Polaris: virus-safe computing for Windows XP

ABSTRACT

It limits the damage a virus can do by using the operating system's own security mechanisms to enforce the Principle of Least Authority on individual applications.

REFERENCES

• 1: Close, T., Stiegler, M., and Karp, A. Shatter-proofing Windows. In Black Hat USA 2005 (Las Vegas, July 23, 2005); www.blackhat.com/presentations/bh-usa-05/BH_US_05-Close/tylerclose_whitepaper_US05.pdf.
• 2: Poul-Henning Kamp , Robert Watson, Building Systems to Be Shared, Securely, Queue, v.2 n.5, July/August 2004 [doi>10.1145/1016998.1017001]
• 3: Kim, S. Java Web Start: Developing and Distributing Java Applications for the Client Side. White Paper, IBM Corp. Armonk, NY, Sept. 1, 2001; www-106.ibm.com/developerworks/java/library/j-webstart/.
• 4: Gary McGraw , Edward W. Felten, Securing Java: getting down to business with mobile code, John Wiley & Sons, Inc., New York, NY, 1999
• 5: Microsoft Corp. 10 Immutable Laws of Security. Redmond, WA; www.microsoft.com/technet/archive/community/columns/security/essays/10imlaws.mspx.
• 6: Microsoft Corp. Developer Best Practices and Guidelines for Applications in a Least Privileged Environment: Understanding User Account Protection in Microsoft Windows Vista Beta 1, Windows Security Access Control. Redmond, WA, Sept. 2005; msdn.microsoft.com/windowsvista/ default.aspx?pull=/library/en-us/dnlong/html/AccProtVista.asp.
• 7: Paget, C. Click next to continue. In Black Hat 2003 (Las Vegas, July 2003); blackhat.com/html/bh-media-archives/bh-archives-2003. html#USA-2003.
• 8: Stiegler, M. An introduction to petname systems. In Advances in Financial Cryptography, Volume 2, I. Grigg, Ed., 2005; www.financialcryptography.com/mt/archives/000499.html.
• 9: Stiegler, M. and Miller, M. A Capability-based Client: The DarpaBrowser. Technical Report, Focused Research Topic 5. Combex, Inc., Meadowbrook, PA, June 2002; www.combex.com/papers/darpa-report/index.html.
• 10: U.S. General Accounting Office. Technology Assessment: Cybersecurity for Critical Infrastructure Protection. GAO-04-321, Washington, D.C., May 2004, 27.
• 11: Websense Security Laboratories. Cyber Extortion Attack. May 2005; www.websensesecuritylabs.com/alerts/alert.php?AlertID=194.
• 12: Ka-Ping Yee, User Interaction Design for Secure Systems, Proceedings of the 4th International Conference on Information and Communications Security, p.278-290, December 09-12, 2002
• 13: Eugene H. Spafford, The internet worm program: an analysis, ACM SIGCOMM Computer Communication Review, v.19 n.1, p.17-57, Jan. 1989 [doi>10.1145/66093.66095]
• 14: Miller, M. and Shapiro, J. Paradigm regained: Abstraction mechanisms for access control. In Proceedings of the Eighth Asian Computing Science Conference (ASIAN 2003) (Mumbai, India, Dec. 10--13). Tata Institute of Fundamental Research, Mumbai India, 2003, 224--242; erights.org/ talks/thesis/index.html.
• 15: Saltzer, H. and Schroeder, M. The protection of information in computer systems. Proceedings of the IEEE 63, 9 (Sept. 1975), 1278--1308.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
      C.2.4 Distributed Systems

  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.2 Social Issues
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.3 Software Management