Operating Systems Define Security
This seems to be something of an issue for some people to “get” but it’s really not so hard. Your operating system is what defines the security of everypart of your system. It enforces a security model, permissions, security technology policies, allows for interfacing in order to garner further security, etc. It is your security, that’s all there is to it.
You can supplement your OS security model by implementing micro-security models within the system. AVs for example have a simple model – allow all execution of files unless they meet a specific criteria. This model is enforced withinthe operating system, not alongside or above it – it is a policy that can only exist because the OS permits such a thing.
A user model is enforced entirely by the operating system. So far every mainstream operating system maintains a user model in some way or another – enforcing restrictions based on user/group tokens. Linux, Android, Windows all do this.
Enforcing memory corruption policies like DEP, ASLR, SEHOP, are also OS provided technologies – the policies are handled by the operating systems. Even EMET, which provides non operating system techniques, is leveraging the OS – the OS is what manages all address space.
It is critical to understand this. It is a fairly basic concept and people seem to get it “from afar” but they don’t seem to get how important it is.
Your micro-security policies that live within your OS do not define the operating system security, in fact, something like an AV can only exist because Windows provides the interfaces for them to work – a significant amount of what an AV does is handled entirely by Windows code.
You must take the above to be true if you’re going to understand the following – users are not some micro-security policy, they exist outside of the operating system, they have a completely separate role. While users can obviously interface with systems through a UI and even change or configure policies, those are still OS policies.
A user can not possibly be expected to hook a function, or perform heuristics on an executable file, because we’ve got a brain and a computer has a CPU and RAM and a HDD and these things don’t just slap together and spit out results.
A user quite obviously has an impact on the system, even on the ‘cleanliness’ of the system – they can make decisions that either infect the system or not. That is entirely different than a user being responsible for the infection, or for the security of the system to rely on the user. If a UAC window asks you “Yes” or “No” that is an OS policy, not a user policy, the user just makes the decision. If they make the wrong decision it is a failing of the policy.
A failing of the operating systems security will lead to infection, not a failing of the user. Perpetuating the notion that users are the ones responsible for infections is backwards and it’ll just continue the constantly too-high rate of infection we see.
Do you blame yourself when you catch a cold? Perhaps. You may have been out in the cold or with a sick person. But do you think that the ability to be infected is a failing on your part? Do you think that somehow illness as a whole is a result of poor decisions? I would hope not – it seems quite obvious that illness is a result of an imperfect immune system fighting off constant waves of rapidly adapting attackers.
So instead of blaming your users for just “being so dumb” perhaps you should start implementing policies that work better. And I empathize – Windows especially does not provide much more policies. The user/group system is dumb and broken and only works when you abuse the hell out of it until it mutates into something completely different.
I was going to talk about PatchGuard and how Microsoft absolutely shot themselves in the foot with it, by trying to force their macro-security policy (which is useless) and not allow for any significant micro-security policies. But people seem to have such issues understanding the basics that I’ll just leave things as they are – just take one thing from this; stop blaming users, start blaming the operating system, and if you’re an administrator, maybe take a little blame too (it’s OK, you can blame the OS more.)
blog comments powered by Disqus