Dr. Erdal Ozkaya
Search
  • Home
  • Cybersecurity
  • 10 core functions of a trusted operating system

10 core functions of a trusted operating system

trusted operating system
Erdal2021-06-10T10:02:12-04:00

What security features are important to design a trusted operating system (OS)?

Trusted Operating System (TOS) generally refers to an operating system that provides sufficient support for multilevel security and evidence of correctness to meet a particular set of government requirements.

As a Microsoft MVP and Security advisor who is travelling internationally a lot, I always get the same question asked. “What is a trusted operating system “(OS)? The easy answer is An OS which has been tested by Common Criteria labs’ based to the ISO /IEC 15408 criteria and is and passed the test to call certified to be a Secure OS. As soon as the OS passes the test it will receive the “Evaluation Assurance Level (EAL) certificate. Based on this criteria I can call Windows as trusted OS ?  But what will be tested? Let’s read the below article to find out the 10 core function needed in a trusted OS:

An OS is trusted if it can provide

  • Memory Protection : Each user’s program must run in a portion of memory protected against unauthorized accesses. The protection will certainly prevent outsiders’ accesses, and it may also control a user’s own access to restricted parts of the program space. Differential security, such as read, write, and execute, may be applied to parts of a user’s memory space
  • File Protection : aims to prevent programs from replacing critical OS files. Protecting core system files mitigates problems such as DLL hell with programs and the OS.
  • General object access control : Users need general objects, such as constructs to permit concurrency and allow synchronization. However, access to these objects must be controlled so that one user does not have a negative effect on other users
  • User Authentication : must identify each user who requests access and must ascertain that the user is actually who he or she purports to be. The most common authentication mechanism is password comparison.
  • I/O device access control: The OS must be able to have an I/O control with a lookup table with an access control matrix
  • Guaranteed fair service: All users expect CPU usage and other service to be provided so that no user is indefinitely starved from receiving service. Hardware clocks combine with scheduling disciplines to provide fairness. Hardware facilities and data tables combine to provide control To be able to design a trusted OS  we have to build the components which makes the OS trusted. An OS is trusted if policy, Model, design and trust components can be added together
  • Policy: Security requirements, well defined, consistent, unambiguous, implementable
  • Model: Representation of the policy, formal. Should not degrade functionality.
  • Design: Includes functionality, implementation option
  • Trust: Review of features, assurance makes an OS worthy of trust .To trust an OS process’s must be not containing any malicious segments and they must be absent of security flows. The OS must be evaluated, approved and it must be secured by enforced security policies which will give as an assurance to have our sensitive information or our data will be protected.

The key features of a Trusted OS are:

  • Identification and Authentication: The OS should have the ability to tell who is requesting access to an object, and must be able to verify the subject’s identity.
  • Mandatory access control (MAC) provides that access control policy decisions are made beyond the control of the individual owner of an object. A central authority determines what information is to be accessible by whom, and the user cannot change access rights.
  • Discretionary access control (DAC), leaves a certain amount of access control to the discretion of the object’s owner or to anyone else who is authorized to control the object’s access. The owner can determine who should have access rights to an object and what those rights should be.
  • Object Reuse Protection ]: OS goals include efficiency. It is often efficient to reuse objects rather than completely destroy them. Trusted systems must make sure that security cannot be abused due to the reuse of objects usually by clearing, or zeroing, out any object before it is allocated to the user.
  • Complete Mediation: Trusted OS’s must perform complete mediation, meaning that all accesses must be controlled and verified.
  • Trusted path : is a mechanism that provides confidence that the user is communicating with what the user intended to communicate with, ensuring that attackers can’t intercept or modify whatever information is being communicated.
  • Accountability and Audit: Accountability usually entails maintaining a log of security-relevant events that have occurred, listing each event and the person responsible for the addition, deletion, or change. A trusted OS must protected the audit logs from outsiders, and record every security-relevant event.
  • Audit Log Reduction: As logs can be huge in size trusted OS’s should have the ability to change the log location, or reduce the size based on needs.
  • Intrusion Detection: Trusted OS must be able to detect some attacks

