Security and Protection

Learning outcomes:

Explain the goals of security, and compare authentication methods including MFA, passkeys, and biometrics, along with their weaknesses
Describe how operating systems control access, using Linux permissions, ACLs, SELinux or AppArmor, sandboxing, Secure Boot, and the TPM
Analyze real attacks such as ransomware, supply chain attacks, and security software failures, and explain the defenses that apply
Explain the basics of encryption, digital signatures, and certificates, and evaluate how AI is changing both attacks and defenses

Would you like to download my PowerPoint to follow along?

What Is Security?

All security starts with two questions: who do you trust, and how much?

Your answers become a security policy: the rules for who can do what

The CIA triad: the three goals of security

Confidentiality: only the right people can see it. Your grades aren't public
Integrity: nobody can secretly change it. Nobody edits your grade after it's posted
Availability: it works when you need it. The learning system is up the night an assignment is due

It's easier to protect against accidents than against someone who is trying to break in
Learn more in the Information Security course: Introduction to Security and Information Assurance

Security Components

Authentication: proving who you are
Protection (access control): deciding what you are allowed to do
Isolation: keeping programs from interfering with each other
Secure communication: protecting data as it travels
Physical security: locks, cameras, and who can touch the hardware
People: often both the strongest and the weakest part
Learn more in the Information Security course: Physical Security

Authentication: Proving Who You Are

Three kinds of factors:

Something you know: a password or PIN
Something you have: your phone, a security key, or a bank card
Something you are: a fingerprint or your face

Multi-factor means two different kinds. Two passwords are still only one factor
Examples: a bank card plus a PIN, or a password plus a code from your phone

Passwords Today

Current NIST guidance for passwords: (NIST SP 800-63B: Authentication and Authenticator Management)

Length matters most: at least 15 characters when a password is the only factor
No forced mixes of symbols and numbers, and no forced changes every few months
Check new passwords against lists of common and breached passwords

A password manager makes long, unique passwords for every account possible
Weaknesses: reused passwords, breaches, phishing sites that steal them, and guessable choices

Multi-Factor Authentication

From weakest to strongest:

Text message codes: better than nothing, but a SIM swap scam can steal your number
Authenticator apps and push approvals
Security keys and passkeys: built to resist phishing

Weakness: MFA fatigue. In 2022, an attacker kept sending login approvals to an Uber contractor until one was accepted (Uber: Security update (September 2022))

Number matching, where you type the number shown on screen, makes this much harder (Microsoft: How number matching works in MFA)

Historical note: key-fob code generators like RSA SecurID were common at work. Still worth knowing because many companies still use them

Passkeys and Biometrics

Passkeys replace passwords with a key stored on your device, unlocked with your face, fingerprint, or PIN (FIDO Alliance: Passkeys)

Nothing to type, so nothing to phish

Face ID, Touch ID, and Windows Hello keep your fingerprint or face data on the device, in protected hardware, not on a company's server
Weaknesses:

You can't change your face or fingerprint if they're ever copied
Losing your phone can lock you out, and passkeys can tie you to one company's devices

Access Control

After you log in, the OS decides what you are allowed to do
Least privilege: give each user and program only the access it needs, and nothing more
Example policy for a personnel file:

Teresa can read it if she knows the password
Patty can change it, Jonathon can only read it, and Brandon has no access
Everyone in the HR group can read it

Ways to store these rules: an access control matrix (every user by every file), or a list on each file of who can do what

Linux Permissions

Every file has an owner and a group
Three classes: owner, group, and others. Three permissions: read (r), write (w), and execute (x)

ls -l shows -rw-r----- : the owner can read and write, the group can read, and others get nothing
chmod changes permissions, chown changes the owner, and id shows your user and groups

root can do anything. Use sudo to run one command as root, instead of logging in as root
Back in Week 9, permissions were just file metadata. This is what the OS does with them

Access Control Lists and Windows

An access control list (ACL) gives finer control, such as letting one extra person read a file

Linux: getfacl shows them, and setfacl changes them (Linux manual page: getfacl)
Windows NTFS permissions are ACLs: right-click a file, then Properties, then Security

User Account Control (UAC) on Windows: even an administrator works with normal rights until a prompt asks to allow a change (Microsoft: User Account Control)
Weakness: people click Yes on every prompt without reading it

