The Security Problem

Security must consider external environment of the system, and protect it from:

    1. unauthorized access.

    2. malicious modification or destruction

    3. accidental introduction of inconsistency.

Easier to protect against accidental than malicious misuse.

Authentication

User identity most often established through passwords, can be considered a special case of either keys or capabilities. Passwords must be kept secret.

    1. Frequent change of passwords.

    2. Use of “non-guessable” passwords.

    3. Log all invalid access attempts.

Passwords may also either be encrypted or allowed to be used only once.

Program Threats

Trojan Horse

  1. Code segment that misuses its environment.

  2. Exploits mechanisms for allowing programs written by users to be executed by other users.

Trap Door

   1. Specific user identifier or password that circumvents normal security procedures.

   2. Could be included in a compiler.

   3. Stack and Buffer Overflow

   4. Exploits a bug in a program (overflow either the stack or memory buffers.)