This article explained what is a trusted operating system .  If you want to learn what Operational security is :

https://www.erdalozkaya.com/operational-security/

References 
[1] http://en.wikipedia.org/wiki/Trusted_operating_system[2] Security in Computing C. Pfleeger Chapter 5[3] http://www.csee.wvu.edu/~cukic/Security/NotesTrusted_OS.pdf[4] Security in Computing C. Pfleeger Chapter 5[5] Security in Computing C. Pfleeger Chapter 5[6] http://www.csee.wvu.edu/~cukic/Security/NotesTrusted_OS.pdf[7] Book : Security in Computing C. Pfleeger Chapter 5[8] http://www.fas.org/irp/nsa/rainbow/tg018.htm[9] http://en.wikipedia.org/wiki/Trusted_path

 

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *


Related Posts

TechTarget CISO Erdal

Why CISOs need to understand the business –

Why CISOs need to understand the business While CISOs need technical skills, business skills help them push their team's agenda and... read more

Windows Security and Forensics – Free 0nline Training

  Every organization must prepare for the possibility of cybercrime within its networks or on its computer systems. Are... read more
Practical Cyber Threat Intelligence

Practical Cyber Threat Intelligence – coming soon 1

Practical Cyber Threat Intelligence Gather, Process, and Analyze Threat Actor Motives, Targets, and Attacks with Cyber Intelligence Practices Easy to pronounce, write... read more
Essential Components of a Zero Trust Erdal Ozkaya

Essential Components of a Zero Trust Architecture : Free VIDE0

Essential Components of a Zero Trust The key components of an effective "zero trust" architecture include multifactor authentication, network segmentation, and... read more
ECC CEH Hall of Fame 2021 Dr Erdal Ozkaya

EC Council CEH Hall of Fame News 2021

Shortlisted at EC Council CEH Hall of Fame I am happy to announce that I have been shortlisted to be in... read more
COVID19 and Cyber Risk

COVID19 and Cyber Risk – Fight against cybercrime

COVID19 and Cyber Risk The current circumstance of COVID-19 can increase organizations vulnerability to cyber-attacks, phishing attempts and fraud. All organizations... read more
Cybersecurity Attack and Defense Strategies v3

Cybersecurity Attack and Defense Strategies 3rd Edition

Cybersecurity Attack and Defense Strategies v3 We are very pleased to announce that the 3rd edition of our award-winning Cybersecurity book... read more

A hacking anatomy and what we can learn out of it! (2012)

A hacking anatomy and what we can learn out of it! There is nearly no single week , we don’t read... read more
Feedback

Microsoft Ignite Feedback – Thankful <3

Microsoft Ignite Feedback Just WOW! Computer Hacked live..in span of 5 Seconds ? Yep, brave ! MSignite Twitter 247101 Erdal, Hasain, Marcus... read more
General Military Staff of Turkey award Erdal Ozkaya

General Military Staff of Turkey awarded me and I am thankful <3

General Military Staff of Turkey, We all work hard, we all sacrifice from our own time to help our customers. Of course... read more

Categories

  • About Dr Erdal Ozkaya (300)
    • Awards (97)
    • Erdal in the news (121)
    • Feedback (88)
    • My Books (53)
    • Who is Dr Erdal Ozkaya ? (2)
  • Announcemets (305)
  • Artificial Intelligence AI (11)
  • Certification (52)
  • Cloud Computing (73)
  • Cybersecurity (325)
  • Cybersecurity Leadership (58)
  • Digital Transformation (2)
  • Financial Sector (31)
  • Forensics (17)
  • Free Events (166)
  • General (138)
  • How to …? (61)
  • ISO 2700x (12)
  • News (38)
  • Reviews (77)
    • Book Reviews (32)
    • Free E-Books (14)
    • Hardware Review (9)
    • Security Review / Reports (10)
    • Software Review (8)
  • Siber Güvenlik (17)
  • Video Tutorials (101)
  • What is new? (27)
  • Windows (30)

Recent Comments

  • Sabri Kızmaz on Finans Sektörü Odaklı Siber Tatbikat
  • celal bayar on Finans Sektörü Odaklı Siber Tatbikat
  • Erdal on Free EDR Certification Training
  • SANDEEP SHRIVASTAV on Free EDR Certification Training
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)

Archives

Dr. Erdal Ozkaya © Copyright 2023. All Rights Reserved.