The concept of information security in OS .

 Plan :

1. Protection system in operating systems . Identification and authentication.

2. Authorization . Restricting access to OT objects, security domains. Rights and permissions. Mandate of capabilities.

3. Prevent reuse of access control objects.

4. Threat identification. System security audit.

5. Analysis of public OSes from a security perspective.

1988 , in the USA, the most serious threat to the security of American computer systems occurred. 23-year-old Cornell University graduate Robert G. Morris released a network “worm” - one of the rarest forms of computer viruses - into the ARPANET computer network. As a result of the threat, many nationwide computer networks, in particular the Internet, CSnet, BITnet, ARPANET and Milnet - non-secret military networks, were completely or partially disabled. As a result, the virus disabled more than 6,200 computer systems throughout America, including many large universities, institutes, government laboratories, private companies, military bases, clinics, and NASA agencies. The damage from this threat was estimated by experts at a minimum of 100 million dollars.

That is why information security problems are now recognized, and great attention is paid to the processes of violating the integrity of the system. The losses of large companies due to violations of their security systems amount to trillions of dollars.

security is complex, and to solve it, it is necessary to implement legal, organizational and software-technical measures together. Thus, ensuring information security requires a systematic approach and for this it is necessary to use various ethical, legal, administrative and technical tools and methods. Technical tools are implemented using software and hardware and solve various protection issues, and they can be included in the OS or implemented as a separate product. .

Security threats​�

Knowing the threats that may occur, and the areas of protection that these threats may affect, is essential to determining the most cost-effective security measures.

A secure system must have the properties of confidentiality, availability, and integrity. Any attempt to violate confidentiality, availability, and integrity is called a threat . An implemented threat is called

Confidentiality ensures that only authorized users can access confidential information. Such users are called authorized users

​

Appealability By availability, we mean the guarantee that the necessary information is always available to authorized users. Finally, system integrity means that an authorized user cannot modify the data in any way.

Data protection is aimed at combating organized threats that are intended to harm OS users, as opposed to random threats such as user error and device corruption, etc.

Organized threats are divided into active and passive threats. A passive threat is an unauthorized access to data that does not change the state of the system , an active threat is a change in the system without authorization. Passive threats are difficult to detect, because the data does not change as a result of their impact. Protection against passive attacks is based on their prevention.

of threats . The most common threat is an attempt to log in to the system as a legitimate (legal) user, i.e., an attempt to guess the password. The most complex option is to introduce a program into the system that displays the login word on the screen. Many legitimate users will try to log in to the system in this case, and their actions can be recorded. Such programs that appear “harmless” from the outside and perform unnecessary functions are called “Trojan mines”. Sometimes, to get rid of such redundant password checking programs, it is enough to press the del, break, cancel, etc. keys several times.

such attacks, the OS implements a process that "authenticates" the user.

Formalizing

Information security has become so important that in a number of countries the main approaches to the problem of information security have been standardized. Fundamental documents have been developed. As a result, it has become possible to rank (separate) information systems by level of reliability.

Defense (DoD 1993), named after the color of the cover, is well-known. This document defines four levels of security – D , S, V, and A. The transition from level D to A is subject to strict requirements for system reliability. Levels S and V are divided into several classes (S1, S2, V1, V2, V3). As a result of the certification process, the system must meet the requirements to be assigned to a class.

​

The OS should provide tools for creating and maintaining protected resources for applications . A key principle for system scalability is to separate the relationship between resources and mechanisms. Mechanisms specify how a particular situation is to be handled, while relationships specify how that situation is to be handled. Relationships can change over time and space. It is desirable to implement mechanisms that are as general as possible, since changing relationships requires only changing system parameters and tables .

Encryption is a process in which plaintext data is converted into ciphertext in such a way that:�

OS protection mechanisms.�

OS security issues is related to their architectural features and the proper organization of identification and authentication authorization and auditing.

The main issues of OS protection include identification, authentication, limiting user access rights to resources, logging, and system auditing.

​

Identification and authentication.�

The most common access control method is the registration procedure. Typically, each user has a unique identifier in the system. User identifiers are used for similar purposes as identifiers of other objects, files, and processes. Identification is the process of a user reporting their identifier. In order to determine whether a user is really real and the entered identifier is his, an authentication procedure is provided in information systems. This word comes from Latin and means “ to establish authenticity,” and the purpose of this process is to prevent unauthorized persons from entering the system.

Typically, authentication is based on one or more of the following components: - something the user has (a key or magnetic card);

- something the user knows (password);

- user attributes (fingerprints, signature sound)

Passwords and their shortcomings

The easiest way to authenticate is to use a user password.

When a user identifies themselves using a unique identifier or name, they are prompted for a password. If the password provided by the user matches the password stored in the system, the system considers the user to be "legitimate . "

Passwords are often used to protect objects in a computer system, in cases where there are no complex protection systems. The disadvantage of passwords is the difficulty in maintaining a balance between the convenience of the password for the user and its reliability. The password can be found, accidentally revealed, or secretly given to an unauthorized user. In addition, we can list a number of ways to try to find passwords.