Operating System Security

Question: Discuss about operating system authentication strategies, attack strategies and techniques and security measures techniques? Answer: Introduction A computer system comprises of hardware, software and processes that is a kind of abstraction of a real business or process model that exists in the world. These systems are used by humans that belong to a system that is outside this computer system. Thus, computer systems use an abstract concept to identify them and they are presented as a user account. This user account acts as an object that has multiple attributes ranging from a login ID to security identifier. Security involves prevention of unauthorized people or entities from accessing systems. It is established to maintain the confidentiality of data, integrity of the same and assuring timely availability of information to authorized people or entities. Background The operating systems play a crucial role in any network as it interacts with multiple devices and machines over a network such that it allocates resources for performing all operations involving these devices as well as involving internal system. These resources include CPU, drive memory, communication ports, and drivers and so on. Moreover, all the applications runover an operating system and use its resources and thus, security of operating system is of prime importance to any security breach or issue can affect all applications running on an operating system. Moreover, a break into one application by a hacker can also cause breaches of security in other applications running on the operating system if the operating system is severely affected(Yang, 2003). To understand how a security system can protect unauthorized users from entering an operating system, it would be essential to understand the process of authentication that is used by operating systems. Moreover, there would also be required an understanding of how attacks may happen over an operating system by unauthorized users if security measures have to be taken. Lastly, security measures and techniques can be studied to understand how they stop or prevent attached in the case of real operating system protection. Thus, in this report, the critical analyzes would be followed in a stepwise manner beginning with the understanding of the Authorization strategies used for protection of operating systems, attack techniques used by unauthorized users for penetrating operating system and the strategies that are used for protection by security providers. Critical Analysis Operating System Authentication Strategies Authentication for humans can be based on five criteria that include something they know such as password or PIN, something they have such as token number, something they do such that they can be asked to perform certain actions to be able to authorize themselves, something they are such as biometric identification and where they are by identification of location. Something they know: This method of authentication is very commonly used, and the authentication passwords are easy to guess making the system vulnerable to unauthorized access. Traditionally passwords used plaintext that was very easy to crack but today systems use stored hashed. However, some of the authentication schemes such as challenge and response still need plaintext. A usual hashed authentication process would involve storage of pass word as a function f(PW) where f cannot be inverted. When a user enters a password, PW, f(PW) is calculated and compared for authentication. For prevention of pre-computation attacks, random salt is added while changing password such that the function stored is salt, f(PW,salt). Further, access control systems are used by operating systems to protect these hashed passwords. However, hackers can still run password guessing programs even in case challenge/response approach is used. Something they have: In such cases, a challenge is thrown to the users having secret cryptographic key for specific time and day often in combination with a PIN such that the user can be guarded against loss or theft of confidential data. Something they do: The users are asked to perform an action that can be used to identify them as humans to ensure that is not the malicious code trying to spoof in the system. User of two-factor authentication, captcha, one-time password generation are some of the examples of such approaches. Something they are: Biometric identification methods such as Fingerprint readers and iris scans work best when they are stored locally as otherwise they can face scenarios of false positive or false negative and user can become a victim of spoofing attacks. Somewhere they are: A user can be identified as per the location such that if the location from where user logs into a system is other than the usual location, the login attempts can either be prevented, or user can be warned about possible attacks such as done in cases of email accounts such as provided by Google. Attack Strategies and Techniques There can be several types of attack strategies that can be used for penetrating operating systems. Trojan horses, login spoofing and use of buggy software are some of the very common techniques used by attackers. Trojan Horses: Trojan horses trick users to run programs that have obnoxious codes. These programs may include viruses and worms, and when they are run by a users, they can change file permissions. Login Spoofing: In login spoofing, a fake prompt asking for credentials and if the same are entered, ID and passwords can be obtained by hackers from users. Computer Virus: It is a program containing malicious code that has the capability to copy itself in a system without permission using deception strategies such as overwriting of genuine files, acting companion to an EXE file, appending code to EXE files such as done by Vienna virus, insertion of malicious code at the start of a program, filling code into an empty space without affecting original program such as done by Lehigh virus, compression of host content such as done by Whales virus, boot sector virus, macro virus running on specific applications such as Microsoft Word, and so on. Security Measures techniques There are several security measures taken, and many of these are targeted to prevent specific types of attacks. For instance, to protect a Trojan Horse program to affect an operating system, operating systems provide Sandboxes, which is an environment in which a program can be executed without affecting rest of the machine that is used. Another trick is having a very limited interaction with the operating system and the outside world, but it can be very difficult to follow in many cases. For preventing login spoofing, trusted paths are used with a user initiated sequence that can guarantee that right operating system is reached out. Military Classification Model Blocking executable is another strategy that is commonly used for preventing unauthorized software runs. However, this causes issues when one tries to run executable files for fixing bugs. In such cases, certified systems make use of Military Classification Model, which define security levels such that every document can be classified as belonging to a certain level with each level being given a set of clearances. One can view only those documents that have these clearances. These classifications identify documents as confidential, secret, top secret and can compartmentalize the same into Crypto, Subs or NoForns. Clearances have to be obtained for each compartment to be able to view files. Systems using such classification schemes for documents security are called multi-level security systems(CS, 2015). Discretionary Access Control As per US government, Trusted Computer System Evaluation Criteria is used for operating system security assurance which requires operating systems to use Discretionary Access Control (DAC). This