Foundation Of Computer

and Introduction to Windows

Security

DABUDZ
Foundation of computer security
•Reliability: accidental failures.
•Usability: operating mistakes.
•Security: intentional failures.
Security
•Security is about the protection of assets.
•Hence, computer security is about the protection of IT assets (i.e. hardware,
software, data & information, and reputation).
•Protection measures can be classified as follows:
oPrevention: taking measures that prevent your assets from being damaged.
oDetection: taking measures that allow you to detect when an asset has been
damaged, how it has been damaged, and who has caused the damage.
oReaction: taking measures that allow you to recover your assets or to recover
from damage to your assets.
Security
Example#1: protection of valuable items kept in your private home.
• Prevention:
o locks at the door and windows bars.
o A wall round the property.
o Add another layer of protection.

• Detection:
o you will detect when something has been stolen if it is no longer there.
o A burglar alarm goes off when a break in occurs.
o Closed circuit television camera

• Reaction:
o call police.
o You may decide to replace the stolen item.
Security
Example #2: Protecting Credit Card from being ‘stolen’ on the web.
•Prevention:
o Use encryption when placing an order.
o Relay on the merchant to perform some checks on the caller before accepting a credit card order.
o Don’t use your card number on the internet.

•Detection:
o Transaction that you didn’t authorize appears on your credit card statement.

•Reaction:
o Ask for new card number.
o The cost of the fraudulent transaction may have to be cover by the card holder, the merchant where the
fraudster made the purchase, or the card issuer.
Computer security
•Computer Security aims to preserve:
o Confidentiality : prevention of unauthorized disclosure of information.
o Integrity : prevention of unauthorized modification of information.
o Availability : prevention of unauthorized withholding of information or resources.

•As lists are never complete you can add further points such as authenticity , Legitimate Use,
accountability or nonrepudiation.
Integrity

Availability

Confidentiality

CIA model

Computer security
 Confidentiality
Prevention of unauthorised disclosure of information

•Historically, security and secrecy were closely related (even today?!).

•Confidentiality (Privacy ,Secrecy).
•Hiding the content of a document OR hiding its very existence.
•Unlinkability: two or more items of interest (e.g. messages, actions, events,
users, etc.) are unlinkableif an attacker cannot sufficiently distinguish whether
they are related or not.
•Anonymity: A subject (e.g. user) is anonymous if it cannot be identified within a
given anonymity set of subjects.
 Integrity
prevention of unauthorized modification of information

•It is not easy to give a concise definition of integrity.

•Does prevention of unauthorized actions fall under integrity?
•Clark and Wilson : no user of the system , even if authorized, may be permitted to modify data
items in such a way that assets or accounting records of the company are lost or corrupted.
•We have captured security by specifying the user actions that have to be controlled.
•External consistency : the data stored in a computer system should correctly reflect some reality
outside the computer system. (DoD’sOrange book)
Integrity
•Integrity in communication security: refers to the detection and correction of
modifications to, insertion in, deletion , or replay of transmitted data.
•This include both intentional manipulations and random transmission errors.
•Integrity is often a prerequisite for other security properties (e.g. protecting OS
access control data so an attacker cannot change it to gain unauthorized access
to documents). Here we have to protect the integrity of access control to
achieve confidentiality.
Availability
prevention of unauthorised withholding of information or resources

•According to ISO 7498-2:

o Availability: the property of being accessible and usable upon demand by an authorized user.
o Denial of Service (DoS):the prevention of authorized access to resources or the delaying of time-critical
operations.

•Although that availability is one of the most important aspects of computer security, there is a
lack of security mechanisms effectively protecting against DoS attacks.
•Security mechanisms that are too restrictive or too expensive can themselves lead to DoS
Accountability
•It is hard to prevent all improper actions:
o we may find that authorized actions can lead to a security violation.
o we may find a flaw in our security system that allow an attacker to find a way past our
controls.
•Users should be hold responsible for their actions.
•Accountability : audit information must be selectively kept and protected so that actions
affecting security can be traced to the responsible party. (the Orange book)
•In order to do this, the system should first identify and authenticate its users.
•It has to keep an audit trail (is a log of security-relevant events).
Non-repudiation
•Non-repudiation is related to accountability.
•Non-repudiation: services provide unforgeable evidence that a
specific action occurred.
•Digital signatures provide non-repudiation.
•Non-repudiation of origin: providing evidence about the sender of a
document.
•Non-repudiation delivery: providing evidence that a message was
delivered to a specific recipient.
Reliability
•Reliability (accidental failures) & safety (impact of failures on the environment).
•Reliability only quantifies the frequency of failures, disregarding the
consequences of a failure. From a safety point of view it is important to consider
the consequences of failures, especially the failures that lead to hazards.
•Security and reliability are very much related and intersected.
•Dependability: the property of a computer system such that reliance can
justifiably be placed on the service it delivers. (IFIP WG 10.4)

