1 / 12

Host and Application Security

Host and Application Security. Lesson 6: Object Protection (intro). OS: More Detail. Let’s look at the security-relevant parts of the OS… which are…?. NO direct access. One of the first things an operating system does is prevent much hardware direct access without the concept of a privilege

burian
Télécharger la présentation

Host and Application Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Host and Application Security Lesson 6: Object Protection (intro)

  2. OS: More Detail • Let’s look at the security-relevant parts of the OS… which are…?

  3. NO direct access • One of the first things an operating system does is prevent much hardware direct access without the concept of a privilege • However, it’s more complicated than that, if we think about the impact of a binary containing the HLT instruction

  4. Separation • Need to think about three different levels • Physical • Temporal • Logical • Cryptographic

  5. Memory and Address • A fence – hard limit between OS and program • A fence register provides support for a movable fence • More sophisticated: base/bounds registers • Tagged architecture – every word of memory has extra bits to signify access rights

  6. Memory Segmentation • Break program into segments • OS translates address references to actual memory • Each address is checked for protection • Highly granular • Two or more processes can share a segment

  7. Paging • Alternative to segmentation • Each page can be individually protected • Page translation table xlates logical to physical addresses

  8. Toward General Objects • Memory is an example of an object – same ideas apply to general objects • Goals of control: • Check every access • Enforce least privilege • Verify acceptable usage

  9. Controlling Access: ACLs • Imagine each object has flags associated with it • What flags would make sense? • Unix typically thinks of user, group, world • Of course, the permission space can be much broader…

  10. Windows

  11. Things to Do… • Find and read Ch4 of the book “Security in Computing” • Find and read “So long and thanks for the externalities” by Cormac Herley • Compare and contrast the difference access control models in Windows and Linux. Give some command & code examples of how they work. Due: 1 week.

  12. Questions?

More Related