9. Cybersecurity and Privacy Flashcards
NICE (National Initiative for Cybersecurity Education)
One taxonomy of computer security work, i.e., of the tasks that need to be accomplished to keep computer systems secure, is advanced by NIST’s NICE framework. The NICE framework divides computer security work into the following categories:
SECURELY PROVISION: “Securely provision. This category encompasses the tasks narrowly focused on developing software to be secure. Software development starts with system requirements planning, during which both security and privacy requirements must be defined. These are drawn from various stakeholders, such as potential customers, and may include legal and regulatory considerations.
OPERATE AND MAINTAIN
PROTECT AND DEFEND
Protecting and defending systems, as well as operating and maintaining them, involves tradeoffs between privacy and security, one of which relates to how much data is collected about how an application, a system or a network is used. Collecting more data may make it possible to detect attacks that might otherwise remain hidden and to better diagnose why a system did not perform as expected. In doing so, collecting more data may make it possible to make systems more secure, and so indirectly lower privacy risks associated with security breaches. On the other hand, collecting detailed usage information itself increases privacy risks, for example, for users whose detailed behavioral information is now stored and could be misused or lost, as well as to the organizations that take on the risks associated with safeguarding this information.
INVESTIGATE
OVERSEE AND GOVERN This category of work deals with aspects of cybersecurity work such as legal advice, executive leadership and training and education.
COLLECT, OPERATE AND ANALYSE
These two areas of work deal with the collection of “intelligence”: information about potential attackers’ capabilities, intentions and possible ongoing activities. Activities in these work areas inform activities in the other work areas. For example, if an attack seems likely, then the level of effort invested into protecting and defending might increase, or the requirements might reflect that a system needs to be constructed to be more robust to attacks.
—all of which can be thought of as focusing on a specific computer system—and analyze, oversee and govern, and collect and operate, all of which generally have a broader scope.
Software vulnerability
The software bugs that an attacker can take advantage of to carry out an attack are called software vulnerabilities. Not every bug is a vulnerability.
Buffer overflow
A buffer is a contiguous area in the memory used by a program. When copying data into a buffer, it is important to make sure that the data is smaller than the buffer. If the data being copied into the buffer is bigger than the buffer, and appropriate checks to detect this are not in place, then the data that does not fit in the buffer may overwrite memory immediately next to the buffer—hence the name buffer overflow. If the attacker is able to control the data being copied into memory, they may be able to choose how memory is overwritten in a way that allows them to alter the intended behavior of the program. With enough sophistication, such alterations can give attackers the ability to execute arbitrary code on the victim machine.
Input Validation Flaw
Software often receives input from untrusted sources that it uses to guide its computation. For example, a search engine allows a user to type in a search string; that string is an input to the program that implements the search functionality. If this input string contains characters or sequences of characters the program is unprepared for, it might execute unexpectedly. Common types of attacks that take advantage of input-validation flaws are buffer overflow attacks, described above, and cross-site scripting (XSS) and structured query language (SQL) injection attacks.
Cross site scripting (XSS) attack
XSS attacks take advantage of input-validation flaws in a website or web application to inject code into a user’s web browser, which can then take any data available to a legitimate user and send it to the attacker. XSS was allegedly responsible for a 2018 breach of the British Airways website that led to the theft of financial and personal data belonging to 380,000 customers.
SQL Injection Attack
In SQL injection, specially crafted inputs, unexpected by the application, cause database queries to go awry. An SQL injection attack was responsible for the theft over 100 million debit and credit card numbers from Heartland Payment Systems in 2012, which was at the time the biggest data breach ever.
Malware
Malware, malicious programs designed by the attacker. Malware is installed on a victim user’s computer either by the exploitation of a software vulnerability or at a time when the attacker has unfettered access to the computer.
Keylogger
Keyloggers, for example, are a type of malware that records a user’s keystrokes, including when typing usernames and passwords.
Rootkit
Malware often changes the behavior of a computer system so as to avoid being detected; such malware is commonly called a rootkit. Because they are hard to detect, rootkits can run on an infected computer for a long time, potentially stealing user information or using the computer for nefarious purposes, such as distributing spam.
Botnet
Malware sometimes coordinates with command-and-control servers to put large sets of computers under the control of a single organization; such a set of computers is called a botnet, and each of the infected computers a bot.
DDoS (Distributed Denial of Service)
“distributed denial-of-service (DDoS) attacks, in which the computers that are part of a botnet are instructed to connect to or interact with a victim server; if the botnet is large enough, the victim server may be overwhelmed with requests and crash.
Misconfiguration
Sometimes, one of several security mechanisms is misconfigured, which doesn’t leave the system or its data completely exposed but makes it easier for an attack to succeed.
Confidentiality
Confidentiality, also called secrecy, refers to keeping sensitive data away from unauthorized users, including attackers.
Access-control list
“One approach for specifying access-control policy is using access-control lists (ACLs). In this approach, every object is annotated with a list of the subjects who are allowed to access it, as well as the type of access that they are allowed. The subjects could be identified individually, but they could also be consolidated into groups, such as administrators. In this case, the group name is used as the subject, and a separate specification describes which individuals belong to which groups. Modern versions of Linux generally support ACLs.
RBAC
Role-based access control (RBAC), specifies who is allowed access in terms of roles. A user may be associated with a number of roles.
