In this lesson,
we're going to discuss trusted operating systems.
Now, a trusted operating system, or TOS,
is a type of operating system that's designed
to provide a secure computing environment
by enforcing stringent security policies
that usually rely on mandatory access controls.
Now, mandatory access controls, or MAC,
is going to be used to specify who or what process is permitted
to access a particular resource or piece of information.
Trusted operating systems are typically used in environments
where the integrity, confidentiality, and availability
of your data is extremely important.
For example, the J-35 Strike Fighter,
which is a US military aircraft, has an operating system
that runs all the operations on that advanced fighter jet.
The operating system that's used by the J-35 Strike Fighter
is known as Integrity-178B.
Now, this is a POSIX-based operating system
that's designed for embedded system use,
and it's been put in place into numerous aircrafts,
like the B-2 Bomber, the F-16, the F-22,
and the F-35 fighter jets,
and even commercial airplanes, like the Airbus A380.
Now, this specific operating system is rated as EAL6,
and EAL6 is the evaluation assurance level
that's assigned to this operating system based on a set
of predefined security standards
and certifications from the Common Criteria
for Information Technology Security Evaluation.
Now, the standards in the Common Criteria are used
to evaluate the effectiveness of the security controls
that are implemented by a given operating system,
and they're rated as EAL1,
which is the lowest level of assurance,
all the way up to EAL7,
the highest level of assurance.
Now, trusted operating systems will often include features
like mandatory access control, security auditing,
and role-based access control
to meet these different EAL standards.
Now, mandatory access control, or MAC,
is one of the key features
of a trusted operating system.
In traditional discretionary access control systems,
or DAC systems, users have some discretion over
who can access their data.
But in a MAC system, access permission is determined
by the policy defined by the system administrators,
and enforced by the operating system itself.
This ensures that even the data owner cannot change
the access permissions to provide themselves
with higher levels of security.
Now, there is also a trusted operating system
that we use a lot, known as SELinux,
or Security-Enhanced Linux.
This is a set of controls that are installed on top
of another Linux distribution,
like CentOS or Red Hat Linux.
And when we're using SELinux,
these systems are rated as an EAL4+.
Now, SELinux is used as an implementation of MAC
in the Linux kernel to ensure that applications
and users only have the minimum necessary access
to your resources.
SELinux uses policies to enforce security properties
and can confine potentially harmful processes
to limit the impact of the vulnerabilities.
The Trusted Solaris operating system is yet another example
of a distribution that's configured to use MAC.
Trusted Solaris is designed
to provide secure multi-level operations
while implementing MAC,
and it gives us detailed auditing of our system events
as well as compartmentalization
to isolate our processes and our data.
Now, inside of a trusted operating system,
we'll often use microkernels that are going to minimize
the trusted computing base of that system.
Now, the trusted computing base includes all the parts
of the system that are critical to security,
and must be trusted to operate correctly.
By minimizing the trusted computing base though,
by using this microkernel architecture,
the system's attack surface is going to be reduced
and the likelihood of security vulnerabilities
will also be decreased.
Trusted operating systems will also exist
in the realm of mobile devices.
Now, operating systems like Google's Android
have incorporated elements of the trusted computing model
throughout the use of various security mechanisms,
including application sandboxing, which restricts access
to system resources and isolates applications from each
other by implementing trusted security architecture tools,
like AppArmor, to enforce mandatory access controls
on your mobile devices.
Now, I'm sure that trusted operating systems sound
like a wonderful idea based on all
the great security they can provide us,
but it is important to note that designing and maintaining
a trusted operating system
is actually quite challenging and really expensive.
So when you're deciding which type of operating system
to use, you have to balance your security requirements
against your usability, performance,
and other functional requirements to ensure
that you're balancing the convenience
and security for your end users
when deciding which operating system to use.
Now, for example, ever since Windows 7,
every version of Microsoft Windows has been tested
and rated at least at an ELA4 or EAL4+
under the Common Criteria system.
Additionally, every version of macOS since version 10.6
has also been rated as either EAL4 or EAL4+.
And many versions of Linux are also rated
as EAL4 or EAL4+ as well.
Now, EAL4 means that the operating system
was methodically designed, tested, and reviewed,
and it really does provide us with a really good,
decent level of security assurance,
but it's not nearly as high as an EAL6 or EAL7.
But achieving those EAL levels
with a generic operating system like Windows, Mac or Linux
would be too difficult and too costly
for the manufacturers to do,
so these higher level EAL systems are usually going to involve
an embedded or purpose-built operating system
like those used in autonomous vehicles,
airplanes, and medical devices.
So remember, trusted operating systems play a vital role
in providing a secure computing environment in context
where data integrity and confidentiality are crucial.
By enforcing strict access control standards,
conducting rigorous security evaluations,
and minimizing the trusted computing base,
these systems aim to mitigate
and minimize potential security risks.
Over time, as data security and assurance continues
to gain an increasingly important role
in our organizational networks,
you may see more and higher levels
of trusted operating systems being used
by your organization.