1
00:00:00,000 --> 00:00:01,110
In this lesson,

2
00:00:01,110 --> 00:00:03,840
we're going to discuss trusted operating systems.

3
00:00:03,840 --> 00:00:06,210
Now, a trusted operating system, or TOS,

4
00:00:06,210 --> 00:00:08,310
is a type of operating system that's designed

5
00:00:08,310 --> 00:00:10,200
to provide a secure computing environment

6
00:00:10,200 --> 00:00:12,240
by enforcing stringent security policies

7
00:00:12,240 --> 00:00:15,420
that usually rely on mandatory access controls.

8
00:00:15,420 --> 00:00:17,790
Now, mandatory access controls, or MAC,

9
00:00:17,790 --> 00:00:20,640
is going to be used to specify who or what process is permitted

10
00:00:20,640 --> 00:00:23,940
to access a particular resource or piece of information.

11
00:00:23,940 --> 00:00:26,640
Trusted operating systems are typically used in environments

12
00:00:26,640 --> 00:00:29,430
where the integrity, confidentiality, and availability

13
00:00:29,430 --> 00:00:32,040
of your data is extremely important.

14
00:00:32,040 --> 00:00:34,590
For example, the J-35 Strike Fighter,

15
00:00:34,590 --> 00:00:37,350
which is a US military aircraft, has an operating system

16
00:00:37,350 --> 00:00:40,530
that runs all the operations on that advanced fighter jet.

17
00:00:40,530 --> 00:00:43,290
The operating system that's used by the J-35 Strike Fighter

18
00:00:43,290 --> 00:00:46,170
is known as Integrity-178B.

19
00:00:46,170 --> 00:00:48,047
Now, this is a POSIX-based operating system

20
00:00:48,047 --> 00:00:50,280
that's designed for embedded system use,

21
00:00:50,280 --> 00:00:52,440
and it's been put in place into numerous aircrafts,

22
00:00:52,440 --> 00:00:55,530
like the B-2 Bomber, the F-16, the F-22,

23
00:00:55,530 --> 00:00:57,090
and the F-35 fighter jets,

24
00:00:57,090 --> 00:01:00,600
and even commercial airplanes, like the Airbus A380.

25
00:01:00,600 --> 00:01:04,200
Now, this specific operating system is rated as EAL6,

26
00:01:04,200 --> 00:01:06,870
and EAL6 is the evaluation assurance level

27
00:01:06,870 --> 00:01:09,300
that's assigned to this operating system based on a set

28
00:01:09,300 --> 00:01:10,800
of predefined security standards

29
00:01:10,800 --> 00:01:12,960
and certifications from the Common Criteria

30
00:01:12,960 --> 00:01:15,810
for Information Technology Security Evaluation.

31
00:01:15,810 --> 00:01:18,120
Now, the standards in the Common Criteria are used

32
00:01:18,120 --> 00:01:20,610
to evaluate the effectiveness of the security controls

33
00:01:20,610 --> 00:01:22,770
that are implemented by a given operating system,

34
00:01:22,770 --> 00:01:24,540
and they're rated as EAL1,

35
00:01:24,540 --> 00:01:26,220
which is the lowest level of assurance,

36
00:01:26,220 --> 00:01:27,990
all the way up to EAL7,

37
00:01:27,990 --> 00:01:29,730
the highest level of assurance.

38
00:01:29,730 --> 00:01:32,310
Now, trusted operating systems will often include features

39
00:01:32,310 --> 00:01:34,800
like mandatory access control, security auditing,

40
00:01:34,800 --> 00:01:36,330
and role-based access control

41
00:01:36,330 --> 00:01:38,880
to meet these different EAL standards.

42
00:01:38,880 --> 00:01:40,980
Now, mandatory access control, or MAC,

43
00:01:40,980 --> 00:01:42,090
is one of the key features

44
00:01:42,090 --> 00:01:43,920
of a trusted operating system.

45
00:01:43,920 --> 00:01:46,260
In traditional discretionary access control systems,

46
00:01:46,260 --> 00:01:49,080
or DAC systems, users have some discretion over

47
00:01:49,080 --> 00:01:50,760
who can access their data.

