4

I am researching on operating system security, And I don't know where to look for more information on this.

I could find the following sources, but I need more guidance.

Sources:

  1. Microkernel security evaluation[2012 Kevin C. Kurtz]
  2. Operating System Security and Secure Operating Systems
  3. Linux kernel vulnerabilities: State-of-the-art defenses and open problems[2011]
  4. Evolution of the Windows Kernel Architecture [Dave Probert, Ph.D 2009]
  5. Can we make operating systems reliable and secure? [Tanenbaum, A.S 2006.]
  6. Monolithic kernel vs. Microkernel
  7. Hybrid vs. monolithic OS kernels: a benchmark comparison [2006]
  8. An Evaluation Framework for Kernel-Mode Security Modules
  9. Protecting Commodity Operating System Kernels from Vulnerable Device Drivers
  10. The Pros and Cons of Unix and Windows Security Policies
  11. OPERATING SYSTEM CONCEPTS ABRAHAM SILBERSCHATZ 9ed
  12. A Multiple-Criteria Approach to Ranking Computer Operating Systems
  13. Choosing Secure Platforms in the Enterprise
  14. Linux vs windows total cost of ownership comparison
  15. XNU: a security evaluation

website links:
http://pastebin.ca/3160959

I am looking for questions like,

  1. Is there any theoretical Operating system architecture that is inherently secure?
  2. What have been done in making operating systems more secure?
  3. If we are to assess an operating systems security, is there any guideline or standard measures to do so?
  4. Is there any theoretical parameter to make an operating system secure?

Is there any parameter for benchmarking OS kernels and rank them?

For example :multics OS has a different design and implementation of stack that makes very hard to do a buffer overflow, or code injection, etc.

Is there any parameter like OWASP Top 10 to rank and benchmark a kernel, or how do I have to gather them?

5
  • 1
    Security in terms of what? That is too broad
    – user45139
    Sep 13, 2015 at 9:30
  • 1
    to be more specific, I need to know more on the kernel security. Any guidance to sources that would help me get more understanding is appreciated
    – Mahdi
    Sep 13, 2015 at 9:32
  • You are looking for something like this one tails.boum.org ?
    – user45139
    Sep 13, 2015 at 9:37
  • no ,thats not a secure os. I m more looking for architectures behind something like multics or histar ,etc For example in multics, it is designed in a way that it is secure, (for example its pretty much very hard to peforme a buffer overflow in that os)
    – Mahdi
    Sep 13, 2015 at 9:44
  • The Secure Desktops mailing list has been created a few months ago "for the discussion of security and privacy challenges in open source desktop computing systems". It gathers announcements as well as technical discussions and other things on the subject and may be a useful source of information. Mar 19, 2016 at 13:59

1 Answer 1

1

The issue is that "security" as a standalone notion doesn't exists. You have different threats, and you can have specialized OS designed to address these threats.

A possible threat is that the OS code contains a bug opening the possibility for this code to act in an unexpected way (no matter if this "unexpected" behaviour is exploitable or simply a bug).

This threat is mostly a concern for specific embedded software. It is addressed by micro-kernels based OS. Micro-kernel having less code, this leave less room for bugs but also opens the possibility to formally prove the OS kernel correctness.

Another threat is information leakage from end-user general purpose environments (think about trojan, exploitable software, etc.).

This threat is address by OS compartimentation: it will divide the desktop environment into several containers, restricting the communication between the container themselves and the communication between the containers and the external environment (network, USB, drives, etc.). Example of commercial solutions implementing this are PolyXene and Bromium, a free alternative is Qubes OS.

Otherwise, more general solution can be achieved using an hardened version of an already existing OS. Here again, the question will be "Hardened against what threat?". This will provide an OS modified in a certain way to address a certain threat (Is it a server environment protecting against remote exploits? A multi-user environment protecting against one user accessing other user's data? Etc.).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .