|
What would an operating system look like it if were redesigned withsecurity in mind? Joanna Rutkowska thinks she has the answer withthe development of Qubes OS. We sit down for an interview withJoanna to discuss the way Qubes OS augments security. Alan: Hi Joanna, thanks again for taking the time to chat with us. Joanna: You're welcome. Alan: Since I know you re busy, I ll just throw in a link to ourprevious interview ( Exclusive Interview: Going Three Levels Beyond Kernel Rootkits ), in which you talked about the risks beyond the rootkit, and askthat our readers skim through it first. I really want to get to talking about Qubes OS, though. For the benefit of our audience, I want to review the threeapproaches to system security. We have security by obscurity withthings like memory randomization, obfuscating code, and systemadministrators mandating complex passwords. This acts as a firstline of defense if the bad guys can t find your house, theycan t break in. It s a deterrent that encourages the bad guys tolook for an easier target. But it doesn t work when they reallywant your data. Then we have security by correctness, where software developers tryto write bug-free code so that there are no vulnerabilities. Everytime software gets patched, it s a little bit more correct. But aswe see every second Tuesday of the month, even the resources thatMicrosoft has are insufficient to come up with a perfectly correctOS. Modern software is so big and complex that it s almostimpossible to validate code to be perfect. Finally, we have security by isolation, which takes a somewhatpessimistic (though more realistic) view that, at some point, thebad guys will break through whatever security measures you have,and so the focus should be stopping the bad guys from gettingaccess to the rest of the system. Fair summary? Joanna: Ha! I wish more interviewers were so well-prepared. :) I would perhaps add to this one more category: reactive security,which in practice comes down to: patches and signatures (for IDSand AV). Of course, this approach is the least effective, as we allwell know. Alan: The problem with security by isolation is that popularimplementations like Safari s or Chrome s sandboxing or InternetExplorer s Protected Mode are great in concept, but less secure inreal life. Is developing perfect isolation just as difficult assecurity by correctness? Joanna: Well, one still needs security by correctness whenimplementing isolation (sandboxing). The difference is that this isonly needed for the code that enforces the isolation, not for all of the code. If we can design a system where the isolation-enforcing code isvery small, than there is a clear win we have much less code towrite correctly. On the other hand, if one tries to build a sandbox on top of ahuge, buggy, monolithic system, which exposes numerous complex APIsto applications, then the amount of code that must be writtencorrectly is not that small, and the potential gain is much lessobvious. As a side note, I find it funny how the word "sandbox" became sucha buzzword. Since the early days of multitasking OSes, the systemwas supposed to provide isolation between processes and users(address space isolation, access control to file system objects,etc.). Thus, we can say that on any multitasking OS, for decades, everyprocess has always been "sandboxed." It's just that, first, thesandboxing was designed for server applications and not for desktopapplications (where all processes usually run as the same user),and second, OS kernels turned out to be buggy, and not so effectiveat enforcing this isolation. Today's sandboxing technologies attempt to address the firstproblem in that they try to be more suited for desktopapplications. This might, for example, require splitting a browser into severalprocesses: one for rendering, another for user interface handling,and so on. This is all good, but the second problem mentioned abovestill remains unsolved. Can we rely on a big, fat, and buggy kernelthat has hundreds of drivers inside, networking stacks, and soforth to enforce strong isolation? People who regularly release kernel exploits for popular OSes(Linux being no exception) seem to be yelling: NO! I am an expert from vl-led.com, while we provides the quality product, such as Led Plug In Lights Manufacturer , China Led Spot Lighting Fixtures, T5 Led Tubes,and more.
Related Articles -
Led Plug In Lights Manufacturer, China Led Spot Lighting Fixtures,
|
