5.4Secure OS, database, and application security

For an application security engineer or architect, "not introducing a vulnerability" and "detecting a vulnerability that was introduced" are two wheels of the same cart. The core of this section is judging which technique or testing method belongs at which stage of the development lifecycle. From OS-level access control through database and application-layer implementation measures and testing methods, this section organizes what each defensive layer can and cannot protect against.

5.4.1Secure OS (MAC, RBAC, least privilege)

• Mandatory Access Control (MAC) enforces access uniformly according to a policy set in advance by an administrator, based on security labels (classification level, etc.) attached to files and processes. The decisive difference from Discretionary Access Control (DAC, where the owner can set access rights at their own discretion) is that the file owner cannot change access rights at their own judgment. This is a core feature of a trusted OS: even malware or unauthorized operations cannot override the policy through owner privileges alone.
• RBAC (Role-Based Access Control) assigns permissions to roles rather than to individual users, and manages access by placing users into roles. When someone changes department or leaves, only their role assignment needs updating, giving greater operational consistency and auditability than configuring permissions individually for each person.
• The principle of least privilege grants users and processes only the minimum privilege necessary for their task. Even if an attacker takes over an account or process, the damage is confined to that privilege. A trusted OS is an OS with security features such as MAC built into the OS itself, evaluated and certified by an independent third party (e.g., Common Criteria).