*skip 3.1.9
The fundamental Dilemma of computer
security
•Security-unaware users have specific security requirements but usually no
security expertise.
•A security unaware user cannot make educated decisions about security
products and will have to pick standard ‘best practice’ solutions.
•Standard solutions may not address the user’s specific requirements.
•There is a trade-off between security and ease-of-use since:
oSecurity mechanisms need additional computational resources.
oSecurity interferes with the working patterns users are accustomed to.
oEffort has to be put into managing security.
Data vs. Information
•Data represents information.
•Information is the interpretation of data.
•Data is physical phenomena chosen by convention to represent certain aspects
of our conceptual and real world. The meanings we assign to data are called
information.
•A covert channel is an information flow that is not controlled by a security
mechanism.
Principles of Computer Security
•Fundamental design parameters of computer security.
Application
Software

User Resource
(subject) (object)

Hardware

•The figure above sketches the main dimensions in the design space for computer security.
Horizontal axis represents the focus of the security policy, whilst the vertical axis represents the
layer of the computer system where a protection mechanism is implemented.
Focus of Control
First Design Decision:
In a given application (i.e. a cash machine), should the protection mechanism in a computer
system focus on:
•data;
•Operations; and/or
•users (access control)?
It is a fundamental design decision choosing which these options to take when applying security
controls. Operating system have traditionally focused on protection data. In modern
applications, it is often more relevant to control users’ actions.
The Man-Machine Scale

more generic simple machine-oriented

Applications

more specific complex man-oriented

Mechanisms towards the center tend to be more Services

generic while mechanisms at the outside are more OS

likely to address individual user requirements OS Kernel

Hardware

Second Design Decision:

In which layer of the computer system should a security mechanism be placed?
 Complexity vs. Assurance
•There is a trade-off between complexity and assurance.
Third Design Decision:
Simple with higher assurance OR complex with a feature-rich
security environment?
•Feature-rich security and high assurance do not match easily
 Centralized vs. Decentralized
• Centralized(If a single entity is in charge of security):
o Easy to achieve uniformity.
o Better control.

BUT
o Performance bottleneck.
o Single Point of Failure (SPoF).

• Decentralized(Distributed):
o More efficient.
o No SPoF.

BUT
o More expensive and complicated (e.g. cost, management, etc.).

Fourth Design Decision:

