|
An operating system can become a security role player without degrading performance, user convenience or reliability. The information in a SESR report exist as flags that an OS can
expose through system calls. The SESR report provides information that may be checked by an OS and other programs to assess code operations. These code operations may involve the
existence of device input simulations. A code operation may further involve omissions such as the absence of a SESR report check in an application that allows embedded code execution.
The presence of a SESR report is crucial to making such validations for security. Therefore, a validation failure due to absence of a SESR report is an effective security feature. An
operating system may add to status flags defined in the SESR report as deemed necessary. The corresponding set of system calls would be added or changed. This should cause relevant
code translators to align operations that evaluate status flags.
A computing environment is managed by an operating system. Therefore, a resource should be properly managed at the instance of entry to such an environment. The efficient management of
a resource requires an OS to define a specific point of entry. The transfer of a resource from an external network or device to a computing environment can best be managed at a single
point of entry. This constraint facilitates the prevention of a malicious resource from causing damage. A Windows operating system has a Download folder that should be enforced as the
sole storage location for inbound resources. The changes to a current OS implementation may involve diverting inbound transmissions to this storage point and checking a SESR report. A
transfer to the intended destination would follow. This feature can lead to detection and control of a malicious resource in the following manner.
|