Category: 

What Is a Security Descriptor?

Article Details
  • Written By: M. McGee
  • Edited By: Lauren Fritsky
  • Last Modified Date: 12 November 2016
  • Copyright Protected:
    2003-2016
    Conjecture Corporation
  • Print this Article
Free Widgets for your Site/Blog
The mongoose was introduced to Hawaii in order to kill rats, but mongooses hunt in the day, while rats are nocturnal.  more...

December 7 ,  1941 :  Japanese bombers attack Pearl Harbor.  more...

A security descriptor is a piece of information that is added to part of a computer system, process or file that controls its access parameters. These descriptors will determine whether or not a user or process can access the secured object and whether the object can access other things. A security descriptor is often placed on a high part of a directory path or process chain and the items below the secured object inherit the descriptors and become secured themselves. This simplifies the process for the user since he only needs to secure one thing to create a secured area.

The term ‘security descriptor’ is only properly used by Windows®-based Operating Systems (OS). These descriptors were developed to secure Windows® objects from being accessed in improper ways. Since the term is so vague, it is often used to describe file and process securing methods on other systems that use different methods. This is particularly common with OSs that make heavy use of read/write access commands.

In Windows® systems, security descriptors apply only to securable objects. "Securable" simply means that it has the potential of having a security descriptor added; the term differentiates these items from standard objects. While securable objects and common objects are different, the term is unrelated to the actual difference.

Ad

Objects are a wide range of different things inside the Windows® OS. The system uses the term to denote anything that it can or may access and everything it has accessed — so nearly every non-fixed bit of information on the system is an object. These objects could be on the user side, such as a file or folder full of files, or they could be a system side object, such as a running process or registry entry.

An object may only be securable if it is unique and identifiable. This is a simple concept that has a huge impact on the way a system runs. A unique object means that there is only one in existence at any time. If only one of an object that can have duplicates exists, it is still not unique because there is a possibility of another coming into existence. An identifiable object contains discrete parameters that determine its beginning, end and reason for existence.

If an object is capable of having a security descriptor added to it, the process is often very simple and generally automatic. The descriptor will contain three pieces of information: ownership, access in and access out. Ownership denotes what created the object and whether it passes its descriptor on to its children. Access in tells the object what has access to its contents. Access out tells the object what objects it has access to.

Ad

You might also Like

Recommended

Discuss this Article

Post your comments

Post Anonymously

Login

username
password
forgot password?

Register

username
password
confirm
email