AIX Host security

Course Overview

This course will introduce students to the IBM Security Architecture model and various security mechanisms provided by AIX 5L. Topics discussed include key security concepts, recommended methodologies for security planning and overall security management, and steps required to configure and use specific security mechanisms.

Techniques for intrusion detection and guidelines for responding to security incidents are also presented. In addition, the course describes methods for checking the security of a system, including standardized industry criteria for evaluating system security.

The security mechanisms covered in detail include standard UNIX user and group administration, passwords, file and directory permissions, and the configuration of the syslog facility. We also discuss AIX 5L extensions in detail: user administration shadow files, the trusted computing base (TCB), extended file and directory access control, the audit mechanism, and the error daemon.

The course will also describe standardised industry criteria for evaluation of system security, with an emphasis on the Common Criteria for Information Technology Security Evaluation (CC), and will explain how AIX 5L can be configured to support compliance with the CC Controlled Access Protection Profile (CAPP) and Evaluation Assurance Level 4 (EAL4) standards.

Audience

The course is intended for:

• System administrators, technical support
• Personnel, and other support personnel responsible for implementing
• Security on systems using the AIX 5L operating system.

Skills Gained

On completion of this course students should be able to:

• Explain and apply a methodology for security planning and management
• Use AIX 5L authorization and authentication mechanisms to implement provisions of a security policy
• Use access control mechanisms provided by AIX 5L
• Use AIX 5L mechanisms to increase system availability and decrease the risk of a successful denial of service (DoS) attack
• Use the trusted computing base (TCB)
• Configure and use the AIX 5L audit subsystem
• Identify intrusions on the host and network
• Develop effective processes for responding to security incidents
• Evaluate system and network security
• Install an AIX system with the Controlled Access Protection Profile (CAPP) and Evaluation Assurance Level 4+ (EAL4+) option

Course Outline

• Security Management and Planning
• Identification and Authorization
• Authentication
• Access Control
• Maintaining Availability
• Maintaining Host Integrity
• Auditing
• Monitoring and Detection
• Incident Response
• Network Security
• System and Network Evaluation
• Formal Security Evaluation
• Conference
• Conference and Workshops

AIX Host security / AU411AGB (AU411AGBGB)