System Configuration and Access

From Kicksecure
Revision as of 20:55, 23 November 2024 by Patrick (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Best Security Practices for System Configuration and Access.

Avoid Shared Hosts[edit]

Info Tip: Kicksecure should preferably be used only on computers without shared access.

It is unwise to allow others to use your computer, even if they are trustworthy individuals. If they are not equally knowledgeable in computer security, then one mistake could potentially lead to compromise of the entire system. [1]

Needless to say, Kicksecure should not be hosted in the cloudarchive.org iconarchive.today icon, on a foreign server that is not controlled by the user, on a virtual private server (VPS)archive.org iconarchive.today icon, or other remote hosting options. The risks include: [2] [3]

  • Data on these systems is readily accessible to their owners.
  • Data can be accidentally or deliberately altered / deleted.
  • Legal ownership of data is disputed.
  • Shared technological vulnerabilities include insecure interfaces and application program interfaces (APIs), data loss / leakage and hardware failure.
  • Proven vulnerability to large scale attacks like "hyperjacking"archive.org iconarchive.today icon, along with exposure to traditional threats like network eavesdropping, invasion, denial of service attacks, side-channel attacks and so on.

Use a Dedicated Host Operating System and Computer[edit]

Both Kicksecure and Kicksecure-Qubes users should avoid dual / multi-boot configurationsarchive.org iconarchive.today icon. The other operating system (OS) such as for example Microsoft Windows could modify the unprotected /boot partition or firmware to maliciously compromise Qubes or the host OS, and also potentially spy on user activities.

Kicksecure users are recommended to use one dedicated host operating system (OS) just for hosting Kicksecure VM (in case Kicksecure is hosted on a VM). Otherwise, if the host OS which is used daily is compromised, Kicksecure cannot provide any additional protection. This is because the host is part of the system's trusted computing base (TCB)archive.org icon:

For a computer system, the trusted computing base or TCB comprises the set of all hardware, software, and firmware components that are critical to establishing and maintaining its security. Typically, the TCB consists of an OS with all its in-built security controls, individual system hardware, network hardware and software, defined security procedures and protocols, and the actual physical location of the system itself.

...

Maintaining the confidentiality and integrity of data on a system is a prime responsibility of the TCB. The trusted computing base is also charged with enforcing the system’s security policy, and is the only component of a system that operates at such a high level of trust. This means that if any part of the TCB is subverted or contains flaws, the overall security policy of a system may be compromised.

See Malware and Firmware Trojans to learn more about the impacts of a compromised TCB.

For even greater security, the dedicated host OS can be used on a computer solely bought for Kicksecure activities. Ideally this computer will have never been used for anything else before, negating the risk of a prior hardware compromise.

Kicksecure on External Media[edit]

See: Kicksecure on USB or other External Media.

See Also[edit]

Footnotes[edit]

  1. ↑ If necessary, this risk is partially mitigated by creating untrusted domains in Kicksecure for Qubes for other users.
  2. ↑ https://en.wikipedia.org/wiki/Cloud_computing#Security_and_privacyarchive.org iconarchive.today icon
  3. ↑ https://en.wikipedia.org/wiki/Cloud_securityarchive.org iconarchive.today icon
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=System_Configuration_and_Access&oldid=88587"