Outline for March 8, 1999

  1. Greetings and felicitations!
    1. Should have homework 1 and 2 back, along with project parts 1 and 2 (if you handed them in)?
  2. Penetration Exercises
    1. MTS
    2. Burroughs
  3. Vulnerabilities Databases
    1. Federated or centralized?
    2. What should they contain?
    3. Use: basis forFlaw Hypothesis step of FHM
    4. Use: basis for testing classification schemes
  4. Exploit Databases
    1. Federated or centralized?
    2. Difference between them and vulnerabilities databases
    3. Use: analysis of detritus
  5. Avoiding Vulnerabilities
    1. Good programming design (eight rules follow; Saltzer and Schroeder)
    2. Good implementation practise (more next week)
  6. Principles of Secure Design
    1. Refer to both designing secure systems and securing existing systems
    2. Speaks to limiting damage
  7. Principle of Least Privilege
    1. Give process only those privileges it needs
    2. Discuss use of roles; examples of systems which violate this (vanilla UNIX) and which maintain this (Secure Xenix)
    3. Examples in programming (making things setuid to root unnecessarily, limiting protection domain; modularity, robust programming)
    4. Example attacks (misuse of privileges, etc.)
  8. Principle of Fail-Safe Defaults
    1. Default is to deny
    2. Example of violation: su program
  9. Principle of Economy of Mechanism
    1. KISS principle
    2. Enables quick, easy verification
    3. Example of complexity: sendmail
  10. Principle of Complete Mediation
    1. All accesses must be checked
    2. Forces system-wide view of controls
    3. Sources of requests must be identified correatly
    4. Source of problems: caching (because it may not reflect the state of the system correctly); examples are race conditions, DNS poisoning
  11. Principle of Open Design
    1. Designs are open so everyone can examine them and know the limits of the security provided
    2. Does not apply to cryptographic keys
    3. Acceptance of reality: they can get this info anyway
  12. Principle of Separation of Privilege
    1. Require multiple conditions to be satisfied before granting permission/access/etc.
    2. Advantage: 2 accidents/errors/etc. must happen together to trigger failure
  13. Principle of Least Common Mechanism
    1. Minimize sharing
    2. New service: in kernel or as a library routine? Latter is better, as each user gets their own copy
  14. Principle of Psychological Acceptability
    1. Willingness to use the mechanisms
    2. Understanding model
    3. Matching user's goal
  15. Auditing
    1. Goals: reconstruction or deduction?
    2. Relationship to security policy
    3. Application logs
    4. System logs
  16. Example analysis technique
    1. GOAL methodology
    2. Do it on local file accesses
  17. Problems
    1. Log size
    2. Impact on system services
    3. Correllation of disparate logs

You can get this document in ASCII text, Framemaker+SGML version 5.5, PDF (for Acrobat 3.0 or later), or Postscript.
Send email to cs253@csif.cs.ucdavis.edu.

Department of Computer Science
University of California at Davis
Davis, CA 95616-8562

Page last modified on 3/15/99