Centralized OR decentralized?
 The Layer Below
•Every protection mechanism defines a security perimeter (boundary).
•Attackers may bypass protection mechanisms at some layer.
Fifth Design Decision:
How can you prevent an attacker from getting access to a layer below the protection
mechanism?
•The Layer Below – Examples:
1. Recovery tools, like Norton Utilities, restore the data by reading memory directly and then
restoring the file structure. Such a tool can be used to circumvent logical access control as it
does not care for the logical memory structure
The Layer Below – Examples
2. Unix treats I/O devices and physical memory devices like files. If access
permissions are defined badly, e.g. if read access is given to a disk containing
read protected files, then an attacker can read the disk contents and reconstruct
the files.
3. Object reuse: in a single processor system, when a new process becomes
active, it gets access to memory positions used by the previous process. You
have to avoid storage residues, i.e. data left behind in the memory area allocated
to the new process.
4. Buffer Overruns: a value is assigned to a variable that is too large for the
memory buffer allocated to that variable , so that memory allocated to other
variables is overwritten.
The Layer Above
•It is not very wise design decision to spend much time and effort
trying to protect a layer from the layer above it!
•The security services provided by a layer are mostly not sufficient to
the layer above it which requires more complex man-oriented
services.
Windows 11 has many security
features
Secured-core PC standards
Secured-core PCs (SCPCs) use a combination of hardware, firmware, and virtualization to protect devices
:from threats. Some of the standards that make up SCPCs include
Dynamic Root of Trust Measurement (DRTM)
Transfers control from the CPU to the Windows hypervisor loader to launch the system into a trusted
state
Trusted Platform Module 2.0 (TPM)
Meets the latest Microsoft requirements for the Trusted Computing Group (TCG) specification
Direct Memory Access (DMA) Protection
The device supports Memory Access Protection (Kernel DMA Protection)
Hypervisor-protected code integrity (HVCI)
Ensures that only signed and trusted code is allowed to execute in the kernel
Secured-core PC standards
Virtualization Based Security (VBS)
Creates a Virtual Secure Mode (VSM) to offer security boundaries within the operating system
Monitoring agent
Uses virtualization-based security to perform secure anti-tampering and secure monitoring of
Windows
:SCPCs protect devices from threats such as
Malware
Physical possession issues, like loss or theft
Access attacks
Virtualization-Based Security
(VBS)
Virtualization-Based Security (VBS) is a Windows
technology that utilizes hardware virtualization and
the Windows hypervisor to create an isolated
.environment
This environment allows security-sensitive processes
to run separately from the operating system and
hardware, enhancing protection against various
.threats
Hypervisor-Protected Code
Integrity (HVCI)
Hypervisor-Protected Code Integrity (HVCI), also known as
memory integrity, is a security feature in Windows that
utilizes hardware technology and virtualization to enhance
system security. It isolates the decision-making process for
code integrity, helping to prevent unauthorized code from
executing in high-security areas of the operating system.
This feature is part of Windows' core isolation capabilities,
.which protect against various types of malware and attacks
Secure Boot
Secure Boot is a security feature in Windows, particularly
emphasized in Windows 11, that prevents malicious software from
loading during the startup process. It ensures that the device boots
only using trusted software, protecting against rootkits and malware
.that could take control before the operating system starts
Make sure to double-check your system settings if you're configuring
Secure Boot, as it can impact your ability to run certain operating
.systems or boot configurations
Windows Firewall
Windows Firewall is a built-in security feature of Microsoft
Windows that helps protect devices by filtering network
traffic that enters and exits the system. It was originally
included in Windows XP Service Pack 2 and Windows Server
2003 Service Pack 1. The firewall can also be configured
using Group Policy objects (GPOs) for more advanced
.security management
BitLocker Drive Encryption
BitLocker Drive Encryption is a built-in Windows security
feature that encrypts entire volumes to protect data from
theft or exposure on devices running Windows Pro,
.Enterprise, or Education editions

It first appeared in Windows Vista and is designed to secure

.data against loss or unauthorized access
Smart App Control
Smart App Control is a feature of Windows 11
designed to block malicious, untrusted, or potentially
unwanted applications from executing on your
device. It integrates Microsoft's app intelligence
services with Windows' code integrity measures to
.enhance system security
Windows Defender System
Guard
Windows Defender System Guard is a suite of technologies
designed to protect the integrity of the Windows operating
system. It aims to ensure that the system cannot be
compromised and alert users if any threats are detected.
This includes features such as System Guard Secure Launch
and System Management Mode (SMM) protection, which
enhance the security of the startup process
Credential safeguards,
malware shields, and
application protection
Windows has a number of security features to protect against credential theft, malware, and
:application threats, including
Credential Guard
Uses virtualization-based security (VBS) to isolate credentials from the rest of the operating
system. This prevents malware from stealing passwords and other credentials, and protects against
credential theft attacks like pass the hash and pass the ticket. Credential Guard is enabled by
.default on Windows 11, version 22H2 and later
Malware shields
Windows 11 includes malware shields to help protect against suspicious activity. You can also install
.antivirus and antimalware software on your devices to detect and alert you to suspicious activity
.
Application protection
Windows 11 includes features like Win32 apps in isolation, token protection, and passkeys to
.help protect users and organizations against attack
Windows Hello
Works with hardware-based features like Trusted Platform Module (TPM) 2.0, biometric
.scanners, and Windows presence sensing to enable secure sign-on
BitLocker encryption
Has been optimized for additional security and performance, and is available on more devices
 Other security features of Windows 11 include: Phishing
Protection, Microsoft Azure Attestation (MAA),
Passwordless Access, Windows Defender Capabilities, and
.Account Lockout Policy Changes
Prepare for Interim