Computer security by design
There are two different
approaches to
security in
computing. One focuses mainly on
external
threats, and generally treats
the
computer system itself as a
trusted system. This philosophy
is discussed in the
computer insecurity article.
The other, discussed in this
article, regards the computer system
itself as largely an untrusted
system, and redesigns it to make it
more secure in a number of ways.
This technique enforces the
principle of least privilege to
great extent, where an entity has
only the privileges that are needed
for its function. That way, even if
an
attacker has subverted one part
of the system, fine-grained security
ensures that it is just as difficult
for them to subvert the rest.
Furthermore, by breaking the
system up into smaller components,
the complexity of individual
components is reduced, opening up
the possibility of using techniques
such as
automated theorem proving to
prove the correctness of crucial
software subsystems. Where formal
correctness proofs are not possible,
rigorous use of
code review and
unit testing measures can be
used to try to make modules as
secure as possible.
The design should use "defense
in depth", where more than one
subsystem needs to be compromised to
compromise the security of the
system and the information it holds.
Subsystems should default to secure
settings, and wherever possible
should be designed to "fail secure"
rather than "fail insecure" (see
fail safe for the equivalent in
safety engineering). Ideally, a
secure system should require a
deliberate, conscious, knowledgeable
and free decision on the part of
legitimate authorities in order to
make it insecure. What constitutes
such a decision and what authorities
are legitimate is obviously
controversial.
In addition, security should not
be an all or nothing issue. The
designers and operators of systems
should assume that security breaches
are inevitable in the long term.
Full
audit trails should be kept of
system activity, so that when a
security breach occurs, the
mechanism and extent of the breach
can be determined. Storing audit
trails remotely, where they can only
be appended to, can keep intruders
from covering their tracks. Finally,
full disclosure helps to ensure
that when bugs are found the "window
of vulnerability" is kept as
short as possible.
Early history of security by
design
The early
Multics operating system was
notable for its early emphasis on
computer security by design, and
Multics was possibly the very first
operating system to be designed as a
secure system from the ground up. In
spite of this, Multics' security was
broken, not once, but repeatedly.
This led to further work on computer
security that prefigured modern
security engineering techniques.
Secure coding
The majority of software
vulnerabilities result from a
few known kinds of coding defects.
Common software defects include
buffer overflows,
format string vulnerabilities,
integer overflow, and
code/command injection.
Some common languages such as C
and C++ are vulnerable to all of
these defects (see Seacord,
"Secure Coding in C and C++").
Other languages, such as Java, are
immune to some of these defects, but
are still prone to code/command
injection and other software defects
which lead to software
vulnerabilities.
Techniques for creating secure
systems
The following techniques can be
used in engineering secure systems.
These techniques, whilst useful, do
not of themselves ensure security.
One security maxim is "a security
system is no stronger than its
weakest link"
-
Automated theorem proving
and other verification tools can
enable critical algorithms and
code used in secure systems to
be mathematically proven to meet
their specifications.
- Thus simple
microkernels can be written
so that we can be sure they
don't contain any bugs: eg
EROS and
Coyotos.
A bigger OS, capable of providing
a standard API like POSIX, can be
built on a microkernel using small
API servers running as normal
programs. If one of these API
servers has a bug, the kernel and
the other servers are not affected:
eg
Hurd.
-
Cryptographic techniques can
be used to defend data in
transit between systems,
reducing the probability that
data exchanged between systems
can be intercepted or modified.
- Strong
authentication techniques
can be used to ensure that
communication end-points are who
they say they are.
Secure cryptoprocessors can be
used to leverage
physical security techniques
into protecting the security of the
computer system.
-
Chain of trust techniques
can be used to attempt to ensure
that all software loaded has
been certified as authentic by
the system's designers.
-
Mandatory access control can
be used to ensure that
privileged access is withdrawn
when privileges are revoked. For
example, deleting a user account
should also stop any processes
that are running with that
user's privileges.
-
Capability and
access control list
techniques can be used to ensure
privilege separation and
mandatory access control. The
next sections discuss their use.
Some of the following items
may belong to the
computer insecurity article:
- Don't run an
application with known
security flaws. Either leave it
turned off until it can be
patched or otherwise fixed, or
delete it and replace it with
some other application. Publicly
known flaws are the main entry
used by
worms to automatically break
into a system and then spread to
other systems connected to it.
The security website
Secunia provides a search
tool for unpatched known flaws
in popular products.
Cryptographic
techniques involve
transforming
information, scrambling
it so it becomes
unreadable during
transmission. The
intended recipient can
unscramble the message,
but eavesdroppers
cannot.
