Re: The morality of operating system security

From	James Harris <james.harris.1@gmail.com>
Newsgroups	alt.os.development
Subject	Re: The morality of operating system security
Date	2016-04-27 07:44 +0100
Organization	A noiseless patient Spider
Message-ID	<nfpmuo$bcp$1@dont-email.me> (permalink)
References	(5 earlier) <20160401202426.293af50b@_> <nebdns$k1m$1@dont-email.me> <20160409185740.51c7ed6d@_> <nfn7e8$tqn$1@dont-email.me> <20160426235820.1cd18000@_>

Show all headers | View raw

On 27/04/2016 04:58, Rod Pemberton wrote:
> On Tue, 26 Apr 2016 09:07:43 +0100
> James Harris <james.harris.1@gmail.com> wrote:

...

All good points (snipped)

> Reports can be tampered with.  How do you know in advance what to
> monitor for suspicious activity?  Do you assume the hacker will set off
> some randomly chosen alarm, or should you assume the hacker is skilled
> enough to avoid 98% of your traps?  If the hacker is in the 2%,
> "extra-devious," then he is in your system without detection.  Most
> good people, like those you'd trust to do your security, simply aren't
> devious enough to entrap someone who is devious and is experienced too.
> So, you need to be prepared to clean up the mess such people make.

I don't know for sure but I have an idea in mind. See what you think.

The main defence is the audit log. Naturally, it is not possible to 
prevent someone or a team with privilege from doing something that is 
not secure. But it should be possible to ensure that any non-secure 
actions cannot go unnoticed.

Of course, people don't have time to go through large audit logs so 
there needs to be a program to check the log for noteworthy events, and 
to bring those to the attention of the company's responsible person.

Reportable events would be such as reactivating any account with certain 
privileges or creating an account with those privileges.

I have described it as generating a single report. In practice, it would 
make more sense to examine the audit log with a filter. Then, multiple 
people could view the log with their own filters.

Any good?

-- 
James Harris

Back to alt.os.development | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-29 15:09 +0100
  Re: The morality of operating system security JJ <jj4public@vfemail.net> - 2016-03-30 00:03 +0700
    Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-03-29 19:39 +0200
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-30 23:54 +0100
      Re: The morality of operating system security JJ <jj4public@vfemail.net> - 2016-03-31 06:16 +0700
  Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-03-29 20:01 +0200
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-30 23:59 +0100
      Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-03-31 17:47 +0200
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 08:11 +0100
          Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-04-01 18:25 +0200
            Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 23:10 +0100
              Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-04-02 14:18 +0200
      Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-04-01 09:58 +0200
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 10:06 +0100
  Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-29 17:39 -0400
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-31 00:13 +0100
      Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-30 23:18 -0400
        Re: The morality of operating system security "Alexei A. Frounze" <alexfrunews@gmail.com> - 2016-03-31 00:31 -0700
          Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-31 16:57 -0400
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 09:22 +0100
          Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-01 20:24 -0400
            Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-09 18:25 +0100
              Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-09 18:57 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-26 09:07 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-26 23:58 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-27 07:01 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-27 05:42 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-03 00:05 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-03 16:55 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-04 09:00 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-04 17:22 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-05 17:02 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-05 17:55 -0400
                Re: The morality of operating system security "Kerr Mudd-John" <admin@127.0.0.1> - 2016-05-09 14:58 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-12 17:46 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-15 00:11 +0100
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-27 07:44 +0100

csiph-web