SELinux and AppArmor

Normal permissions let the owner decide. Mandatory access control adds system-wide rules that even root has to follow
SELinux: used by Red Hat, Fedora, and Android (Red Hat: What is SELinux?)
AppArmor: used by Ubuntu, Debian, and SUSE. Each program gets a profile listing what it may touch (Ubuntu: AppArmor)
If a web server is hacked, the attacker is still boxed in by its rules
Weakness: the rules are complicated, so people often turn them off when something breaks, which removes the protection

Weaknesses in Access Control

Privilege creep: people gain access as their jobs change and never lose the old access
Everyday use as an administrator, so any malware also gets admin rights
Privilege escalation: an attacker uses a bug to go from a normal user to root or administrator
Convenience vs security: shared passwords and "just give everyone access" are common shortcuts
The fix is the same every time: least privilege, and checking access regularly

Isolation and Sandboxing

Each process gets its own memory, so it can't read another's data (Week 11)
Phone apps run in a sandbox and must ask before using your camera, location, or contacts
Browsers run each website in its own sandboxed process (Week 2)
Containers isolate groups of processes (Week 14)
Historical note: browsers used to run Java applets, ActiveX, and Flash plugins with weak isolation, and all three have been removed. Still worth knowing because they show why sandboxing became the default
Weakness: attackers chain several bugs together to escape a sandbox

Secure Boot and the TPM

Secure Boot: the firmware only runs boot software with a trusted digital signature, so malware can't load before the OS (Microsoft: Secure boot)
TPM (Trusted Platform Module): a small security chip that stores keys and records what started up (Microsoft: Trusted Platform Module overview)

Full-disk encryption (Week 9) can keep its key in the TPM, so a stolen drive cannot be read in another computer

Windows 11 requires both (Week 1)
Historical note: these grew out of the Trusted Computing Initiative of the 2000s. Still worth knowing because the same debate about who controls the computer continues today

Secure Boot: Who Chooses Your OS?

Secure Boot trusts whatever the manufacturer chose to trust, which on most PCs means software signed by Microsoft

Linux distributions boot by using a small loader (shim) signed by Microsoft, or you turn Secure Boot off, or enroll your own keys (Debian: SecureBoot)

On phones, tablets, game consoles, and some laptops, you often can't choose a different OS at all
Critics such as the Free Software Foundation call this "Restricted Boot" when users cannot turn it off or install the OS they choose (Free Software Foundation: Secure Boot vs Restricted Boot)

Secure Boot, DRM, and Ownership

The same chain of trust is used for DRM (digital rights management) and anti-cheat: software checks that your device is "trusted" before it will run

Riot's Vanguard anti-cheat requires TPM 2.0 and Secure Boot on Windows 11, so you can't play with them off or on Linux (Riot Games: Vanguard error codes)

Security for the user and control by the company use the very same tools
The question to ask: if a company decides what your hardware will run, do you really own it?

Weaknesses in Secure Boot and the TPM

BlackLotus (2023): malware that bypassed Secure Boot on Windows by using an older, still-trusted boot program (Microsoft: Guidance for investigating BlackLotus)
PKfail (2024): around 900 PC and server models shipped with test keys labeled "DO NOT TRUST", and one of those keys had leaked (Binarly: PKfail)
Someone with the laptop in hand can sometimes read the encryption key on its way out of the TPM. A startup PIN blocks this (Microsoft: BitLocker countermeasures)
Trust expires too: Microsoft's original 2011 Secure Boot certificates began expiring in June 2026, so devices needed updates to keep booting safely

Updates and Patching

Most attacks use known bugs that already have a fix. Updates close those holes
A zero-day is a bug attackers use before a fix exists
CISA keeps a list of vulnerabilities being actively exploited, so admins know what to patch first (CISA: Known Exploited Vulnerabilities Catalog)
Linux: sudo apt upgrade or sudo dnf upgrade. Windows: Windows Update. Phones: system updates
End of life means no more fixes, ever (Week 1)
Weakness: updates can break things, so people delay them, which leaves the holes open

Case Study: The CrowdStrike Outage (2024)

In July 2024, a faulty update to CrowdStrike, a security product that runs inside the Windows kernel, crashed about 8.5 million Windows computers (Microsoft: Helping our customers through the CrowdStrike outage)

Airlines, hospitals, and banks were knocked offline, and many machines had to be fixed by hand (CrowdStrike: Preliminary post incident report)

Lessons:

Code running in the kernel can take down the whole system (Week 1)
Roll updates out to a few machines first, not everyone at once

