Welcome > Privilege Separation > Process or thread-like solutions for Privilege Separation > Preventing Privilege Escalation

Preventing Privilege Escalation

2003 USENIX Security¹:

Privilege Escalation

Services that require special privilege for their operation are critically sensitive. A programming error here may allow an adversary to obtain and abuse the special privilege.

Privilege Separation

Privilege Seperation: a generic approach to limit the scope of programming bugs. The basic priciple of privilege separation is to reduce the amount of code that runs with special privilege without affecting or limiting the functionality of the service. This narrows the exposure to bugs in code that is executed with privileges.

Ideally, the only consequence of an error in a privilege separated service is denial of service to the adversary itself.

OpenSSH

Reference:

Preventing Privilege Escalation. USENIX Security. 2003. ↩

If you could revise
the fundmental principles of
computer system design
to improve security...

... what would you change?