Assignment: Computer System Security

Computer Systems Security

Assignment 5

Submitted By:

Furqan Ali Khan (Fa-2014/M.SC C.E/009)

Submitted To:

Dr Hassan

Zainab Saud

Dated: Sunday 30rd December 2014 Q1. Following code is vulnerable to buffer over flow attack…..?

There are two lines in the following code that are erroneous;

1. While ((buffer [i++] = getchar()) ! = ‘\n’) {};

In this line, it is not being checked that whether the characters that are being entered by the user are of which size. Either they are less than 4096 or greater. If it would be greater than 4096 then it will have buffer overflow.

Suggestion:

We can use ‘fget()’ function in this case where it will limit the user to take character upto the defined limit.

2. strcpy(newbuffer,buffer);

In

Q2. Suppose you are designing an audit trail policy for some organization’s IS system. What events will be of interest to you keeping in mind that more data will be a performance penalty on the system’s log analysis and storage ability?

Requirements determine the choice of data. We can gather large amount of data but that will greatly affect performance. There is a tradeoff between performance and quantity basically. So while creating the security audit trail design we usually considers following for events alerts for auditing software design;

• Events related to the security mechanisms on the system.

• Any events that are collected for use by the various security detection and prevention mechanisms. These include items relevant to intrusion detection and items related to firewall operation.

• Events related to system management and operation.

• Operating system access (e.g., via system calls).

• Application access for selected applications.

• Remote access.

We usually choose events from best practices and standards according to our requirement. Now, as we are designing audit trail policy for IS system of organization, we are choosing some of following essential alerts from the standards X.8.16 and ISO

Suppose you work for a company with a Chinese Wall security policy with clients in the following conflict classes: (5)

If we see that we have five data sets ;

• { Cadbury, Nestle}

• { Ford, Chrysler, GM }

• { Citicorp, Credit Lyonnais, Deutsche Bank }

• { Microsoft }

According to Chinese Wall Policy (CWM), we need to follow these two properties;

Simple security rule: A subject S can read on object O only if

• O is in the same DS as an object already accessed by S, OR

• O belongs to a CI from which S has not yet accessed any information

*-property rule: A subject S can write an object O only if

• S can read O according to the simple security rule, AND

• All objects that S can read are in the same DS as O.

When we apply these properties to the given scenario, we see that since employee has worked with Nestle and Citicrop, that means that Chinese wall will be built around Cadbury, Credit Lyonnais and Deutsche Bank and hence the employee will not be able to work on these organizations as next assignment.

Reference:

https://www.owasp.org/index.php/OS_Injection