a certain url", which clogs up not only the internet mail
system but also the web server to which everyone is directed. ( Note: sending a "reply all" to such a
message notifying everyone that it was just a hoax also clogs up the internet mail service, just as
effectively as if you had forwarded the thing. )
• Security systems that lock accounts after a certain number of failed login attempts are subject to dos
attacks which repeatedly attempt logins to all accounts with invalid passwords strictly in order to lock up
all accounts.
• Sometimes dos is not the result of deliberate maliciousness
 CRYPTOGRAPHY AS A SECURITY TOOL

• Within a given computer the transmittal of messages is safe, reliable and secure, because the OS
knows exactly where each one is coming from and where it is going.
• On a network, however, things aren't so straightforward - a rogue computer ( or e-mail sender )
may spoof their identity, and outgoing packets are delivered to a lot of other computers besides
their ( intended ) final destination, which brings up two big questions of security:
• Trust - how can the system be sure that the messages received are really from the source
that they say they are, and can that source be trusted?
• Confidentiality - how can one ensure that the messages one is sending are received only by
the intended recipient?
• Cryptography can help with both of these problems, through a system of secrets and keys. 
Encryption
• The basic idea of encryption is to encode a message so that only the desired recipient can decode and
read it. Encryption has been around since before the days of caesar, and is an entire field of study in
itself. Only some of the more significant computer encryption schemes will be covered here.
• The basic process of encryption 
1. The sender first creates a message, m in plaintext.
2. The message is then entered into an encryption algorithm, e, along with the encryption key, ke.
3. The encryption algorithm generates the ciphertext, c, = e(ke)(m). For any key k, e(k) is an algorithm for
generating ciphertext from a message, and both E and e(k) should be efficiently computable functions.
4. The ciphertext can then be sent over an unsecure network, where it may be received by attackers.
5. The recipient enters the ciphertext into a decryption algorithm, d, along with the decryption key, kd.
6. The decryption algorithm re-generates the plaintext message, m, = d(kd)(c). For any key k, d(k) is an
algorithm for generating a clear text message from a ciphertext, and both D and d(k) should be efficiently
computable functions.
7. The algorithms described here must have this important property: given a ciphertext c, a computer can
only compute a message m such that c = e(k)(m) if it possesses d(k).
A secure communication over an insecure medium.
 USER AUTHENTICATION

• Protection, dealt with making sure that only certain users were allowed to perform certain tasks,
i.e. That a users privileges were dependent on his or her identity.

1. Passwords

• Passwords are the most common form of user authentication. If the user is in possession
of the correct password, then they are considered to have identified themselves.
• In theory separate passwords could be implemented for separate activities, such as
reading this file, writing that file, etc. In practice most systems use one password to
confirm user identity, and then authorization is based upon that identification. This is a
result of the classic trade-off between security and convenience.
2. Password vulnerabilities
• Passwords can be guessed.
• Intelligent guessing requires knowing something about the intended target in specific, or
about people and commonly used passwords in general.
• Brute-force guessing involves trying every word in the dictionary, or every valid
combination of characters. For this reason good passwords should not be in any
dictionary ( in any language ), should be reasonably lengthy, and should use the full
range of allowable characters by including upper and lower case characters, numbers,
and special symbols.
• "Shoulder surfing" involves looking over people's shoulders while they are typing in their password.
• Even if the lurker does not get the entire password, they may get enough clues to narrow it
down, especially if they watch on repeated occasions.
• Common courtesy dictates that you look away from the keyboard while someone is typing their
password.
• Passwords echoed as stars or dots still give clues, because an observer can determine how many
characters are in the password. :-(
• "Packet sniffing" involves putting a monitor on a network connection and reading data contained in
those packets.
• Ssh encrypts all packets, reducing the effectiveness of packet sniffing.
3. Encrypted passwords
• Modern systems do not store passwords in clear-text form, and hence there is no mechanism to
look up an existing password.
• Rather they are encrypted and stored in that form. When a user enters their password, that too is
encrypted, and if the encrypted version match, then user authentication passes.
• The encryption scheme was once considered safe enough that the encrypted versions were stored
in the publicly readable file "/etc/passwd".
• They always encrypted to a 13 character string, so an account could be disabled by putting a
string of any other length into the password field.
• A random seed is included as part of the password generation process, and stored as part of
the encrypted password. This ensures that if two accounts have the same plain-text password
that they will not have the same encrypted password. However cutting and pasting encrypted
passwords from one account to another will give them the same plain-text passwords.
4. One-time passwords
• One-time passwords resist shoulder surfing and other attacks where an observer is able to
capture a password typed in by a user.
• These are often based on a challenge and a response. Because the challenge is different each time,
the old response will not be valid for future challenges
• Another option is to have some sort of electronic card with a series of constantly changing numbers,
based on the current time. The user enters the current number on the card, which will only be valid
for a few seconds. A two-factor authorization also requires a traditional password in addition to the
number on the card, so others may not use it if it were ever lost or stolen.
• A third variation is a code book, or one-time pad. In this scheme a long list of passwords is
generated, and each one is crossed off and cancelled as it is used. Obviously it is important to keep
the pad secure.
5. Biometrics
• Biometrics involve a physical characteristic of the user that is not easily forged or duplicated
and not likely to be identical between multiple users.
• Fingerprint scanners are getting faster, more accurate, and more economical.
• Palm readers can check thermal properties, finger length, etc.
• Retinal scanners examine the back of the users' eyes.
• Voiceprint analyzers distinguish particular voices.
• Difficulties may arise in the event of colds, injuries, or other physiological changes.
 IMPLEMENTING SECURITY DEFENSES