Microsoft responded by building a way for security software to run outside the kernel (Microsoft: Windows security and resiliency)

How Attacks Happen

Trojan horse: looks like a normal program, but does something harmful
Backdoor: a hidden way around normal security
Buffer overflow: too much data overwrites nearby memory. ASLR, no-execute memory, and memory-safe languages fight this (Week 11)
Privilege escalation: turning a normal account into an administrator
Phishing and social engineering: tricking people instead of computers
Botnets: hacked devices, often cheap smart home gadgets, controlled together to flood websites (Week 1, IoT)
Learn more in the Information Security course: Malware
Learn more in the Information Security course: Denial of Service and Social Engineering

Ransomware

Ransomware encrypts your files and demands payment for the key (CISA: #StopRansomware Guide)

Many groups also steal the data first and threaten to publish it

It usually gets in through phishing, stolen passwords, or unpatched systems
Defenses:

Backups the ransomware cannot reach: offline, or unchangeable for a set time (Week 10, 3-2-1 rule)
Test that you can actually restore
Least privilege, MFA, and fast patching to keep it from spreading

Learn more in the Information Security course: Detecting and Managing Infections

Case Study: The xz Utils Backdoor (2024)

xz is a small compression tool included in almost every Linux system, maintained mostly by one volunteer
An attacker spent a long time earning trust as a helper, then hid a backdoor in versions 5.6.0 and 5.6.1, aimed at SSH logins (Andres Freund: backdoor in upstream xz/liblzma (oss-security))
Andres Freund, a developer, noticed SSH logins were using extra CPU and taking about half a second longer, and traced it back (NIST NVD: CVE-2024-3094)
It was caught in test versions, before it reached most stable releases
Lessons: a supply chain attack hides in software you trust, and critical open source projects often depend on a few unpaid people

Antivirus Then and Now

Historical note: antivirus used to rely on signatures, matching files against a list of known malware. Still worth knowing because signatures are still one layer
Today it also watches behavior, such as a program suddenly encrypting hundreds of files
Built in: Microsoft Defender on Windows, and XProtect on macOS (Microsoft: Defender Antivirus in Windows)
Linux: ClamAV, mostly used to scan files on mail and file servers
Weaknesses: new malware can slip past, false alarms happen, and security software with deep access can cause outages itself

Firewalls and Intrusion Detection

A host firewall decides which network connections are allowed in and out

Windows Defender Firewall, ufw on Ubuntu, and firewalld on Red Hat and Fedora

Intrusion detection systems (IDS) watch logs and network traffic for signs of an attack

Logs record who logged in, which services started, and what failed. Linux: journalctl. Windows: Event Viewer

Weaknesses: too many alerts get ignored (alert fatigue), and a misconfigured firewall gives a false sense of safety
Learn more in the Information Security course: Network Attack and Defense

Cryptography: Symmetric Encryption

Encryption scrambles data so only someone with the key can read it
Symmetric: the same key locks and unlocks

Fast, so it is used for disks, files, and most network traffic
AES is the standard today

The hard part: both sides need the key, without anyone else getting it
Historical note: DES, from the 1970s, used keys so short they can be cracked quickly today. Still worth knowing because old systems and textbooks still mention it
Learn more in the Information Security course: Cryptography

Cryptography: Public Key Encryption

Two keys: a public key anyone can have, and a private key you keep secret

Lock with the public key, and only the private key can unlock it. This solves the key sharing problem

Examples: RSA, which relies on how hard it is to factor very large numbers, and elliptic curve cryptography
Weakness: future quantum computers could break RSA and elliptic curves

NIST published its first post-quantum encryption standards in 2024 (NIST: FIPS 203, post-quantum key encapsulation)

Hashing and Digital Signatures

A hash is a fingerprint of data: change one letter, and the hash changes completely. It cannot be reversed
If Alice wants to sign a document:

She hashes the document, and encrypts the hash with her private key
Anyone can check it with Alice's public key

That proves Alice signed it, and that nobody changed it afterward
Passwords are stored as hashes, so a stolen password file does not reveal the passwords directly

Certificates and PKI

A certificate ties a public key to a name, signed by a certificate authority (CA) that everyone trusts
The HTTPS padlock means your connection is encrypted to that site. It does not mean the site is honest

Let's Encrypt gives free certificates, so even phishing sites have padlocks (Let's Encrypt: How it works)

