1. Chapter 15 Computer Security Techniques Patricia Roy Manatee Community College, Venice, FL ©2008, Prentice Hall Operating Systems: Internals and Design Principles, 6/E William Stallings

2. Authentication Basis for most type of access control and accountability Identification step Verification step

3. Password-Based Authentication ID –Determines if use authorized to access system –Determines privileges for user –Discretionary access control

4. UNIX Password Scheme

6. Token-Based Authentication User posses object Memory cards Smart cards

7. Biometric Authentication Facial characteristics Fingerprints Hand geometry Retinal pattern

8. Biometric Authentication Iris Signature Voice

9. Cost versus Accuracy

10. Access Control Discretionary access control –Based on identity of requestor Mandatory access control –Based on comparing security labels with security clearances Role-based access control –Based on roles user has in system

11. Extended Access Control Matrix

12. Organization of the Access Control Function

14. Users, Roles, and Resources

15. Access Control Matrix Representation of RBAC

17. Intrusion Detection Host-based Network-based

18. Intrusion Detection Sensors –Collect data Analyzers User interface

19. Profiles of Behavior of Intruders and Authorized Users

20. Host-Based IDSs Anomaly detection –Collection of data relating to behavior of legitimated users over time Signature detection –Define set of rules or attack patters

21. Audit Records Native audit records –Operating system accounting software Detection-specific audit records –Generate audit records required by the IDS

22. Antivirus Approaches Detection Identification Removal

23. Generic Decryption CPU emulator Virus signature scanner Emulation control module

24. Digital Immune System

25. Behavior-Blocking Software Operation

26. Worm Countermeasures Signature-based worm scan filters Filter-based worm containment Payload-classification-based worm containment

27. Worm Countermeasures Threshold random walk scan detection Rate limiting Rate halting

28. Buffer Overflow Compile-time defenses Stack protection mechanisms

29. Buffer Overflow Run-time defenses Executable address space protection Address space randomization Guard pages

30. Windows Vista Security Access control scheme –Access token –Indicates privileges

31. Windows Security Structures

32. Access Mask