The system must control applets' accesses to sensitive system resources, such as the file system, the processor, the network, and internal state variables. But the term "the file system" is very broad, and useful applets usually need some persistent storage. Suggest controls that could be placed on access to the file system. Your answer has to be more specific than "allow all reads" or "disallow

Question

all writes." Your answer should essentially differentiate between what is "security critical" and not or "harmful" and not.

What will be an ideal response?

Answer 1

On
the
order
of
a
host-­?based
intrusion
detection
system,
consider
what
privileges
the
applet
requires:
to
which
resources
it
should
legitimately
have
access.
Consider
files
to
which
no
or
few
applets
should
have
access,
such
as
the
password
file,
configuration
files,
and
other
security-­?critical
databases.
Consider
giving
an
applet
full
access
to
a
fenced-­?off
storage
space,
but
denying
the
applet
direct
access
to
other
files:
to
what
resources
does
the
applet
need
access
to
be
useful?
Be
sure
to
distinguish
between
"need"
and
"want":
sometimes
recoding
the
applet
can
allow
it
to
be
access
fewer
resources
without
limiting
its
effectiveness.