Transcript October 16

Advanced Accounting
Information Systems
Day 23
Operating Systems Security
October 16, 2009
Announcements
– Quiz 5
– Assignment 4 – due today
• Task as IT auditor is to identify potential
problems new owner may encounter with
Threadchic
– Midterm
• In class – systems documentation, sql queries
• Out of class – four essay questions, you pick the
two to write on, maximum of two double-spaced
pages per essay question
– Covers systems development, IT auditing, internal
controls
Objectives – Operating Systems
Security



Understand the core components of operating systems
Understand the common implmentations of the main operating
system components as well as the associated risk and control
considerations
Apply security principles and concepts to effectively secure
operating systems
Blaster Worm


Remote procedure call
– Core operating system component implemented in the Windows family of
products
• Allows a computer to invoke and execute programs from remote
computers
• Present on every Windows computer and has highest level of privileges
July 16, 2003 announcement of critical vulnerability that allowed attackers to send
specially crafted malformed messages and thereby run any code of their choice
on a computer with no restrictions
– Attackers could then
• install any software on a machine
• Capture keystrokes to get passwords
• Impersonate users
• Read or delete any emails
Blaster Worm


Department of Homeland Security issued high[profile alerts but many businesses
and end users did not install patch
August 11, 2003, MSBlaster worm was released in the wild
–
–
–
–
–
–
–
Within 204 hours, over 330,000 computers were infected
Resulted in denial of service for Windows users as infected computers frequently
rebooted
Caused CSX Transportation Corporation to stop trains causing serious delays for
commuter rail service near Washington DC
Caused Air Canada to delay flights
forced Maryland’s motor vehicle agency to close for a day
Kicked Swedish Internet users offline
Contributed to the major power blackout on the East Coast
Goal of Chapter



For each environment – operating systems, applications,
databases, telecommunication networks, data networks, and Web
systems, we look at the risks that affect these environments and
learn about controls to mitigate the risks
Breach in one environment may affect other environments given
that these environments depend on each other
Most important environment that needs to be secured – operating
system
Common Operating Systems


Every command entered on a computer is managed and
processed by the operating system
– All data files, applications, and databases reside on the
operating system
Operating system – house that contains various safes
( applications and databases) – if someone breaks into
the house, they can just pick up the safe and run, no
matter how strong the security lock is on the safe
– Thus compromise of operating system almost always leads to
compromise of its contents including various applications and
database
Operating Systems





Operating system – software that controls the
operation of a computer and directs the processing of
programs by assigning storage space in memory and
controlling input and out functions
Interface between end user and various applications
Must also manage the hardware present in the
computer
API – application programming interface
Rainbow series books
– Orange book – trusted computer system evaluation
criteria – seven classes – see table 7.1
Orange Book summary chart

Division D – minimum security
– D systems that aren’t rated higher

Division C – discretionary protection
– C1 discretionary security protection
– C2 – controlled access protection


Division B
Division A
– A verified design
Common Operating Systems




Windows
Linux
z/OS
NetWare
Common Risks and Controls Authentication




Passwords
Risks
Controls
Other authentication technologies
Common Risks and Controls Authorization



Permissions
Risks
Controls
Common Risks and Controls –
Trust Relationships

Why establish trust?
– Data exchange between two systems
without requiring user intervention to first
authenticate and authorize the transaction
– User movement across multiple systems
without having to re-authenticate


Risks
Controls
Common Risks and Controls – Job
Scheduling


Risks
Controls
Common Risks and Controls – File
Systems





Local File Systems
Remote File Systems
File and Directory Permissions
Risks
Controls
Common Risks and Controls –
Software Updates


Risks
Controls
Assurance Considerations




Number of workstations and servers on
system
Number of different operating systems
used
Criticality of the computers or data stored
on the system
Types of tools available for collection
and analysis of data detailing the
security controls
Vocabulary Review















Access control list
Active directory
Application programming interface
Authentication
Authorization
Baseline
Biometrics
brute-force attacks
Common internet file system (CIFS)
Dictionary attacks
File system
Jobs
Malware
netWare directory service (NDS)
Network file system (NFS)
Vocabulary Review
















One-time password (OTP)
One-way hash algorithms
Operating system
Password file
Password hash
Permissions
piggybacking
Root
Salt
Samba
Secure shell (SSH)
Server message block (SMB)
Shadow file
Smart card
Tripwire
Trust relationship
Questions for Monday

Identify common risks to application
security and suggest at least one control
to mitigate each risk