1. Security policy
• A security policy should be well thought-out, agreed upon, and contained in a living document that
everyone adheres to and is updated as needed.
• Examples of contents include how often port scans are run, password requirements, virus detectors, etc.
2. Vulnerability assessment
• Periodically examine the system to detect vulnerabilities.
• The government considers a system to be only as secure as its most far-reaching component. Any system
connected to the internet is inherently less secure than one that is in a sealed room with no external
communications.
• Some administrators advocate "security through obscurity", aiming to keep as much information about
their systems hidden as possible, and not announcing any security concerns they come across.
3. Intrusion detection
• Intrusion detection attempts to detect attacks, both successful and unsuccessful attempts.
• Intrusion detection systems, idss, raise the alarm when they detect an intrusion. Intrusion
detection and prevention systems, idps, act as filtering routers, shutting down suspicious traffic
when it is detected.
• There are two major approaches to detecting problems:
• Signature-based detection scans network packets, system files, etc. Looking for recognizable
characteristics of known attacks, such as text strings for messages or the binary code for
"exec /bin/sh". The problem with this is that it can only detect previously encountered problems for
which the signature is known, requiring the frequent update of signature lists.
• Anomaly detection looks for "unusual" patterns of traffic or operation, such as unusually heavy load
or an unusual number of logins late at night
4 virus protection
• Modern anti-virus programs are basically signature-based detection systems, which also have the ability (  in some cases )
of disinfecting the affected files and returning them back to their original condition.
• Both viruses and anti-virus programs are rapidly evolving. For example viruses now commonly mutate every time they
propagate, and so anti-virus programs look for families of related signatures rather than specific ones.
• Some antivirus programs look for anomalies, such as an executable program being opened for writing (  other than by a
compiler. )
• Avoiding bootleg, free, and shared software can help reduce the chance of catching a virus, but even shrink-wrapped official
software has on occasion been infected by disgruntled factory workers.
• Some virus detectors will run suspicious programs in a sandbox, an isolated and secure area of the system which mimics the
real system.
• Rich text format, rtf, files cannot carry macros, and hence cannot carry word macro viruses.
• Known safe programs ( e.G. Right after a fresh install or after a thorough examination ) can be digitally signed, and
periodically the files can be re-verified against the stored digital signatures. ( Which should be kept secure, such as on off-
line write-only medium. )
5. Auditing, accounting, and logging
• Auditing, accounting, and logging records can also be used to detect anomalous behavior.
• Some of the kinds of things that can be logged include authentication failures and successes,
logins, running of suid or sgid programs, network accesses, system calls, etc. In extreme cases
almost every keystroke and electron that moves can be logged for future analysis. ( Note that
on the flip side, all this detailed logging can also be used to analyze system performance. The
down side is that the logging also affects system performance ( negatively! ), And so a
heisenberg effect applies. )
FIREWALLING TO PROTECT SYSTEMS AND NETWORKS

• Firewalls are devices ( or sometimes software ) that sit on the border between two security
domains and monitor/log activity between them, sometimes restricting the traffic that can pass
between them based on certain criteria.
• A common architecture is to establish a de-militarized zone, dmz, which sort of sits "between"
the company domain and the outside world, as shown below. Company computers can reach
either the DMZ or the outside world, but outside computers can only reach the DMZ. 
• Firewalls themselves need to be resistant to attacks, and unfortunately have several
vulnerabilities:
• tunneling, which involves encapsulating forbidden traffic inside of packets that are allowed.
• Denial of service attacks addressed at the firewall itself.
• Spoofing, in which an unauthorized host sends packets to the firewall with the return address of an
authorized hos
 COMPUTER-SECURITY CLASSIFICATIONS 
• No computer system can be 100% secure, and attempts to make it so can quickly make it unusable.
• However one can establish a level of trust to which one feels "safe" using a given computer system for particular
security needs.
• The u.S. Department of defense's "trusted computer system evaluation criteria" defines four broad levels of trust,
and sub-levels in some cases:
• Level D is the least trustworthy, and encompasses all systems that do not meet any of the more stringent criteria. DOS and
windows 3.1 fall into level D, which has no user identification or authorization, and anyone who sits down has full access
and control over the machine.
• Level C1 includes user identification and authorization, and some means of controlling what users are allowed to access
what files. It is designed for use by a group of mostly cooperating users, and describes most common UNIX systems.
• Level C2 adds individual-level control and monitoring. For example file access control can be allowed or denied on a per-
individual basis, and the system administrator can monitor and log the activities of specific individuals. Another restriction
is that when one user uses a system resource and then returns it back to the system, another user who uses the same
resource later cannot read any of the information that the first user stored there. ( I.E. Buffers, etc. Are wiped out between
users, and are not left full of old contents. ) Some special secure versions of UNIX have been certified for C2 security
levels, such as SCO.
• Level B adds sensitivity labels on each object in the system, such as "secret", "top secret", and "confidential".
Individual users have different clearance levels, which controls which objects they are able to access. All human-
readable documents are labeled at both the top and bottom with the sensitivity level of the file.
• Level B2 extends sensitivity labels to all system resources, including devices. B2 also supports covert channels
and the auditing of events that could exploit covert channels.
• B3 allows creation of access-control lists that denote users not given access to specific objects.
• Class A is the highest level of security. Architecturally it is the same as B3, but it is developed using formal
methods which can be used to prove that the system meets all requirements and cannot have any possible bugs or
other vulnerabilities. Systems in class A and higher may be developed by trusted personnel in secure facilities.
• These classifications determine what a system can implement, but it is up to security policy to
determine how they are implemented in practice. These systems and policies can be reviewed and certified by
trusted organizations, such as the national computer security center. Other standards may dictate physical
protections and other issues.
THANK YOU