48
00:01:50,760 --> 00:01:53,670
But in a MAC system, access permission is determined

49
00:01:53,670 --> 00:01:55,890
by the policy defined by the system administrators,

50
00:01:55,890 --> 00:01:58,350
and enforced by the operating system itself.

51
00:01:58,350 --> 00:02:00,510
This ensures that even the data owner cannot change

52
00:02:00,510 --> 00:02:02,520
the access permissions to provide themselves

53
00:02:02,520 --> 00:02:04,470
with higher levels of security.

54
00:02:04,470 --> 00:02:06,450
Now, there is also a trusted operating system

55
00:02:06,450 --> 00:02:08,699
that we use a lot, known as SELinux,

56
00:02:08,699 --> 00:02:10,590
or Security-Enhanced Linux.

57
00:02:10,590 --> 00:02:12,600
This is a set of controls that are installed on top

58
00:02:12,600 --> 00:02:14,160
of another Linux distribution,

59
00:02:14,160 --> 00:02:16,320
like CentOS or Red Hat Linux.

60
00:02:16,320 --> 00:02:18,120
And when we're using SELinux,

61
00:02:18,120 --> 00:02:21,570
these systems are rated as an EAL4+.

62
00:02:21,570 --> 00:02:24,150
Now, SELinux is used as an implementation of MAC

63
00:02:24,150 --> 00:02:26,400
in the Linux kernel to ensure that applications

64
00:02:26,400 --> 00:02:28,860
and users only have the minimum necessary access

65
00:02:28,860 --> 00:02:30,360
to your resources.

66
00:02:30,360 --> 00:02:33,330
SELinux uses policies to enforce security properties

67
00:02:33,330 --> 00:02:35,670
and can confine potentially harmful processes

68
00:02:35,670 --> 00:02:38,340
to limit the impact of the vulnerabilities.

69
00:02:38,340 --> 00:02:41,220
The Trusted Solaris operating system is yet another example

70
00:02:41,220 --> 00:02:43,650
of a distribution that's configured to use MAC.

71
00:02:43,650 --> 00:02:45,000
Trusted Solaris is designed

72
00:02:45,000 --> 00:02:47,040
to provide secure multi-level operations

73
00:02:47,040 --> 00:02:48,240
while implementing MAC,

74
00:02:48,240 --> 00:02:50,610
and it gives us detailed auditing of our system events

75
00:02:50,610 --> 00:02:52,050
as well as compartmentalization

76
00:02:52,050 --> 00:02:54,510
to isolate our processes and our data.

77
00:02:54,510 --> 00:02:56,400
Now, inside of a trusted operating system,

78
00:02:56,400 --> 00:02:58,920
we'll often use microkernels that are going to minimize

79
00:02:58,920 --> 00:03:01,470
the trusted computing base of that system.

80
00:03:01,470 --> 00:03:03,960
Now, the trusted computing base includes all the parts

81
00:03:03,960 --> 00:03:06,060
of the system that are critical to security,

82
00:03:06,060 --> 00:03:08,490
and must be trusted to operate correctly.

83
00:03:08,490 --> 00:03:10,800
By minimizing the trusted computing base though,

84
00:03:10,800 --> 00:03:12,990
by using this microkernel architecture,

85
00:03:12,990 --> 00:03:15,240
the system's attack surface is going to be reduced

86
00:03:15,240 --> 00:03:16,950
and the likelihood of security vulnerabilities

87
00:03:16,950 --> 00:03:18,720
will also be decreased.

88
00:03:18,720 --> 00:03:20,610
Trusted operating systems will also exist

89
00:03:20,610 --> 00:03:22,650
in the realm of mobile devices.

90
00:03:22,650 --> 00:03:24,570
Now, operating systems like Google's Android

91
00:03:24,570 --> 00:03:27,090
have incorporated elements of the trusted computing model

92
00:03:27,090 --> 00:03:29,370
throughout the use of various security mechanisms,

93
00:03:29,370 --> 00:03:32,220
including application sandboxing, which restricts access

94
00:03:32,220 --> 00:03:34,770
to system resources and isolates applications from each

95
00:03:34,770 --> 00:03:37,680
other by implementing trusted security architecture tools,

96
00:03:37,680 --> 00:03:40,530
like AppArmor, to enforce mandatory access controls

97
00:03:40,530 --> 00:03:42,210
on your mobile devices.

