Chapter 28: User Security Dr. Wayne Summers Department of Computer Science Columbus State University Summers_wayne@colstate.edu http://csc.colstate.edu/summers

Policy U1 - Only users have access to their accounts U2 - No other user can read / change a file without the owner’s permission U3 - Users shall protect the integrity, confidentiality, and availability of their files U4 - Users shall be aware of all commands that they enter, or that are entered on their behalf

Access Passwords Generate random passwords where possible Keep passwords secure Use proactive password checking program Login Procedure Trusted hosts Leaving System Screen locking program

Files and Devices Files File Permissions on Creation (use templates) Group Access (default deny) File Deletion (aliases, persistence) Devices Writeable Devices Smart Terminals Monitors and Window Systems

Processes Copying & Moving Files (different permissions) Accidentally Overwriting Files (confirmation) Encryption, Cryptographic Keys, and Passwords .netrc file for ftp Start-up Settings (trust start-up info) Limited Privileges Malicious Logic search path: should include only trusted directories

Electronic Communications Automated Electronic Mail Processing Execution of attachments Failure to Check Certificates Sending unexpected content Attachments to email