Re: Secure OS Thoughts

dsr_at_Florence.edu
Date: 08/30/03 

Date: Sat, 30 Aug 2003 02:53:09 GMT

On 29 Aug 2003 14:51:35 -0700, mbealby@myrealbox.com (Martin Bealby)
wrote:

>I have been reading a large amount about cryptography recently, and a
>couple of things that appear again and again is the idea that you
>cannot build a secure system upon an insecure one, and that a system
>must be designed with security in mind from the outset. This set me
>thinking, why has nobody created a secure operating system. Now, I am
>not naive enough to think that any computer program can be 100%
>secure, but I imagine a large percentage of them did not have security
>as their number one goal. So I started thinking about this, and what
>the operating system would have to include. Below are the ideas I came
>up with:
>
>Objective:
>
> * To create a secure operating system suitable for use in highly
>security concious environments, with minimal risk of unauthorised
>access. Security is paramount, above all the system should be secure,
>even if this means a sacrafice in speed.
>[To quote Schneier: "We already have enough fast, insecure systems. We
>don't need another one."]
>
>Needed capabilities:
>
> * Forced write to disk, not just to buffers. [Possibly not available
>due to on disk caches?]
> * Assignment of secure memory when requested, that only that process
>can access and that will not by any means be written to a swap file.
>Possibly wiped when not needed anymore?
> * Secure file deletion from disks. [Links with point one.]
> * Minimal exploits due to broken code (buffer overflows etc) [Use of
>checking memory copy functions, random stack locations etc.]
> * Access control to devices.
> * Built-in correct implementations of encryption algorithms and key
>management protocols?
> * Logs of usage of devices, files, etc.
> * Encrypted filesystems?
> * Forced clearance of memory caches. [Is this possible?]
> * Cryptographicly secure random number generator.
> * Open source so even the *most* paranoid people can read it.
>
>These are the ideas that I came up with, I know that users are not
>bothered by security (usually), but I envisioned this operating system
>to be ran in high security environments, not one somebodies desktop.
>However, users will be users, so safeguards against common user side
>security flaws should also be reduced (Password checking, hashing
>etc.).
>
>I was just wondering if anyone else had any ideas on this topic. It is
>basically a list of security features that a paranoid person would
>want in an operating system, hence I'm posting it to sci.crypt :P
>
>Cheers,
>Martin

You could use google to search for terms such as "red black" emission
security etc. pretty much SOP for sensitive installations.

Relevant Pages

  • Re: Secure OS Thoughts
    ... > I have been reading a large amount about cryptography recently, ... > must be designed with security in mind from the outset. ... why has nobody created a secure operating system. ...
    (sci.crypt)
  • Secure OS Thoughts
    ... I have been reading a large amount about cryptography recently, ... must be designed with security in mind from the outset. ... why has nobody created a secure operating system. ...
    (sci.crypt)
  • Re: I have 2 versions of .NET, which is being used
    ... 'secure' memory methods in the CRT in VS2005 will not prevent your own ... that will detect buffer overruns in code that you have not written and ... important part of an operating system, it mandates that .NET is used as ... However, as I have pointed out elsewhere, the security of a process is ...
    (microsoft.public.dotnet.framework)
  • Re: Ten least secure programs
    ... it's probably better you leave the topic alone ... I said I do not have security issues with the programs I code. ... I didn't realize you were a Linux user, ... > the most widely used and secure UNIX flavors? ...
    (Security-Basics)
  • "An Asp.Net accident waiting to happen" - Draft article
    ... In a time where Security ... in shared hosting environments. ... technologies that allow the creation and deployment of secure ... IIS 6 web server and windows 2003 also provide some tools to deploy ...
    (microsoft.public.dotnet.framework.aspnet.security)