Prevent unauthorized disclosure
Permissions, isolation and encryption limit who can observe information.
PART 4 • SYSTEMS & CAREER
Permit the Required Action—and Nothing More
Separate authentication from authorization, model access rights, apply least privilege and trace how the kernel reference monitor protects system objects.
BY THE END, YOU CAN
Reason about protection
- Apply CIA and least privilege.
- Compare ACLs and capabilities.
- Separate identity and permission.
- Explain common OS attack classes.
- Design layered controls and audits.
Protection Controls Use; Security Resists Misuse
Prevent unauthorized change
Access control, signed code, audit logs and safe update paths protect correctness.
Keep service usable
Quotas, rate limits, redundancy and recovery reduce accidental and deliberate disruption.
least privilege
default deny
complete mediation
defense in depth
separation of duty
A trusted reference monitor must mediate every access, resist tampering and remain small enough to analyze. User/kernel mode, page permissions and system calls provide the mechanism; policy decides which accesses should be granted.
Access Matrix Rows Are Subjects; Columns Are Objects
| Model | Stored with | Question answered | Trade-off |
|---|---|---|---|
| ACL | Object | Who may access this object? | Easy object review; delegation/revocation details matter |
| Capability | Subject/token | What objects may this holder access? | Natural delegation; protect unforgeability |
| RBAC | Role assignments | What may this job role do? | Scales administration; role explosion possible |
| MAC | Labels and central policy | Does label flow permit access? | Strong central control; less discretionary flexibility |
Authentication establishes an identity using evidence. Authorization evaluates that identity, requested operation, target object and context. Auditing records what occurred; it does not itself prevent the action.
Evaluate Role, Resource and Action
Default deny
Select an access request to see the explicit policy decision.
Different Threats Require Different Controls
Overflow/use-after-free
Safer languages, bounds checks, ASLR, NX/DEP and control-flow defenses reduce exploitation.
Gain forbidden authority
Patch vulnerable code, minimize privileged services, separate accounts and audit elevation.
Abuse legitimate execution
Signed updates, allow-listing, sandboxing, least privilege and behavioral detection provide layers.
Check/use race
Use atomic APIs and object handles; a pathname may resolve differently after a separate check.
Infer through shared effects
Timing, caches and speculative behavior can leak across boundaries not visible in access checks.
Exhaust finite resources
Quotas, backpressure, rate limits and isolation protect availability.
Trace One Protected File Read
Ten Security Checks
Answered correctly: 0 of 10
Explain Threat, Mechanism and Residual Risk
- Protection versus security?
- Define least privilege.
- ACL versus capability?
- Authentication versus authorization?
- What is complete mediation?
- Explain access matrix.
- Compare security models.
- Explain defense in depth.
- Analyze TOCTOU.
- Describe malware controls.
- Why default deny?
- Why hash passwords?
- What does ASLR do?
- Why are logs protected?
- Can containers be a security boundary?
LEVEL 12 SUMMARY
You Can Explain Why an Access Is Allowed or Denied
- Security preserves confidentiality, integrity and availability.
- Authentication and authorization solve different problems.
- ACLs, capabilities, roles and labels encode policy differently.
- Least privilege limits blast radius.
- Layered controls reduce but do not eliminate risk.
COURSE CHECKPOINT
Mark complete after you can justify one policy decision.
Saved only in this browser.