-
Backups are a way of
securing your information; they
are another copy of all your
important computer files kept in
another location. These files
are kept on hard disks,
CD-Rs,
CD-RWs, and
tapes. Backups can be kept
in a multitude of locations,
some of the suggested places
would be a fireproof,
waterproof, and heat proof safe,
or in a separate, offsite
location than that in which the
original files are contained.
Some individuals and companies
also keep their backups in
safe deposit boxes inside
the
vaults of
banks. There is also a
fourth option, which involves
using one of the
file hosting services that
backs up files over the
Internet for both business
and individuals.
- Backups are also
important for reasons other
than security. Natural
disasters, such as
earthquakes, hurricanes, or
tornadoes, may strike the
building where the computer
is located. The building can
be on fire, or an explosion
may occur. There needs to be
a recent backup at an
alternate secure location,
in case of such kind of
disaster. The backup needs
to be moved between the
geographic sites in a secure
manner, so as to prevent it
from being stolen.
-
Anti-virus software consists
of computer programs that
attempt to identify, thwart and
eliminate
computer viruses and other
malicious software (malware).
-
Firewalls are systems which
help protect computers and
computer networks from attack
and subsequent intrusion by
restricting the network traffic
which can pass through them,
based on a set of system
administrator defined rules.
- Access
authorization restricts
access to a computer to group of
users through the use of
authentication systems.
These systems can protect either
the whole computer - such as
through an interactive
logon screen - or individual
services, such as an
FTP server. There are many
methods for identifying and
authenticating users, such as
passwords,
identification cards, and,
more recently,
smart cards and
biometric systems.
-
Encryption is used to
protect your message from the
eyes of others. It can be done
in several ways by switching the
characters around, replacing
characters with others, and even
removing characters from the
message. These have to be used
in combination to make the
encryption secure enough, that
is to say, sufficiently
difficult to
crack.
Public key encryption is a
refined and practical way of
doing encryption. It allows for
example anyone to write a
message for a list of
recipients, and only those
recipients will be able to read
that message.
-
Intrusion-detection systems
can scan a network for people
that are on the network but who
should not be there or are doing
things that they should not be
doing, for example trying a lot
of passwords to gain access to
the network.
-
Social engineering awareness
- Keeping yourself and your
employees aware of the dangers
of social engineering and/or
having a policy in place to
prevent social engineering can
reduce successful breaches of
your network and servers.
Capabilities vs. ACLs
Within computer systems, the two
fundamental means of enforcing
privilege separation are
access control lists (ACLs) and
capabilities. The semantics of
ACLs have been proven to be insecure
in many situations (e.g.,
Confused deputy problem). It has
also been shown that ACL's promise
of giving access to an object to
only one person can never be
guaranteed in practice. Both of
these problems are resolved by
capabilities. This does not mean
practical flaws exist in all
ACL-based systems — only that the
designers of certain utilities must
take responsibility to ensure that
they do not introduce flaws.
Unfortunately, for various
historical reasons, capabilities
have been mostly restricted to
research
operating systems and commercial
OSes still use ACLs. Capabilities
can, however, also be implemented at
the language level, leading to a
style of programming that is
essentially a refinement of standard
object-oriented design. An open
source project in the area is the
E language
[1].
The Cambridge
CAP computer demonstrated the
use of capabilities, both in
hardware and software, in the 1970s,
so this technology is hardly new. A
reason for the lack of adoption of
capabilities may be that ACLs
appeared to offer a 'quick fix' for
security without pervasive redesign
of the operating system and
hardware.
The most secure computers are
those not connected to the Internet
and shielded from any interference.
In the real world, the most security
comes from
operating systems where
security is not an add-on, such
as
OS/400 from
IBM. This almost never shows up
in lists of vulnerabilities for good
reason. Years may elapse between one
problem needing remediation and the
next.
A good example of a current
secure system is
EROS. But see also the article
on
secure operating systems.
TrustedBSD is an example of an
opensource project with a goal,
among other things, of building
capability functionality into the
FreeBSD operating system. Much
of the work is already done.
Other uses of the term "trusted"
The term "trusted" is often
applied to operating systems that
meet different levels of the
common criteria, some of which
are discussed above as the
techniques for creating secure
systems.
A computer industry group led by
Microsoft has used the term
"trusted system" to include making
computer hardware that could impose
restrictions on how people use their
computers. The project is called the
Trusted Computing Group (TCG).
See also
Next-Generation Secure Computing
Base.
Computer security is a highly
complex field, and it is relatively
immature, except on certain very
secure systems that never make it
into the news media because nothing
ever goes wrong that can be
publicized, and for which there is
not much literature because the
security details are proprietary.
The ever-greater amounts of money
dependent on electronic information
make protecting it a growing
industry and an active research
topic.
Notable persons in computer
security
-