to some extent provides protection to the system in a time-sharing environment or in case of multi-tasking thereby protecting operating system mainstream. However, this does not guarantee protection of individual applications that run on the operating system. A B Class level of security is mandatory in the case of use of Mandatory Access Control (MAC), but the benefit of the same cannot be drawn upon in the systems using DAC efficiently. Preventive Measures In 2009, an investigation was done by DSD on targeted cyber intrusions and with the preventive mechanisms studied, in 2010, Australian Defense Signals Doctorate (DSD) list was published with 35 mitigation strategies identified, out of which top key measures of prevention including patch updating of operating system, patching of third-party applications, restricting of admin privileges to regular users, and use of only white-listed applications. When white-listing is implemented, it makes it difficult for the intruder to compromise a communication and information system as it ensures that only authorized applications are allowed to run on a system thereby preventing applications with malicious codes from running. Before operating system security can be established and patches are properly upgraded as required, risks have to be assessed, and a system deployment plan has to be created. System security planning process may be used for preventing operating systems. A proper planning proce ss may be used for ensuring complete safety through identification of critical content to be secured, use of network protection mechanisms and use of appropriate processes for maintenance of the operating system security(Australian Government, 2012). The first step in securing a system as used by major organizations or security officials is system hardening which involves installation of operating system and its patches. Further, operating system would be hardened and configured. Further additional security controls such as firewalls, anti-virus and intrusion detection systems can be installed for further hardening of security of operating system. Initially, there were various detection systems used for identifying patterns of virus activities such as string scan, mismatch detection, wildcards, bookmarking, smart scan, skeleton detection, specific virus detection and heuristics. However, only the use of security systems is not sufficient unless they are tested for their capability to address security needs of an operating system. Moreover, detection methods can only be useful in the cases of known viruses such that they are required to be frequently updated to remain effective for new cases of attacks. Also, detection of metamorp hic viruses that know antivirus loopholes can be difficult to detect by static and dynamic techniques of anomaly detection and thus new approaches are required to be explored(Daoud, Jebril, Zaqaibeh, 2008). Encryption Technology Encryption is used for securing data that is in transit and to be able to use encryption on data; appropriate cryptographic keys have to be created, signed, secured and configured. In case of IPSec and TLS, appropriate private keys are also generated, and if SSH is used then server and client keys are created. Security Maintenance Security establishment is the first step but it is not sufficient to keep operating system secure in the long run for which security is also required to be maintained for the system for which certain mechanism may be used such as monitoring and analysis of logging information, regular backups, security recovery, security system testing, and use of maintenance through patches and updates for monitoring and revision of configuration. Process Homeostasis Modern computer systems face several challenges including data loss, server hacking, system crashes and so on. Most of these issues result from the abnormal behavior of systems or program. Homeostasis is a technique used by Linux 2.2 kernel that can be used for detection of unusual behavior of a program through the study of short sequences of system calls. Unusual behavior can be in the form of system slow down and delays. Unusual program behavior can lead to set of symptoms such as data corruption, security isolation, crashes, but there are no inbuilt in mechanisms in an operating system that can respond to such anomalies and thus, for this a system called pH or Process Homeostasis based on the structure of biological system have been tested. There is a rise in complexities with increasing data shared through internet and network connections leading to additional and new security issues making systems vulnerable to crashes. Unlike an isolated system, a networked system cannot remain consistent over time but changes frequently. Thus, monitoring and keeping track of activities happening in an operating system that is connected to the network can be crucial for understanding and identifying vulnerabilities and attacks. In such cases, a program is used for identifying legal behavior as well as unusual events that result into issues such as communication failures and invalidation of data with rarely used codes getting executed. In this approach, detectors are developed for recognizing explicit behavior or a program through data streams scanning such that attack signatures can be identified. However, this approach also has its limitations as it is difficult to identify all types of behavior when a program can malfunction. Also, such programs are required to be regularly upgraded to be able to detect new anomalies. Detection and learning of unusual and normal program behavior can enhance the security of an operating system. In homeostasis, several types of detectors and effectors are used for creating a stable environment of an operating system. Conclusion The paper discussed various security and control measures that could be used for attaining and maintaining security for an operating system. It was found that to have an efficient security system; a proper security planning process can be used beginning with operating system hardening which involves upgrading of system and installation of patches followed by installation of additional security measures such as firewall systems, intrusion detection, and anti-virus applications. Moreover, some innovative and new techniques like homeostasis can also be used for prevention of attacks on operating systems. The choice of appropriate method would not be possible without the study of actual system and the content that needs to be protected as well as the programs or applications that would be run on the system. References Australian Government. (2012). Top four mitigation strategies to protect your ICT system. Australian Government. Bosworth, S. and Kabay, M. (2002).Computer security handbook. New York: John Wiley Sons. (2015). Security and Operating Systems. Columbia: CS. Daoud, E. A., Jebril, I. H., Zaqaibeh, B. (2008). Computer Virus Strategies and Detection Methods. Int. J. Open Problems Compt. Math , 29-36. Finzel, T. (1992). Trends in Operating System Security.Information Systems Security, 1(1), pp.50-57. Franklin, I. (2001). Securing the Operating System.Network Security, 2001(5), pp.12-13. Franklin, I. (2001). Securing the Operating System.Network Security, 2001(5), pp.12-13. Hopkins, P. (2015). Operating System Security.Engineering Technology Reference. Irtegov, D. (2003).Operating system fundamentals. Hingham, Mass.: Charles River Media. Ning, P., Xu, D. (2003). Learning Attack Strategies from Intrusion Alerts. Raleigh, NC: North Carolina State University. Post, G. (1987). Improving operating system security.Computers Security, 6(5), pp.417-425. Silberschatz, A., Galvin, P. and Gagne, G. (2005).Operating system concepts. Hoboken, NJ: J. Wiley Sons. Vacca, J. (2014).Network and system security. Amsterdam: Syngress. Yang, C.-Q. (2003). Global Information Assurance Certification Paper. SANS Institute.