Part I
An attacker seeks to view the contents of a specific Microsoft Word document file to which they do not have any kind of access.
You may assume that:
- no exploitable vulnerabilities of any kind exist;
- the attacker has a non-privileged account on the system;
- basic system access controls do not currently permit the attacker to access the file and the attacker cannot directly change these controls; and
- the attacker cannot physically tamper with the system in any way.
Based on your study in this unit, outline and describe the core security mechanisms that Windows implements to prevent the attacker achieving that goal. Include a brief discussion of the low-level mechanisms that protect the operating system from an attack that targets the layer below. The marks breakdown table below may assist you in identifying the general issues that need to be covered.
In completing this task, you must use an approach based on the architectural divisions discussed during lectures to organise your answer. You may find that the information discussed in lectures and contained in the textbook substantially assist you to frame your answer. However, you may wish to do some additional research.
You should include a complete reference list of any additional sources that you have used.
Part II
Now assume that the attacker has been able to gain control over the system such that they have gained administrator access.
Discuss briefly how the above outlined security mechanisms would fail, and the reasons for this failure. Outline an alternative security architecture that could continue to achieve the specified security goal despite this new scenario. You must include in your discussion of the security limitations of your approach.
Note that this is intended to be an open-ended problem and your alternative security architecture may or may not exist as a specific product or system, so you are expected to think creatively about this solution. It is likely that you will need to undertake some research to assist in answering this part of the problem.