Operating System Security

• Operating systems are software that grants access to hardware resources such as the CPU, memory, and devices.
• Programs on a computer system necessitate CPU instruction execution and use of peripheral resources.
• Operating systems run programs as processes.
• Developers must allow concurrently executing processes to use resources while preserving their independence and ensuring resource fair sharing.

Building a Successful Operating System

• The operating system must provide mechanisms enabling high-performance use of a computer's resources.
• Operating systems should offer efficient resource management via file systems, memory management, and network protocol stacks so processes can use hardware.
• The operating system should switch among processes fairly for good performance and access to the computer's devices.
• Scheduling access to computer resources is essential.
• Resource access should be controlled to prevent one process from negatively impacting another, either inadvertently or maliciously.
• Ensuring the secure execution of processes involves system security.
• Correct resource and scheduling mechanism implementation is critical for secure execution.
• Resource mechanisms must provide boundaries to prevent interference.
• Scheduling mechanisms should make sure resources are available to prevent denial of service (DoS) attacks.

Secure Operating Systems

• Security mechanisms within a secure operating system ensure security goals are enforced despite potential threats.
• These mechanisms operate within the context of resource and scheduling mechanisms.
• Security goals define secure operation requirements for any processes the system may execute.
• Security mechanisms have to uphold these goals and prevent system misuse by attackers.
• The idea of a "secure operating system" is considered an ideal concept.
• Systems with a high degree of enforcement assurance are called secure or "trusted," but completely secure systems are rare given modern systems' complexity.
• Studying how to build an ideal secure operating system is important when assessing OS security.

Security Goals

• Security goals define how a system can execute operations while preventing unauthorized access
• Security goals describe system access to implement resources, satisfying secrecy, integrity, and availability.
• System access is based on subject operations (processes/users) performing actions (read/write) on objects (files/sockets).
• Secrecy limits objects that subjects can read for secret containment.
• Integrity limits objects that subjects can write, especially if others rely on the contained information for correct functioning.
• Some subjects cannot be trusted to modify objects.
• Availability limits system resources that subjects consume to avoid exhaustion.
• Security goals need to be clearly defined, practical, and enable popular software execution effectively.

Trust Model

• A system's trust model defines the software and data crucial for enforcing system security goals.

• The trust model for operating systems is termed the Trusted Computing Base (TCB).

• A system TCB should have the minimum amount of software to enforce security goals correctly.

• The software that must be trusted includes the software defining and enforcing the security goals which includes the OS security mechanisms.

• Software that bootstraps the TCB must be trusted.

• Ideally, a TCB includes an element that enables security goals to be loaded and enforced throughout the system's lifespan beginning from the software bootstrapping mechanism.

• In practice, a system TCB contains wide-ranging software and the enforcement mechanism operates within the OS.

• Software running outside the OS has to be trusted.

• For example, the OS relies on programs like login and SSH to authenticate users which requires trust for correct identification.

• Certain services are trusted to ensure a secure computing environment, such as windowing systems like X Window, which perform actions on behalf of running OS processes and have mechanisms that can violate security goals.

• X Window and other software must be added to a system’s TCB.

Operating System Developer (Trust Model)

• Developers must prove that their systems have viable trust models.
• This involves the TCB mediating security-sensitive operations, verifying the correctness of the software, and preventing external tampering.
• Identifying the TCB software is a complex process that often leads to challenges.
• Verifying the correctness of TCB software can be a complex task.
• With general-purpose systems, the amount of software that is not part of the main OS but is still part of the TCB, often exceeds the core, so this is impossible to verify formally.
• The system needs to protect the TCB and its data from unauthorized modification.
• Maintaining TCB integrity to resist system threats is essential, because compromised software is not trustworthy.

Threat Model

• A threat model defines how attackers can compromise system security.
• Attackers are able to inject network operations and control software outside the TCB.
• Attackers may actively try to violate the security goals of the system.
• If attacker vulnerabilities allow access to secret information or permits the subjects whose dependants' information to be modified, then compromised occurs.

Task of a Secure Operating System Developer

• This involves protecting the TCB from different threats.
• Protecting the TCB ensures the security goals become enforced from user processes.
• User processes are untrusted but protected from threats.
• A secure OS prevents user processes with secret data access from exfiltration by limiting process interactions.
• Protecting the TCB proves difficult because interactions with the untrusted processes is inevitable.
• The developer has to identify and assess threats, their system's security impact, and implement effective mitigation strategies so threats can be countered.
• The trusted computing base component has identify where untrusted network requests have come from, determine how system threats can impact component functions, and limit possible commands and inputs as countermeasures.
• The developer also needs to ensure that the components that have roles in the trusted computing base effectively prevent system threats.

These questions cover the core security responsibilities of operating systems, including resource management, process isolation, and access control. It also covers Trusted Computing Base (TCB) and trust models.