e strategy is to make sure that external layers are as difficult to breach as possible, and to ensure that security experts are immediately notified of breaches.
Similarly, public file areas, such as FTP and WWW servers, are publicly accessible areas on computer systems that sometimes provide entry to a different level in the system. An easily guessed or stolen password may provide user-level (but unprivileged) access to the system. A brute force attack against the local password database might even yield the superuser password. Accessing a local database might contain the target records of interest. However, instead of storing the data plaintext within tables, data may have been written using a stream cipher, making it potentially very difficult to obtain the data. And because 40-bit ciphers have been broken in the past, obtaining the encrypted data might eventually lead to its dissemination. Again, a key strategy is ensuring that data is secure by as many external layers as possible, and also that the data itself is difficult to negotiate.
Increasing the number of levels of security typically leads to a decrease in system ease of use—for example, setting a password for accessing a printer requires users to remember and enter a password when challenged. Whether or not printer access needs this level of security will depend on organizational requirements. For a printer that prints on plain paper, no password may be needed. However, for a printer that prints on bonded paper with an official company letterhead, a password should be used to protect the printer, and optionally, a copy of the file being sent to the printer may need to be stored securely for auditing purposes.
For government and military systems, there are a number of security specifications and policy documents available, which detail the steps necessary to secure Solaris systems in “top secret” installations. The U.S. Department of Defense, for example, publishes the Orange Book, formally known as the “Trusted Computer System Evaluation Criteria” specification. This book describes systems it has evaluated in terms of different protection levels, from weakest to strongest, including:
Class D, which are systems that do not pass any tests and are therefore untrusted. No sensitive data should be stored on class D systems.
Class C1, which are systems that require authentication based on a user model.
Class C2, which are systems that provide auditing and logging on a per-user basis, ensuring that file accesses and related operations can always be traced to the initiating user.
Class B1, which requires security labeling for all files. Labels range from “top secret” to “unclassified.”
Class B2, which separates normal system administration duties from security activities that are performed by a separate security officer. This level requires covert channels for data communications and verified testing of an installation’s security procedures.
Class B3, which requires that a stand-alone request monitor be available to authenticate all requests for file and resource access. In addition, the request monitor must be secured and all of its operations logged.
Class A1, which is a formally tested and verified installation of a class B3 system.
All of the strategies that we discuss in this chapter are focused on increasing the number of layers through which a potential cracker (or disgruntled staff member) must pass to obtain the data that they are illegally trying to access. Reducing the threat of remote access exploits and protecting data are key components of this strategy.
It may seem obvious—if an intruder can physically access your system, then he or she may be able to take control of your system without the root password, bypassing all of the software-based controls that normally limit such activity. How is this possible, you might ask? If the intruder has access to a bootable CD-ROM drive, and a bootable CD-ROM (of Solaris, Linux, or any other operating system that can mount UFS drives), it’s trivial to enter the following command at the OpenBoot prompt and start the 