Introduction to Information Security

Built-in Security Subsystems and Mechanisms

• To make installation and use easier, modern operating systems default to low security out of the box
• The process of increasing the security level is called hardening
• As operating systems mature, more security functionality is being built in
• For example, Kerberos ships with current Windows products
• Identification and authentication are mainly generic
• Other security functionality differs among products

System Security Principles and Practices

• Security planning starts with understanding potential risks
• Use risk assessment to determine and rank risks
• Implement controls for important risks (harden the system)
• A control is a mechanism that limits access to an object
• Test results of hardening
• Controls are working
• Access is not so restrictive that system doesn’t operate properly
• Train users to understand and use proper security

Windows Security Design

• Windows security model differs among products
• Model described here is for Windows server security
• Built on the concept of Active Directory
• A directory service data structure that enables access and addressing of objects across a network
• Objects are files, folders, shares, printers
• Subjects are logically grouped
• Each object has a discretionary access control list (DACL)
• Conflicts resolved by giving priority to the most specific rule governing an object and by giving priority to “deny” over “allow”

Windows Security Design (continued)

• Network resources (printers, computers, users, etc.) are grouped in domains
• Domains can be hierarchically grouped into trees and forests
• Access rules are specified at the domain level and inherited through groups and individual objects
• The Active Directory data structure can be physically distributed
• Local security is specified in local security objects