1. Introduction Flashcards
What does the acronym CIA stand for, and what do each of the words mean?
Confidentiality → Protection of sensitive information from unauthorized access or disclosure. It ensures that data or resources are accessible only to authorized individuals or entities.
Integrity → Pertains to maintaining the accuracy, consistency, and trustworthiness of data or resources. It involves preventing unauthorized or unintended modification, alteration, or destruction of information.
Availability → Relates to ensuring that data, systems, and resources are accessible and usable when needed. It involves protecting against disruptions, outages, or unauthorized denial of service to maintain continuous access to critical resources.
What is the hierarchy of trust?
The hierarchy of trust refers to the levels or layers of trust within a system or network, where higher-level entities are considered more trustworthy than lower-level entities.
Entities trust themselves, and all layers of tech below them
All other trust-relations should be imposed by a higher layer entity, a user, a systems manager or a cryptographic protocol
Who is responsible for maintaining the trust relations in the hierarchy of trust?
The entities or individuals at the higher levels of the trust hierarchy are primarily responsible for maintaining trust relations.
However, in decentralized systems, trust is distributed among all participants, and they collectively contribute to maintaining trust in the system.
How does the responsibilities of the system administrators and users differ from the responsibilities of the developers of hardware and software?
・System administrators are responsible for the day-to-day management and security of the system, users are responsible for adhering to security policies and practices.
・Developers are responsible for creating secure hardware and software components and addressing vulnerabilities in their designs.
How is protection between processes on the same computer done?
Duty of OS, based on settings from admin & user
・File-systems with privileges
・Memory-mapping systems with privileges
・Scheduling of CPU resources
・Virtualization of peripherals
How is protection between users on the same computer done?
Duty of OS, based on settings from admin & user
・Passwords
・Privileges (root user)
・File system with user privileges
・Separation of processes/apps
・Scheduling of resources (to avoid DoS)
How is protection between OSs on the same h/w done?
Duty of hypervisor, based on settings from admin
・Privileges in shared file systems
・Virtually separate file systems
・Supported by protection between processes
・Scheduling of resources (to avoid DoS)
How is protection in a networked environment done?
Duty of sys admin & user
・Firewalls that control what traffic is allowed through
・NATs that hide n/w addresses & n/w structure
・VPNs, that logically divide a n/w into several n/ws with diff privileges
・Cryptographic protocols (encryption) that help integrity & confidentiality
・Redundancy, scheduling & capacity to support availability
Classification of malware based on how it runs/infection
・Virus
・Worms
・Trojan
Virus
・Piece of code that inserts itself into an existing pgm & is executed whenever host pgm is executed
・Spread by inserting themselves into other executables
・Initial infection of sys done through a pgm that only needs to run once, for e.g., which could come through a link from an email
Worm
・A complete pgm on its own & can execute independently of any other pgm
・Doesn’t need a host pgm (unlike virus)
・strategies for spreading is different
・Can spread through a n/w by exploiting vulns in OS, or come as attachments/links in email. Once clicked on, it could be a link to malicious website or can download automatically & run the worm
・More visible
What is a virus, and how does it differ from a trojan?
Virus:
・Malicious software that replicates itself and spreads from one computer to another.
・Attaches to files or programs and activates when they are executed.
・Can modify, delete files, disrupt system operations, and spread to other devices.
・Requires user action to initiate replication and spread.
Trojan:
・Malicious software that disguises itself as legitimate software or files.
・Does not replicate on its own.
・Relies on social engineering to trick users into executing or installing it.
・Can steal sensitive information, allow unauthorized access, or install additional malware.
Difference:
・Viruses replicate and spread, while Trojans do not.
・Viruses spread in stealth mode, trojan not
・Viruses attach to files/programs, Trojans disguise themselves.
・Viruses require user action to spread, Trojans rely on user deception.
・Both can cause significant harm to computer systems and networks.
・Finding Trojan is easier than virus
Classification of malware based on intent
・Spyware
・Ransomware
・Bot
・Rootkit
Spyware
・The task of spyware is to collect sensitive information from the
system it resides on and transfer this information to the attacker.
・The information can be gathered by logging keystrokes on a keyboard,
analysing the contents of documents on the system, or analysing the
system itself in preparation for future attacks.
Malware designed to covertly gather information from a user’s device without their knowledge.
* Monitors and records activities such as keystrokes, browsing habits, and personal data.
* Often used for unauthorized surveillance, stealing sensitive information, or targeted advertising.
* May be installed through deceptive downloads, software vulnerabilities, or bundled with legitimate programs.
* Primarily focuses on unauthorized data collection and invasion of privacy.
Ransomware
・As the name suggests, this is malware that puts the attacker in a
position to require a ransom from the owner of the system.
・The most frequent way to do this is by rendering the system useless through encrypting vital information and requiring compensation for making it available again.
- Malware that encrypts files on a victim’s computer or network, rendering them inaccessible.
- Typically demands a ransom payment in exchange for the decryption key.
- Spreads through various methods like email attachments, infected websites, or malicious downloads.
- Focuses on financial gain by extorting victims for money.
- Can cause significant data loss and disruption to individuals and organizations.