Signed software: app stores, Windows drivers, and Linux packages from apt and dnf are all checked with signatures
Weakness: if a signing key is stolen, malware can be signed and look legitimate

Secure Connections

TLS protects web traffic (HTTPS), email, and most apps
VPNs create an encrypted tunnel across the internet. IPsec is the older standard, and WireGuard is built into Linux (WireGuard)

Weakness: a VPN moves your trust to the VPN company, which can see your traffic

Wi-Fi: WPA3 is current (Wi-Fi Alliance: Security)

Historical note: WEP and the original WPA can be broken quickly. Still worth knowing because old routers and devices still use them

Learn more in the Information Security course: Web Security

AI Built Into the Operating System

Windows Copilot+ PCs and Apple devices run AI features on the NPU (Week 3)
Windows Recall takes regular snapshots of your screen so you can search everything you've seen (Microsoft: Update on Recall security and privacy architecture)

After privacy concerns, Microsoft redesigned it: it is opt-in, encrypted, isolated in a protected enclave, and needs Windows Hello to search

Apple sends some AI requests to its Private Cloud Compute, designed so even Apple can't read them (Apple: Private Cloud Compute)
Weakness: AI features collect and keep more of your data, which becomes one more thing to protect

AI and Attackers

The FBI warns that criminals use generative AI to make scams more convincing and faster to produce (FBI IC3: Criminals use generative AI to facilitate financial fraud (2024))

Phishing emails without the spelling mistakes that used to give them away
Cloned voices of family members asking for money

In 2024, a finance worker in Hong Kong paid out about $25 million after a video call where the "chief financial officer" and coworkers were deepfakes (CNN: Finance worker pays out $25 million after video call with deepfake CFO)
Defense: verify through a second channel, such as calling back a number you already know

New Weaknesses from AI

Prompt injection: hidden instructions in a web page, email, or file trick an AI assistant into doing something you didn't ask for (OWASP: LLM01 Prompt Injection)

The more an AI agent can do on your computer, like reading files or sending email, the more damage it can do
Least privilege applies to AI too

AI-written code can include security bugs, or even suggest software packages that do not exist, which attackers can then create
AI answers can be confidently wrong (hallucinations), so a person must check anything security-related

AI for Defense

Security tools use machine learning to spot unusual behavior, such as a login from a new country at 3 a.m.
AI can help sort thousands of alerts and summarize logs
But it can also miss attacks or flag normal activity, so people still make the final call
Attackers and defenders both use AI, so the basics still matter most: updates, MFA, least privilege, and backups

People and Security

Most breaches involve a person: a clicked link, a reused password, or an approved login prompt
Social engineering targets trust, urgency, and helpfulness
Good habits: slow down, verify requests through another channel, and report mistakes quickly
Security works best when it's easy to do the right thing
Learn more in the Information Security course: Privacy, Anonymity, and Paranoia

See It Yourself

Linux:

id, ls -l, and sudo -l (what you are allowed to run as root)
sestatus (SELinux) or sudo aa-status (AppArmor)
mokutil --sb-state shows whether Secure Boot is on

Windows: the Windows Security app, tpm.msc for the TPM, and System Information for "Secure Boot State"
macOS: System Settings, Privacy and Security

Suggested Activities and Discussion Topics:

Activity: on a Linux system or virtual machine, run id, then ls -l in your home directory. Pick a file and explain who can read, change, and run it. Then run sudo -l. What are you allowed to run as root?
Activity: check whether Secure Boot is on and your computer has a TPM. On Windows, open System Information and look for "Secure Boot State", then run tpm.msc. On Linux, run mokutil --sb-state. Could you install a different operating system on this computer if you wanted to?
Activity: look at the sign-in options for an account you use every day, such as school email or a bank. Which kinds of multi-factor authentication does it offer? Does it support passkeys? Which is the strongest one you could turn on today?
Activity: find a recent ransomware or data breach news story from a reliable source. How did the attackers get in? Which defenses from this week would have stopped or limited it?
Discussion: Secure Boot and the TPM protect users, but the same tools let companies decide what software your device will run, for DRM and anti-cheat. Is that trade-off worth it? Who should get to decide?
Discussion: would you turn on a feature like Windows Recall that remembers everything you have seen on your screen? What would you want to know about how it protects your data first?
Discussion: an AI assistant can read your email and files to help you. How could a hidden instruction in an email trick it? What limits would you put on what it can do?

Would you like to see some more classes? Click here