A Quantitative Model of Operating System Security Evaluation

Part of the Advances in Intelligent Systems and Computing book series (volume 167)

Abstract

Operating System (OS) as the root of trust for all applications running on the computer systems and plays an important role in information security. If the network or the software in application level that are executing on the operating system be unsecure, it is expected that OS as a defensive layer or in another words as the last defensive layer protects the security of information. In this paper, first, we extract and classify a vast spectrum of security features which has been used in multi-purposed OS, and then attribute them to three levels of low, medium and high. Our case study indicates how it is possible to evaluate OS security and specify the security level of an OS.

Keywords

OS security Security mechanisms Security levels Evaluation Methodology 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
  2. 2.
    Spencer, R., Smalley, S., Loscocco, P., Hibler, M., Andersen, D., Lepreau, J.: The Flask Security Architecture: System Support for Diverse Security Policies. In: Proc. of the 8th Conference on USENIX Security Symposium, SSYM 1999 (2009)Google Scholar
  3. 3.
    Nicol, D.M., Sanders, W.H., Trivedi, K.S.: Model-Based Evaluation: From Dependability to Security. The IEEE Transactions on Dependable and Secure Computing 1(1), 48–65 (2004)CrossRefGoogle Scholar
  4. 4.
    Jeffery, H.: Security Evaluation of the OpenBS Operating system, (2002), http://www.eduunix.ccut.edu.cn/index/pdf/Security%20Evaluation%20of%20the%20OpenBSD%20Operating%20System.pdf (last accessed: October 2011)
  5. 5.
    Information technology – Security techniques – Evaluation criteria for IT security – Part 1: Introduction and general model ISO/IEC 15408-1 (2009)Google Scholar
  6. 6.
    Hernan, S., Lambert, S., Ostwald, T., Shostack, A.: Threat Modeling: Uncover Security Design Flaws Using the STRIDE Approach (2006), http://msdn2.microsoft.com/hi-in/magazine/cc163519en-us.aspx (last Accessed: October 2011)
  7. 7.
    Chew, E., Swanson, M., Stine, K., Bartol, N., Brown, A., Robinson, W.: Performance measurement guide for information security. NIST Special Publication 800-55, Revision 1, Information Security (2008)Google Scholar
  8. 8.
    Security-enhanced Linux (SELinux), http://www.nsa.gov/selinux
  9. 9.
    Shostack, A.: Experiences Threat Modeling at Microsoft. In: Modeling Security Workshop. University, UK (2008), http://blogs.msdn.com/b/sdl/archive/2008/10/08/experiences-threat-modeling-at-microsoft.aspx (last accessed: October 2011)
  10. 10.
    Fuller, J., Ha, J., O’Brien, D., Radvan, S., Christensen, E.: Fedora 11 Security Guide: A Guide to Securing Fedora Linux. Red Hat Inc. (2008)Google Scholar
  11. 11.
    US National Institute of Standards, “Recommended Security Controls for Federal Information Systems and Organization”, NIST Special Publication 800-53 Revision 3, Information Security (2009)Google Scholar
  12. 12.
    Common Criteria EAL4+ Evaluated Configuration Guide for Red Hat Enterprise Linux 5 on HP Hardware, v 2.3 (2007)Google Scholar
  13. 13.
    US National Institute of Standards, Common Criteria for IT Security Evaluation, ISO Standard 15408 (1999), http://csrc.nist.gov/cc/
  14. 14.
    Mourani, G.: Securing and Optimizing Linux: Red Hat Edition, Open Network Architecture and Open Docs Publishing, v 1.3 (2000)Google Scholar
  15. 15.
    Scambray, J., McClure, S.: Hacking Exposed: Windows Security Secrets and Solutions. McGraw-Hill Prof. Med./Tech. (2007)Google Scholar
  16. 16.
    Mokhov, S.A., Laverdière, M., Benredjem, D.: Taxonomy of linux kernel vulnerability solutions. In: Innovative Techniques in Instruction Technology, E-learning, Eassessment, and Education, Proceedings of CISSE/SCSS 2007, pp. 485–493 (2007)Google Scholar
  17. 17.
    Kong, J.: Designing BSD Rootkits: An Introduction to Kernel Hacking. No Starch Press Inc., San Francisco (2007)Google Scholar
  18. 18.
    Trivedi, K.S., Kim, D.S., Roy, A., Medhi, D.: Dependability and Security Models. In: Proc. DRCN 2009 Improving Dependability by Revisiting Operating System Design (2009)Google Scholar
  19. 19.
    Gligor, V.: Architectures for practical security. In: Proc. of the 15th ACM Symposium on Access Control Models and Technologies, SACMAT (2010)Google Scholar
  20. 20.
    Rushby, J.M.: Design and verification of secure systems. In: Proceedings of the Eighth ACM Symposium on Operating Systems Principles, December 14-16, pp. 12–21 (1981)Google Scholar
  21. 21.
    Klein, G., Elphinstone, K., Heiser, G., Andronick, J., Cock, D., Derrin, P., Elkaduwe, D., Engelhardt, K., Kolanski, R., Norrish, M., Sewell, T., Tuch, H., Winwood, S.: seL4: formal verification of an OS kernel. In: Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles, October 11-14 (2009)Google Scholar
  22. 22.
    Rhee, J., Riley, R., Xu, D., Jiang, X.: Kernel Malware Analysis with Un-tampered and Temporal Views of Dynamic Kernel Memory. In: Jha, S., Sommer, R., Kreibich, C. (eds.) RAID 2010. LNCS, vol. 6307, pp. 178–197. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  23. 23.
    Seshadri, A., Luk, M., Qu, N., Perrig, A.: SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity OSes. In: Proc. of the 21st ACM Symposium on Operating Systems Principles, SOSP (October 2007)Google Scholar
  24. 24.
    Hughes, J.P., Feist, C.J.: Architecture of the Secure File System. Storage Technology Corporation (2001)Google Scholar
  25. 25.
    Song, J., Hu, G., Xu, Q.S.: Operating System Security and Host Vulnerability evaluation. In: Management and Service Science, MASS 2009 (2009)Google Scholar
  26. 26.
    Nguyen, A.M., Schear, N., Jung, H.D., Godiyal, A., King, S.T., Nguyen, H.D.: MAVMM: Lightweight and Purpose Built VMM for Malware Analysis. In: 2009 Annual Computer Security Applications Conference, pp. 441–450. IEEE (2009)Google Scholar
  27. 27.
    Weidner, K.: Common Criteria EAL4+ Evaluated Configuration Guide RedHat Enterprise Linux 5 on HP Hardware (2007)Google Scholar
  28. 28.
    National Security Agency, “Apple Mac OS X v10.3.x “Panther” Security Configuration Guide”, ver 1.1, SNAC (2004)Google Scholar
  29. 29.
    Mac OS X: System Hardening Guidelines for Faculty and Staff Desktops, http://www.info.apple.com/kbnum
  30. 30.
    COTS Compartmentalized Operations Protection Profile – Operating Systems (CCOPP-OS), ver. 2.0 (2008), http://www.commoncriteriaportal.org

Copyright information

© Springer-Verlag GmbH Berlin Heidelberg 2012

Authors and Affiliations

  1. 1.Operating System Security Lab (OSSL)Alzahra UniversityTehranIran
  2. 2.ICT DepartmentMalek-ashtar University of TechnologyTehranIran

Personalised recommendations