A security descriptor is a piece of information that is added to part of a computer system, process or file that controls its access parameters. These descriptors will determine whether or not a user or process can access the secured object and whether the object can access other things. A security descriptor is often placed on a high part of a directory path or process chain and the items below the secured object inherit the descriptors and become secured themselves. This simplifies the process for the user since he only needs to secure one thing to create a secured area.
The term ‘security descriptor’ is only properly used by Windows®-based Operating Systems (OS). These descriptors were developed to secure Windows® objects from being accessed in improper ways. Since the term is so vague, it is often used to describe file and process securing methods on other systems that use different methods. This is particularly common with OSs that make heavy use of read/write access commands.
In Windows® systems, security descriptors apply only to securable objects. "Securable" simply means that it has the potential of having a security descriptor added; the term differentiates these items from standard objects. While securable objects and common objects are different, the term is unrelated to the actual difference.
Objects are a wide range of different things inside the Windows® OS. The system uses the term to denote anything that it can or may access and everything it has accessed — so nearly every non-fixed bit of information on the system is an object. These objects could be on the user side, such as a file or folder full of files, or they could be a system side object, such as a running process or registry entry.
An object may only be securable if it is unique and identifiable. This is a simple concept that has a huge impact on the way a system runs. A unique object means that there is only one in existence at any time. If only one of an object that can have duplicates exists, it is still not unique because there is a possibility of another coming into existence. An identifiable object contains discrete parameters that determine its beginning, end and reason for existence.
If an object is capable of having a security descriptor added to it, the process is often very simple and generally automatic. The descriptor will contain three pieces of information: ownership, access in and access out. Ownership denotes what created the object and whether it passes its descriptor on to its children. Access in tells the object what has access to its contents. Access out tells the object what objects it has access to.
