10 core functions of a trusted operating system

What security features are important to design a trusted operating system (OS)?

Trusted Operating System (TOS) generally refers to an operating system that provides sufficient support for multilevel security and evidence of correctness to meet a particular set of government requirements.

As a Microsoft MVP and Security advisor who is travelling internationally a lot, I always get the same question asked. “What is a trusted operating system “(OS)? The easy answer is An OS which has been tested by Common Criteria labs’ based to the ISO /IEC 15408 criteria and is and passed the test to call certified to be a Secure OS. As soon as the OS passes the test it will receive the “Evaluation Assurance Level (EAL) certificate. Based on this criteria I can call Windows as trusted OS ? But what will be tested? Let’s read the below article to find out the 10 core function needed in a trusted OS:

An OS is trusted if it can provide

Memory Protection : Each user’s program must run in a portion of memory protected against unauthorized accesses. The protection will certainly prevent outsiders’ accesses, and it may also control a user’s own access to restricted parts of the program space. Differential security, such as read, write, and execute, may be applied to parts of a user’s memory space
File Protection : aims to prevent programs from replacing critical OS files. Protecting core system files mitigates problems such as DLL hell with programs and the OS.
General object access control : Users need general objects, such as constructs to permit concurrency and allow synchronization. However, access to these objects must be controlled so that one user does not have a negative effect on other users
User Authentication : must identify each user who requests access and must ascertain that the user is actually who he or she purports to be. The most common authentication mechanism is password comparison.
I/O device access control: The OS must be able to have an I/O control with a lookup table with an access control matrix
Guaranteed fair service: All users expect CPU usage and other service to be provided so that no user is indefinitely starved from receiving service. Hardware clocks combine with scheduling disciplines to provide fairness. Hardware facilities and data tables combine to provide control To be able to design a trusted OS we have to build the components which makes the OS trusted. An OS is trusted if policy, Model, design and trust components can be added together

Policy: Security requirements, well defined, consistent, unambiguous, implementable
Model: Representation of the policy, formal. Should not degrade functionality.
Design: Includes functionality, implementation option
Trust: Review of features, assurance makes an OS worthy of trust .To trust an OS process’s must be not containing any malicious segments and they must be absent of security flows. The OS must be evaluated, approved and it must be secured by enforced security policies which will give as an assurance to have our sensitive information or our data will be protected.

The key features of a Trusted OS are:

Identification and Authentication: The OS should have the ability to tell who is requesting access to an object, and must be able to verify the subject’s identity.
Mandatory access control (MAC) provides that access control policy decisions are made beyond the control of the individual owner of an object. A central authority determines what information is to be accessible by whom, and the user cannot change access rights.
Discretionary access control (DAC), leaves a certain amount of access control to the discretion of the object’s owner or to anyone else who is authorized to control the object’s access. The owner can determine who should have access rights to an object and what those rights should be.
Object Reuse Protection ^]: OS goals include efficiency. It is often efficient to reuse objects rather than completely destroy them. Trusted systems must make sure that security cannot be abused due to the reuse of objects usually by clearing, or zeroing, out any object before it is allocated to the user.
Complete Mediation: Trusted OS’s must perform complete mediation, meaning that all accesses must be controlled and verified.
Trusted path : is a mechanism that provides confidence that the user is communicating with what the user intended to communicate with, ensuring that attackers can’t intercept or modify whatever information is being communicated.
Accountability and Audit: Accountability usually entails maintaining a log of security-relevant events that have occurred, listing each event and the person responsible for the addition, deletion, or change. A trusted OS must protected the audit logs from outsiders, and record every security-relevant event.
Audit Log Reduction: As logs can be huge in size trusted OS’s should have the ability to change the log location, or reduce the size based on needs.
Intrusion Detection: Trusted OS must be able to detect some attacks