98
00:03:42,210 --> 00:03:44,130
Now, I'm sure that trusted operating systems sound

99
00:03:44,130 --> 00:03:45,780
like a wonderful idea based on all

100
00:03:45,780 --> 00:03:47,640
the great security they can provide us,

101
00:03:47,640 --> 00:03:50,250
but it is important to note that designing and maintaining

102
00:03:50,250 --> 00:03:51,540
a trusted operating system

103
00:03:51,540 --> 00:03:54,660
is actually quite challenging and really expensive.

104
00:03:54,660 --> 00:03:56,700
So when you're deciding which type of operating system

105
00:03:56,700 --> 00:03:59,070
to use, you have to balance your security requirements

106
00:03:59,070 --> 00:04:00,780
against your usability, performance,

107
00:04:00,780 --> 00:04:02,640
and other functional requirements to ensure

108
00:04:02,640 --> 00:04:03,960
that you're balancing the convenience

109
00:04:03,960 --> 00:04:05,820
and security for your end users

110
00:04:05,820 --> 00:04:08,250
when deciding which operating system to use.

111
00:04:08,250 --> 00:04:10,740
Now, for example, ever since Windows 7,

112
00:04:10,740 --> 00:04:13,050
every version of Microsoft Windows has been tested

113
00:04:13,050 --> 00:04:16,920
and rated at least at an ELA4 or EAL4+

114
00:04:16,920 --> 00:04:18,959
under the Common Criteria system.

115
00:04:18,959 --> 00:04:22,320
Additionally, every version of macOS since version 10.6

116
00:04:22,320 --> 00:04:26,340
has also been rated as either EAL4 or EAL4+.

117
00:04:26,340 --> 00:04:28,200
And many versions of Linux are also rated

118
00:04:28,200 --> 00:04:31,470
as EAL4 or EAL4+ as well.

119
00:04:31,470 --> 00:04:33,720
Now, EAL4 means that the operating system

120
00:04:33,720 --> 00:04:36,300
was methodically designed, tested, and reviewed,

121
00:04:36,300 --> 00:04:38,370
and it really does provide us with a really good,

122
00:04:38,370 --> 00:04:40,020
decent level of security assurance,

123
00:04:40,020 --> 00:04:43,710
but it's not nearly as high as an EAL6 or EAL7.

124
00:04:43,710 --> 00:04:45,690
But achieving those EAL levels

125
00:04:45,690 --> 00:04:48,510
with a generic operating system like Windows, Mac or Linux

126
00:04:48,510 --> 00:04:50,280
would be too difficult and too costly

127
00:04:50,280 --> 00:04:51,750
for the manufacturers to do,

128
00:04:51,750 --> 00:04:54,780
so these higher level EAL systems are usually going to involve

129
00:04:54,780 --> 00:04:57,150
an embedded or purpose-built operating system

130
00:04:57,150 --> 00:04:59,010
like those used in autonomous vehicles,

131
00:04:59,010 --> 00:05:00,990
airplanes, and medical devices.

132
00:05:00,990 --> 00:05:03,810
So remember, trusted operating systems play a vital role

133
00:05:03,810 --> 00:05:06,360
in providing a secure computing environment in context

134
00:05:06,360 --> 00:05:09,300
where data integrity and confidentiality are crucial.

135
00:05:09,300 --> 00:05:11,490
By enforcing strict access control standards,

136
00:05:11,490 --> 00:05:13,230
conducting rigorous security evaluations,

137
00:05:13,230 --> 00:05:15,300
and minimizing the trusted computing base,

138
00:05:15,300 --> 00:05:17,040
these systems aim to mitigate

139
00:05:17,040 --> 00:05:19,290
and minimize potential security risks.

140
00:05:19,290 --> 00:05:21,990
Over time, as data security and assurance continues

141
00:05:21,990 --> 00:05:23,520
to gain an increasingly important role

142
00:05:23,520 --> 00:05:25,020
in our organizational networks,

143
00:05:25,020 --> 00:05:26,760
you may see more and higher levels

144
00:05:26,760 --> 00:05:28,710
of trusted operating systems being used

145
00:05:28,710 --> 00:05:29,853
by your organization.