Who has the right? — Security and Access

Содержание и основные понятия

Back to the table of contents
Alterna chapter 3 · page 3.4
Who has the right? — Security and Access
One file is a payroll statement. The accountant needs it, and the intern doesn't. How does OS decide who can do what? Through the access rights system. Today, you're gonna be the administrator and you'll learn to protect the data without interrupting work.
Imagine, you gave all employees full access to all the files.
The operating system divides access through
law
: Each user is assigned to each file what he can do. This is the foundation of computer security.
PLF · Infred
EEG · access rights
01
Three rights: Reading, recording, execution
Any permit in the OS is built from these three bricks.
· What the user can do
R — Reading (Read).
You can open and look at the content of the file, copy it, but you can't change and delete it.
W is a record (Write).
You can change the content, rewrite, delete the file. The most dangerous right.
X - Implementation (eXecute).
You can start a file as a program.
.exe
) or enter the catalogue.
The key idea
Rights are combined.
R
"I look, but I don't touch." Right.
R+W
= "full access to the contents." A typical question on this subject is: "The user was given R's right to the file — what can he do?" The answer is:
Just look at it.
.
The principle of minimum privileges
The main safety rule is to give to everyone.
Just as many rights as it takes to work.
The accountant doesn't need access to the designer's maquettes, and the designler does not need to have access to a payroll. Less of the extra rights are less of a risk.
:: Fill-in question
Why is it dangerous to work under the administrator's account all the time?
Any
The program (including the virus) has the highest rights, the principle of minimum privileges protects even against its own mistakes.
02
Trainer: You're the administrator.
Give each employee the right to each file. The goal is to minimize the risks with maximum productivity: give exactly what it takes to work. Cell clicks include/off the right.
♪ The Internet ♪ Access rights matrix
The company: the marketer prepares the report and the logo, the accountant handles the report, the salary, the designer draws the logo.
R / W / X
..to give away my rights.
Staff member
Report.xlsx
salary.pdf
logo.ai
03
Searching for error: Diagnostics
The system administrator should be able to read "strange" errors.
PIF · digital literacy
Why isn't the file saved?
The student tries to save the document on the school computer and gets a message:
Error: not enough space on the disk to save the file.
But the test shows on the disk
320 GB free
What's the real reason?
Interactor · "Dismissed access"
The user downloaded the program and tried to install it in the folder.
C:\Program Files
The system responds to:
You're denied access. Please contact the administrator.
There's room on the disk, the file's intact. Why isn't the installation going?
♪ The Interact · File not saved
The student opened the document from the general network disk, corrected the text and pressed "Save".
Unable to save: file available only for reading.
What changes must be made to ensure that the preservation goes away?
04
Security laboratory
The loudest burglaries occur because of the simplest mistakes.
PIF · security
How did the Wi-Fi router get hacked?
School Wi-Fi router hacked with
First attempt
There were no long passwords, what was the main reason?
Interactor · Suspicious letter
A letter came to the post office saying: "I'm sorry.
Your account is blocked!
" The sender's address is
support@bank-secure-login.ru
, links to a website that looks a lot like a bank.
♪ The Interact ♪ File Fail
The messenger sent a file with a name.
Photo_class.jpg.exe
What's this file and should it be started?
05
Rights in Windows and Linux: What does it look like in practice
The same idea of "who can" is written differently in two systems.
PIF · Deepened
GEF
Rights
Reading / Recording / Performing
(R/W/X) is available in any system, but Windows and Linux show them in their own way.
♪ Windows (NTFS file)
In the file properties of the Safety tab, rights are set to understandable levels for each user or group:
Full access
- you can do anything, including change of rights for others;
Change
- Read, write, delete;
Reading and implementation
- Open and launch;
Reading
- Only to look;
Recording
- add or modify the contents.
♪ Linux (chmod command)
In Linux, the file has three groups of rights:
Owner
for
Group
and for
Other
Each group is three bits.
rwx
which is convenient to write with one digit (eight-digit):
Number
Bits
What's allowed
7
rwx
Read + record + perform
5
r-x
Read + Implementation
4
r--
Read only
0
---
There's nothing
Therefore,
chmod 755 file
=
rwxr-xr-x
: The owner can read and perform everything, the group and the others.
chmod 777 file
=
rwxrwxrwx
- everything is allowed to everyone.
♪ Lifehaq safety ♪
Set
777
"for sure to work" is a typical rookie error. It means "any user can change and delete the file." The principle of minimum privileges is here: give exactly as much right as you need, most often.
755
for programmes and
644
For documents.
06
Cyphering: How to Hide Meaning
The rights protect the file "outside." And if it's in the wrong hands, then it saves the encryption.
PIF · Deepened
Digital literacy code 1.5
Circulation
- It's a secret rule (key) conversion that only someone who knows the key can read it.
Two large families
Symmetrical
- One key and encryption and decryption (AES, DES).
Asymmetrical
- Two keys:
open
(they're encrypted, they can be published) and
closed
This is how RSA and secure sites work.
https
.
Caesar's Code — A Simple Example
Each letter moves in alphabetical order to the same number of entries.
cipher simple replacement
IV. A more robust option —
Vigener's code
where the change is for each letter by the key word.
♪ The Interact ♪ Caesar's Cyphre
Enter the text and choose the shift -- see how the message turns into a cipher. The same shift deciphers back.
Text:
Swift:
3
It's encrypted:
Same shift decryption:
♪ An idea
Caesar's coder is easy to hack with over-the-shelf, only 32 versions of the Russian alphabet, so modern ciphers (AES, RSA) use hundreds and thousands of bits of keys.
07
Personal data and Law 152-FZ
Digital hygiene is not only about viruses, but also about responsibility for other people's data.
GEF · Personal results
PIF
Personal data (Dan)
- It's any information related to a particular person: the FIO, date of birth, address, phone, photo, grade.
Federal Act No. 152-FZ on Personal Data
.
Operation Pound
(schools, bank, site) is obliged to protect the data collected and not to transmit it to third parties without cause.
The only way to process human data is with him.
Consent
.
A person has the right to know what his data are stored and to demand that they be deleted.
♪ question to fill ♪
You collect the contacts of your classmates on the general table and post it on the open chat room. The violation? Yes, you became the "operator" of someone else's Po