Scribd
Upload
3 views

Week 9 Operating System Security

The document outlines various types of security threats to operating systems, including malware, phishing, and denial-of-service attacks. It also discusses basic security mechanisms such as access controls, encryption, and user authentication methods. Additionally, it highlights secure OS design principles like least privilege, defense in depth, and secure defaults.

Uploaded by

david.kaje
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
3 views

Week 9 Operating System Security

The document outlines various types of security threats to operating systems, including malware, phishing, and denial-of-service attacks. It also discusses basic security mechanisms such as access controls, encryption, and user authentication methods. Additionally, it highlights secure OS design principles like least privilege, defense in depth, and secure defaults.

Uploaded by

david.kaje
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Week 9: Operating System Security

1. Types of Security Threats

• Malware: Malicious software designed to damage or disrupt systems.


o Types:
▪ Virus: Attaches to files and spreads when the file is executed. Can
corrupt or delete files.
▪ Worm: Self-replicates and spreads through networks. Does not require
a host file.
▪ Trojan: Disguises itself as legitimate software to gain unauthorized
access.
• Phishing: Fraudulent attempts to acquire sensitive information by pretending to be a
trustworthy entity.
• Denial-of-Service (DoS) Attacks: Overload a system or network to make it unavailable
to users. Often achieved through flooding the target with excessive traffic.

2. Basic OS Security Mechanisms

• Access Controls: Regulate who can access resources and at what level. Includes:
o User Authentication: Verifies the identity of users (e.g., usernames and
passwords).
o Authorization: Determines what actions authenticated users can perform (e.g.,
read, write permissions).
• Encryption: Converts data into a secure format that can only be read or decrypted by
authorized entities.
o Types:
▪ Symmetric Encryption: Uses the same key for encryption and
decryption (e.g., AES).
▪ Asymmetric Encryption: Uses a pair of keys (public and private) for
encryption and decryption (e.g., RSA).
• Authentication: Verifies user identity through methods such as:
o Passwords: A common but less secure method of authentication.
o Biometrics: Uses physical characteristics (e.g., fingerprints, facial recognition)
for authentication.
o Two-Factor Authentication (2FA): Combines two or more methods for
enhanced security.

3. User Authentication and Access Control

• Authentication: Methods for verifying user identities.


o Password-Based Authentication: Users provide a password to gain access.
o Biometric Authentication: Uses unique biological traits for verification (e.g.,
fingerprints).
o Two-Factor Authentication (2FA): Requires two forms of verification (e.g.,
password and a mobile device code).
• Access Control: Manages permissions and access rights for users and processes.
o Discretionary Access Control (DAC): Users have control over their own
resources and permissions.
o Mandatory Access Control (MAC): Access permissions are determined by the
system based on classification levels (e.g., military security classifications).

4. Secure OS Design Principles

• Principles:
o Least Privilege: Users and programs should operate with the minimum level of
access necessary to perform their tasks.
o Defense in Depth: Multiple layers of security should be implemented to protect
against threats.
o Secure Defaults: Systems should be configured securely out of the box to
minimize vulnerabilities.

You might also like