Protection refers to a mechanism that controls the access of programs, processes, or users to the resources defined by a computer system. We can take protection as a helper to multiprogramming operating systems so that many users might safely share a common logical namespace such as a directory or files.
Security can be attacked in the following ways:
- Authorization
- Browsing
- Trap doors
- Invalid Parameters
- Line Tapping
- Electronic Data Capture
- Lost Line
- Improper Access Controls
- Waste Recovery
- Rogue Software
What is Operating System Security?
Measures to prevent a person from illegally using resources in a computer system, or interfering with them in any manner. These measures ensure that data and programs are used only by authorized users and only in a desired manner, and that they are neither modified nor denied to authorized users. Security measures deal with threats to resources that come from outside a computer system, while protection measures deal with internal threats. Passwords are the principal security tool.
A password requirement thwarts attempts by unauthorized persons to masquerade as legitimate users of a system. The confidentiality of passwords is upheld by encryption. Computer users need to share data and programs stored in files with collaborators, and here is where an operating system’s protection measures come in.
The owner of a file informs the OS of the specific access privileges other users are to have—whether and how others may access the file. The operating system’s protection function then ensures that all accesses to the file are strictly in accordance with the specified access privileges. We begin by discussing how different kinds of security breaches are carried out: Trojan horses, viruses, worms, and buffer overflows. Their description is followed by a discussion of encryption techniques. We then describe three popular protection structures called access control lists, capability lists, and protection domains, and examine the degree of control provided by them over sharing of files. In the end, we discuss how security classifications of computer systems reflect the degree to which a system can withstand security and protection threats
Security measures guard a user’s data and programs against interference from persons or programs outside the operating system; we broadly refer to such persons and their programs as nonusers.
Goal of Security System
Below are some goal of security system.
- Integrity: Users with insufficient privileges should not alter the system’s vital files and resources, and unauthorized users should not be permitted to access the system’s objects.
- Secrecy: Only authorized users must be able to access the objects of the system. Not everyone should have access to the system files.
- Availability: No single user or process should be able to eat up all of the system resources; instead, all authorized users must have access to them. A situation like this could lead to service denial. Malware in this instance may limit system resources and prohibit authorized processes from using them.
Threats to Operating System
Below are some threats to the operating system.
Malware
Malware is short for malicious software and refers to any software that is designed to cause harm to computer systems, networks, or users. Malware can take many forms. Malware is a program designed to gain access to computer systems, generally for the benefit of some third party, without the user’s permission.
Network Intrusion
A system called an intrusion detection system (IDS) observes network traffic for malicious transactions and sends immediate alerts when it is observed. It is software that checks a network or system for malicious activities or policy violations. Each illegal activity or violation is often recorded either centrally using a SIEM system or notified to an administration.
Buffer Overflow Technique
The buffer overflow technique can be employed to force a server program to execute an intruder-supplied code to breach the host computer system’s security. It has been used to a devastating effect in mail servers and other Web servers. The basic idea in this technique is simple. Most systems contain a fundamental vulnerability—some programs do not validate the lengths of inputs they receive from users or other programs.
Because of this vulnerability, a buffer area in which such input is received may overflow and overwrite contents of adjoining areas of memory. On hardware platforms that use stacks that grow downward in memory e.g., the Intel 80×86 architecture, such overflows provide an opportunity to execute a piece of code that is disguised as data put in the buffer. This code could launch a variety of security attacks
How a buffer overflow can be used to launch a security attack?
1. The stack grows downward, i.e., toward smaller addresses in memory. It looks as shown on the left before the currently executing function calls the function sample.
2. The code of the calling function pushes a return address and two parameters of sample onto the stack. Each of these occupies four bytes.
3. The code of sample allocates the variable beta and other variables on the stack. The stack now looks as shown on the right. Notice that the start address of beta is at the low end of the memory allocated to it. The end address of beta adjoins the last byte of the parameters.
4. The function sample copies 412 bytes into the variable beta. The first 408 bytes contain code whose execution would cause a security violation. Bytes 409–412 contain the start address of this code. These four bytes overwrite the return address in the stack.
5. The function sample executes a return statement. Control is transferred to the address found in the stack entry that is expected to contain the return address. Effectively, the code in variable beta is invoked. It executes with the privileges of the calling function.
Types of Threats
Below are tow types of threats.
1. Program threats
Below are some program threats.
- Virus: A virus is a malicious executable code attached to another executable file. The virus spreads when an infected file is passed from system to system. Viruses can be harmless or they can modify or delete data. Opening a file can trigger a virus.
- Trojan Horse: A Trojan horse is malware that carries out malicious operations under the appearance of a desired operation such as playing an online game.
- Logic Bomb: A logic bomb is a malicious program that uses a trigger to activate the malicious code. The logic bomb remains non-functioning until that trigger event happens.
2. System Threats
Below are some system threats.
- Worm: Worms replicate themselves on the system, attaching themselves to different files and looking for pathways between computers, such as computer network that shares common file storage areas.
- Denial of Service: Denial of Service (DoS) is a cyber-attack on an individual Computer or Website with the intent to deny services to intended users. Their purpose is to disrupt an organization’s network operations by denying access to its users.
How to Ensure Operating System Security?
- Authorization: It means verification of access to the system resources. Intruders may guess or steal password and use it. Intruder may use a vendor-supplied password, which is expected to use by system administrator. It may find password by trial and error method. If the user logs on and goes for a break then the intruder may use the terminal. An intruder can write a dummy login program to fool user and that program collects information for its use later on.
- Authentication: Authentication is verification of a user’s identity. Operating systems most often perform authentication by knowledge. That is, a person claiming to be some user X is called upon to exhibit some knowledge shared only between the OS and user X, such as a password
- Browsing: Files are very permissive so one can easily browse system files. Due to that it may access database and confidential information can be read.
- Trap doors: Sometimes Software designers want to modify their programs after installation. for that there are some secret entry points which programmers keep and it does not require and permission . These are called trap doors. Intrudes can use these trap doors.
- Invalid Parameters: Due to invalid parameters some security violation can take place.
- Line Tapping: Tapings in the communication line can access or modify confidential data.
- Electronic data capture: Using wiretaps or mechanism to pick up screen radiation and recognize what is displayed on screen is termed electronic data capture.
- Lost Line: In networking, the line way gets lost. In such case some o/s log out and allow access only after correct identify of user. some o/s cannot do this. So process will be floating and allow intruder to access data.
- Improper Access Controls: Some administrators may not plan about all rights. So some users may have more access and some users have very less access.
- Waste Recovery: If the block is deleted its information will be as it is. until it is allocated to another file. Intruder may use some mechanism to scan these blocks.
- Rogue Software: Programs are written to create mischief .
Frequently Asked Questions on Operating System Security – FAQs
What is system security?
System security is the procedures and policies put in place to guard against unauthorized access to, use of, disclosure of, disruption of, alteration of, and destruction of computer systems and data.
What are the security problems in OS?
An unauthorized user running a computer application has the potential to seriously harm the system or the data on it.
Why is operating system security important?
Operating systems are exposed to a variety of cyberthreats, such as viruses, worms, Trojan horses, ransomware, and other malware, if sufficient security measures are not taken. Significant harm, such as data loss, system breakdowns, and even monetary losses, can be brought on by these dangers.