Part I in .NET framework

Generating Code128 in .NET framework Part I

In this part: 1: Subjects, Users, and Other Actors . . . . . . . . . . . . . . . . . . . . . . . . . 3 2: Authenticators and Authentication Protocols . . . . . . . . . . . . . .17 3: Objects: The Stuff You Want . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55 4: Understanding UAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91 5: Windows Firewall(s) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115 6: Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .151 7: Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183 8: Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213

1

Jesper M. Johansson In this chapter: The Subject/Object/Action-Tuple . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Types of Security Principals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Security Identifiers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Additional Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 At the most basic level, everything in security boils down to subjects and objects. Objects are the things you protect, and subjects are the things you protect objects against. Subjects and objects are used in authentication (proving who you are), authorization (granting access to something), and auditing (tracking who accessed what). These concepts are fundamentally very simple. Subjects are users. Objects are files. Authentication, authorization, and auditing all have to do with how subjects and objects interact. That is the way it used to be, and in some simpler systems, that's the way it still is. Windows, however, supports some immensely rich semantics when it comes to security and has greatly extended the definition of a subject and an object. A subject can be much more than just a user, and the representation is far more complex than just a basic user identifier. Windows also refers to them differently. You will very often come across the term security principal. In Windows parlance, a security principal encompasses not only the typical subject (what we would think of as a user) but also groups and computers. A security principal is anything that can be assigned a security identifier (SID) and that can be given permission to access something. In this chapter you will learn about the various things that can be security principals, and how they are identified in Windows operating systems in general, as well as what is new in Windows Server 2008. In 3, Objects: The Stuff You Want, you will learn about the other side of security: objects.