Operating System Security

1. Operating SystemSecurity

2. Lesson 1:Security Principles

3. Objectives • Explain the need for security in Linux and Windows 2000 environments • Describe industry evaluation criteria used for security • Identify the guidelines for determining the three general security levels • Discuss the security mechanisms used to implement security systems

4. Objectives (cont’d) • Identify the different areas of security management • Describe Windows 2000 and Linux “out-of-the-box” security measures • Implement tools to evaluate key security parameters in Windows 2000 and Linux • Describe security components in the Windows 2000 security architecture

5. Security Services • Authentication • Access control • Data confidentiality • Data integrity • Nonrepudiation

6. Evaluation Criteria • European Information Technology Security Evaluation Criteria document BS 7799 • Trusted Computer Systems Evaluation Criteria • Common Criteria

7. Security Levels • Low • Medium • High

8. Specific Encipherment Digital signature Access control Data integrity Authentication Traffic padding Wide Trusted functionality Security labels Audit trails Security recovery Security Mechanisms

9. Windows 2000 Security • Exploits • Windows 2000 registry

10. Windows 2000Security Architecture • Windows 2000 security components • C2 certification • Windows 2000 objects • Security components • SIDs • Access tokens • Security descriptors • Access control lists and entities • Security subsystem

11. Linux Security • Configuration problems • Misconfigured authentication settings • Unnecessary services • Default account policies • Non-root user access to sensitive commands

12. PluggableAuthentication Modules • Editing PAM files • PAM directories • PAM entry format • Telnet access and the root account

13. Summary • Explain the need for security in Linux and Windows 2000 environments • Describe industry evaluation criteria used for security • Identify the guidelines for determining the three general security levels • Discuss the security mechanisms used to implement security systems

14. Summary (cont’d) • Identify the different areas of security management • Describe Windows 2000 and Linux “out-of-the-box” security measures • Implement tools to evaluate key security parameters in Windows 2000 and Linux • Describe security components in the Windows 2000 security architecture

15. Lesson 2:Account Security

16. Objectives • Describe the relationship between account security and passwords • Explain techniques for securing accounts in Windows 2000 and Linux • Prune users, detect account changes, rename default accounts, and implement password policies in Windows 2000 and Linux

17. Objectives (cont’d) • Identify Linux commands for password aging and explain how to log unsuccessful logon attempts • Explain Linux security threats, restrict account access, and monitor accounts

18. Passwords • Windows 2000 and strong passwords • Enforcing strong passwords • Dictionary attacks • Linux and strong passwords • Shadow passwords • The root account

19. VerifyingSystem State • Cross-referencing information on non-domain controllers • Built-in and external tools • Renaming default accounts • Windows 2000 account policies • Password lockout

20. PasswordAging in Linux • Linux command options • Timing out users • Monitoring accounts • System-wide event logging facility

21. Summary • Describe the relationship between account security and passwords • Explain techniques for securing accounts in Windows 2000 and Linux • Prune users, detect account changes, rename default accounts, and implement password policies in Windows 2000 and Linux

22. Summary (cont’d) • Identify Linux commands for password aging and explain how to log unsuccessful logon attempts • Explain Linux security threats, restrict account access, and monitor accounts

23. Lesson 3:File System Security

24. Objectives • Identify the Windows 2000 file-level permissions • Assign NTFS permissions • Explain the importance of drive partitioning and how it relates to security • Describe how copying and moving a file affect file security • Identify remote file access control permissions

25. Objectives (cont’d) • Describe Linux file system security concepts • Explain the function of the umask command • Discuss the purpose of setuid, setgid, and sticky bits

26. Windows 2000File System Security • File-level permissions • Standard 2000 permissions • Drive partitioning • Copying and moving files

27. Remote File Access Control • Remote access permissions • Full Control • Modify • Read & Execute • No Access • Share permissions

28. Linux File System Security • Files • File information • Permissions • The umask command • The chmod command • UIDs and GIDs • The set bits: setuid, setgid and sticky bits

29. Summary • Identify the Windows 2000 file-level permissions • Assign NTFS permissions • Explain the importance of drive partitioning and how it relates to security • Describe how copying and moving a file affect file security • Identify remote file access control permissions

30. Summary (cont’d) • Describe Linux file system security concepts • Explain the function of the umask command • Discuss the purpose of setuid, setgid, and sticky bits

31. Lesson 4:Assessing Risk

32. Objectives • Identify general and specific operating system attacks • Describe a keylogger program’s function • Change Windows 2000 system defaults • Scan a system to determine security risks • Explain Linux security concerns

33. Security Threats • Accidental threats • Intentional threats • Passive threats • Active threats

34. Types of Attacks • Spoofing/masquerade • Replay • Denial of service • Insider • Trapdoor • Trojan horses

35. Windows 2000Security Risks • Default directories • Default accounts • Default shares and services

36. General UNIX Security Vulnerabilities • Viruses • Buffer overflows

37. Keyloggers • Invisible KeyLogger Stealth and Windows 2000 • Keylogging and securing the Linux search path • Protecting yourself against keyloggers

38. SystemPort Scanning • Advanced security scanners • WebTrends Security Analyzer

39. UNIXSecurity Risks • The rlogin command • Interactive sessions: Telnet vs. rlogin • Network Information System (NIS) • Network File System (NFS)

40. NISSecurity Concerns • NIS security problems • No authentication requirements • Contacting server by broadcast • Plain-text distribution • Encryption and authentication • Portmapper processes and TCPWrappers • The securenets file • NIS+

41. NFSSecurity Concerns • Users, groups and NFS • Secure RPC • NFS security summary

42. Summary • Identify general and specific operating system attacks • Describe a keylogger program’s function • Change Windows 2000 system defaults • Scan a system to determine security risks • Explain Linux security concerns

43. Lesson 5:Reducing Risk

44. Objectives • Explain the purpose and importance of system patches and fixes, and apply system patches • Modify the Windows 2000 Registry for security • Lock down and remove services for effective security in Windows 2000 and Linux

45. Patches and Fixes • Microsoft service packs • Red Hat Linux errata

46. Windows 2000Registry Security • Registry structure • Subtrees and their uses • Auditing the registry • Setting registry permissions

47. Disabling and Removing Services in Windows 2000 • Securing network connectivity • Server Message Block • Miscellaneous configuration changes

48. Disabling and Removing Services in UNIX • Bastille • The tarball format • Downloading and installing Bastille • Running Bastille in text mode

49. Summary • Explain the purpose and importance of system patches and fixes, and apply system patches • Modify the Windows 2000 Registry for security • Lock down and remove services for effective security in Windows 2000 and Linux

50. Operating System Security • Security Principles • Account Security • File System Security • Assessing Risk • Reducing Risk