Novell APPARMOR Admin Manual page 96

U s e r ' s G u i d e
By not relying on attack signatures, SubDomain provides "pro-active"
instead of "reactive" defense from attacks. This is better because there
is no window of vulnerabilty where the attack signature has to be
defined for SubDomain as it does for products using Attack Signatures
to secure their networks.
Vulnerabilities: An aspect of a system or network that leaves it open
.
to attack Characteristics of computer systems that allow an individual
to keep it from correctly operating, or that will allow unauthorized users
to take control of the system. Design, administrative, or implementation
weakness or flaw in hardware, firmware, or software. If exploited, a vul-
nerability could lead to an unacceptable impact in the form of unautho-
rized access to information or disruption of critical processing.
Mandatory Access Control: A means of restricting access to objects
that is based on fixed security attributes assigned to users and to files
and other objects. The controls are mandatory in the sense that they
cannot be modified by users or their programs.
Application firewalling: SubDomain contains applications and limits
the actions they are permitted to take. It uses privilege confinement to
prevent attackers from using malicious programs on the protected
server or even using trusted applications in unintended ways.
Profile Foundation Classes: or profile building blocks needed for
common application activities such as DNS lookup and user authenti-
cation.
Streamlined Access Control: SubDomain provides streamlined
access control for network services by specifying which files each pro-
gram is allowed to read, write, and execute. This ensures that each
program does what it is supposed to do, and nothing else.
Host Intrusion Prevention (HIP): This technology works with the
operating system kernel to block abnormal application behavior in the
expectation that the abnormal behavior represents an unknown attack.
It works by blocking the malicious packet on the host at the network
level, before they could 'hurt' the application they're targeting.
96