jump to navigation

Windows NT Security Systems March 2, 2012

Posted by John Ruby in Archives, Security, Technologies.
Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,
add a comment

Windows NT Security Systems

The starting point for strong Internet security is the operating system of any machine connected to it. Fortunately for the organizations using IIS 4.0, strong levels of security were built into the core of Windows NT in order to meet and exceed certifiable security standards, i.e. the C2 security guidelines required by the U.S. Department of Defense’s evaluation criteria. Windows NT security contrasts sharply with the thin and weak security layers that are bolted on to the top of some other operating systems.

Compliance with the C2 security standard was originally only required for government organizations. However, many commercial organizations are demanding the same level of security, and they recognize the value that such standards offer. The main requirements for C2 compliance are:

  • User identification and authentication. Before gaining access to the systems, a user must prove their identity. This is typically done by providing a user-id / password combination, for example by entering the details via a keyboard or by the presentation of a device such as a smart card which stores such information.
  • Discretionary access control. Each object within the system, for example files, printers and processes, must have an owner—who can grant or restrict access to the resources at various degrees of granularity.
  • Auditing Capabilities. The system must provide the ability to log all user actions and object access, and include enough information to identify the user that performed any operation. Such information must only be accessible by system administrators.
  • Safe Object reuse. The system must guarantee that any discarded or deleted object cannot be accessed, either accidentally or deliberately, by other entities.
  • System integrity. The system must protect resources belonging to one entity, from being interfered with by another entity.

The C2 guidelines are applicable to standalone systems, and are specified in the document Trusted Computer System Evaluation Criteria (TCSEC). Fortunately, to make life simpler, this is often referred to as the Orange Book, thanks to the color of its cover. Other specifications that expand on the Orange Book include the Red Book for networking, and the Blue Book for subsystems.

Obtaining C2 certification is a long and complex task, and Microsoft are pushing hard for complete certification. Windows NT has passed the Orange Book certification process (for a standalone PC, not connected to a network) and is on the DOD’s official list of evaluated products. At the time of writing, Windows NT 4.0 is undergoing Red and Blue book evaluations.

Read More…Windows NT Security Systems

Windows 8 Consumer Preview: Welcome to the Windows 8 Consumer Preview February 29, 2012

Posted by John Ruby in BlogoSphere, Microsoft, Paul Thurrott, Software, Windows 8.
Tags: , , , , , , , , , , , , , , , , ,
add a comment


Windows 8 Consumer Preview: Welcome to the Windows 8 Consumer Preview


For weeks now I’ve been biting my tongue, watching what I say and write about the Windows 8 Consumer Preview. But with the release today of this most eagerly-awaited Windows 8 milestone, the shackles are off. This freedom takes a few different forms for me. I can reveal that work on Windows 8 Secrets has already begun in earnest. And I have a ton of content to post here on the SuperSite for Windows, with more to come in the days ahead. Best of all, I can guarantee that you’ll find out things about Windows 8 here you won’t see anywhere else.

If you’ve been reading this site for a while, you know that I often write lengthy reviews of Microsoft products, including pre-release versions. With the Windows 8 Consumer Preview, however, I’m going to do things a bit differently. This article will serve as a high-level introduction of sorts, providing you with a basic overview of what’s new and different in this second and most crucial milestone on the way to Windows 8. But scattered throughout the discussion below, you’ll find links to numerous other articles about the Windows 8 Consumer Preview, the vast majority of which are immediately available and dramatically expand on the overview provided here. This isn’t just information overload, it’s a tsunami.

Ready? Good, let’s dive right in.