From: leichter@lrw.com (Jerry Leichter)
Newsgroups: comp.os.vms
Subject: RE: Questions about VMS image accounting
Date: 2 Sep 92 14:24:58 GMT
Distribution: world
Organization: The Internet


	Since time immemorial, the VAXen here at our site have been performing
	image accounting.  Recently we have come into a bit if a disk space
	crunch; it was suggested that we could save a lot of disk space if we
	turned off image accounting.  I am evaluating that suggestion,
	primarily from a security standpoint. 

	Basic facts concerning our system:

	- It services military personnel, so security is important.
	- We do not "charge" organizations for computer time or images
		activated.
	- We do perform fairly comprehensive security auditing.

	My questions:

	1.  How useful would image accounting records be in the case of a
	breach in system security?  I have noted that even the ACCOUNTING/FULL
	report does not show a whole lot of useful information about what was
	actually being done by the activated image.

	2.  Is there any way to get further information about a specific image
	activation that was recorded by image accounting?  If more specific
	information cannot be obtained about the various accounting entries, I
	can't see the point in creating them.

While I could imagine some rare circumstances in which it might be useful (if
you knew, after the fact, that some process had been run by an intruder, you
can at least check what images it had run), in general image accounting is
there for purposes like charging and statistics gathering, not security.
The actual accounting packet for an image accounting entry is documented in
the Accounting Utility manual.  What's in there is a full identification of
the process (including "privileges held by the process", but it isn't clear
whether this is the authorized, enabled, or current privilege mask); a snap-
shot of resources used so far by the process; and the full file spec of the
image file.  As far as I can tell, all the information available will be
displayed by a /FULL display of the record.

While you can tell, but examining successive records for a given process, how
much CPU time, how many disk I/O's, and so on the image used, at least
approximately, there's no information to be had about WHAT it did with those
resources.  (BTW, I say "approximately" because the record is written at image
rundown, and simply summarizes total process resource usage, not incremental
usage.  If a process ran image A, then played around in DCL for a while, then
ran image B, you'd be able to determine resource usage after A and after B,
hence total usage between the time A completed and the time B completed; but
you would have not way to determine how much of the usage occured while B was
active, and how much was due to mucking around in DCL.  Since it's quite
possible to do things like examine and update SYSUAF.DAT from DCL (if you have
the appropriate access to the file, of course), image accounting is inherently
unable to give you any real picture of what is going on within a phase of the
process's life that is as critical to security as any other.

You can get much more useful information by setting alarm ACL's on sensitive
files.

I suppose the real bottom line is:  If you have a security problem, every
bit of information is potentially useful.  The question is, how much are you
willing to pay for this information, knowing that it is likely to have rather
limited usefulness?  The tradeoff is inherently very site dependent.

(I know of one site that insists on full image accounting so that reports on
image usage statistics can be sent to upper-level managers who have been
receiving analogous reports from their IBM mainframes since time immemorial.
As far as anyone can tell, no one ever looks at these reports.)

							-- Jerry