3.3 Implement secure systems design. Flashcards
FDE
(Full Disk Encryption) Encryption of all data on a disk (including system files, temporary files, and the page file) can be accomplished via a supported OS, third-party software, or at the controller level by the disk device itself.
TPM
(Trusted Platform Module) A computer chip (microcontroller) that can store digital certificates, key, hashed passwords, and other user and platform identification information.
HSM
(Hardware Security Module) An appliance for generating and storing cryptographic keys, safeguards and digital keys, performing encryption and decryption functions for digital signatures, strong authentication and other cryptographic functions. This sort of solution may be less susceptible to tampering and insider threats than software-based storage.
UEFI/BIOS
(Unified Extensible Firmware Interface) A type of system firmware providing support for 64-bit CPU operation at boot, full GUI and mouse operation at boot, and better boot security.
Secure boot and attestation
Secure boot: prevents a computer from being hijacked by a malicious OS.
Attestation: declare something to be true
Supply Chain
The end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer.
Hardware root of trust
A secure subsystem that is the foundation on which all secure operations of a computing system depend, and it’s able to provide attestation.
EMI/EMP
(Electromagnetic Interference) A disruption of electrical current that occurs when a magnetic field around one electrical circuit interferes with the signal being carried on an adjacent circuit.
Operating systems
An OS is HARDENED when is put into a secure configuration. The principle of LEAST FUNCTIONALITY should be implemented.
Kiosk
A computer terminal deployed to a public environment. ex. ATMs, airport checkin.
In order to secure a kiosk, the hardware ports must be inaccessible
Patch Management
A couple rules to follow for patches:
- Only apply patches if a particular problem is being experienced.
- Always create backups before implementing a patch
Disabling unnecessary ports and services
Application service ports allow client software to connect to applications. These should be CLOSED if remote access is not necessary.
Least functionality
The principle of a system only running protocols and services required by legitimate users and nothing more.
Secure configurations
A few points on secure configurations:
- Disable unnecessary interfaces, services, and application service ports.
Trusted Operating System
An OS that meets the criteria for a Common Criteria OS Protection Profile.
