FR
EN
Sécurité systèmeSécurité Informatique (STI)
6ECTS (EU)
1Coefficient
25:20Hours
Séquencement
Learning objectives
- Implement system security under GNU/Linux
Prerequisites
| Module | Teaching unit | Semester |
|---|---|---|
| Computer Security | Network and System Administration | S6 |
| Linux System Administration | Network and System Administration | S6 |
Program
Module divided between two participants (4 courses and 4 TD each)
- General principles
- Principle of lesser privileges and minimization
- In-depth defence principle
- General information on the choice and installation of a secure system
- Partitioning
- kernel configuration (
sysctl)
- Clarification and isolation of processes
- Reminders on UNIX access control and introduction to SELinux
- Old mechanisms (
chroot/jail,setuidandsetgid,seccomp(-bpf)) and alternatives (Capabilities) - Principle of Linux Cgroups and Namespaces
- Principle and discussion on containers and virtualization
- Journalization and centralization
- Principles and implementation of logging
- Principles and implementation of collection and centralisation, operating principles
- General Safety of Information Systems
- Risk-based approach to safety
- Basic principles of risk analysis
- Continuity of activity
- Authentication systems
- Terms of authentication factors
- Password protection
- OTP / HOTP / TOTP
- Applications of cryptography in authentication mechanisms (MAC, HMAC, RSA, operating modes)
- Introduction to Zero-Knowledge Protocols and Shamir's Distributed Secret
- Vulnerabilities of operating systems
- Concept of vulnerability in a system, introduction to the "killchain" model
- Presentation of a main type of vulnerability
- Common protective mechanisms
- Sources of intelligence, assessment of vulnerability criticality
Directed work:
- Installing a secure minimum system on a Debian basis
- Integration of an application with isolated components
- Added centralized logging features
- Hardening Pluggable Authentication Modules configuration (password policy, OTP, smartcard)
Assessment
- Final review
References
ANSSI Guides, Recommendations and Repository:
- Memento on the concept of defence in depth applied to information systemsversion 1.1 of 19 July 2004
- Security Recommendations for a GNU/Linux System, version 1.2 of 22 February 2019)
- Recommendations for a secure use of (Open)SSH, version 1.3 of 17 August 2015
- Recommendations for system partitioning, version 1.0 of 14 December 2017
- Technical note on security issues associated with the virtualization of information systems, version 1.1 of 26 September 2013
- Safety recommendations for the architecture of a logging system, version 2.0 of 28 January 2022
- Security recommendations for the logging of Microsoft Windows systems in the Active Directory environmentversion 1.0 of 28 January 2022
- Security incident detection providers - Reference of requirements, version 2.0 of 21 December 2017
- [Recommendations for Multifactor Authentication and Passwords] (https://www.ssi.gouv.fr/uploads/2021/10/anssi-guide-authentification_multifacteur_et_mots_de_passe.pdf), version 2.0 of 8 October 2021
SecNumEdu Skills
| Skill | Lecture hours | Practical hours | Entry level | Exit level |
|---|---|---|---|---|
| Physical security | 0.17 | 0 | 0 | 1 |
| Awareness of physical security measures in the context of the in-depth defence of a system | ||||
| Contribution of architectures to security | 0.5 | 0.5 | 1 | 2 |
| Contribution and implementation of a centralized logging architecture | ||||
| Product certifications and evaluations | 1 | 0 | 0 | 1 |
| Awareness of the contribution to confidence in safety features and limitations (safety targets) of certifications (CFNs and Common Criteria), qualifications (products and services) and approvals | ||||
| Operating system security | 5.33 | 8.16 | 1 | 2 |
| Security mechanisms of a GNU/Linux system: kernel configuration, partitioning, disk encryption, access control (ACL UNIX, SELinux), partitioning and isolation (Cgroups, namespaces, containerization); logging. Setting and hardening the authentication of a GNU/Linux system: discovery of PAM, implementation of a password policy, a matrix OTP system, authentication with a smartcard. Introduction to the main vulnerabilities of operating systems and their vectors; the various protection mechanisms. | ||||
| Knowledge of governance, norms and standards in the security field | 0.83 | 0.66 | 0 | 1 |
| Existence and use of ANSSI's guidance guides Presentation of the different standards/standards and their uses: PCI, ETSI, COBIT, ITIL | ||||
| Fundamentals | 1.33 | 0.33 | 0 | 1 |
| Reminders of security objectives, principles of defence in depth, less privileges and minimalization. Contribution of risk analysis to the supervision of threat scenarios through logging | ||||
| Cryptology | 1.33 | 0.67 | 1 | 1 |
| Use of cryptography in authentication systems (MAC/HMAC constructions in OTP, HOTP, TOTP systems). Electronic signature in "challenge-response" protocols. | ||||
| Cybersecurity policy and ISMS | 1.33 | 0 | 0 | 1 |
| Risk Governance Approach. Functioning of risk analysis methodologies. Continuity and compliance, backup strategies. | ||||