Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Software security > Authorization > Flashcards

Authorization Flashcards

1
Q

What are the layers of access control? (5)

A

Policy

Model

Mechanism

Awareness

Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the Policy-layer of access control?

A

High-level rules, what is and is not allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the Model-layer of access control?

A

Formal representation of the policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the Mechanism-layer of access control?

A

Low-level implementation of the model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the Awareness-layer of access control?

A

Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the Management-layer of access control?

A

Operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is priivilege creep?

A

People end up with more access than necessart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the technical layers of access control?

A

Application

Middleware

OS

Hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Name some access control models

A

DAC: Discretionary Access Controll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is DAC: Discretionary Access Controll

A

The owner of a resource decides how it is shared

The owner chooses to give read, write or other access to other users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an access control matrix?

A

X-axis: Resource (file, program, etc.)
Y-axis: User

Entry: Permissions (own, read, write, execute, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an authorization table?

A

A mechanism to implement access control matrices.

Pick non-empty entries in the access control matrix to create a list. This list is the authorization table.

From Access control matrix:

      File 1.        File 2.       File 3.      Program 1 Ann.  Own.         Read                         Execute
      Read.         Write
      Write

Authorization table entry:
User - Access Mode - Object
Ann Own. File 1
Ann Read File 1
Ann Write File 1
Ann Read File 2
Ann Write File 2
Ann Execute Program 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Where are authorization tables used?

A

Database management systems (DBMS): Software systems used to store, retrieve, and run queries on data

The tables are stored as relational tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are access control lists (ACL)

A

Another mechanism to implement access control matrices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe Access control list (ACL)

A

Stores information according to objects (file 2, Program 1, etc.), stores column.

From access control matrix:
Program 1
Ann. Execute

Bob.

Carl. Execute
Read

ACL’s stores each object in a file 1 with the structure:

File 1-> Ann
Execute
-> Carl
Execute
Read

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Where are ACL’s used?

A

In modern OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Give an example of how ACLs are used

A

Linux: ls -l

rexre—

18
Q

What does rwxrw—- mean in linux?

A

rwx: Owner can read, write and execute

rw-: User’s in the owner’s group can read and write

—: Users outside the group cannot read, write or execute

19
Q

What is capabilities?

A

The third mechanism to implement access control matrices

20
Q

Describe Capabilities

A

Stores information according to the subject: matrix row

      File 1.         File 2.         File 3           Program 1 Bob.  Read.                             Read
                                              Write

Bob -> File 1
read
-> File 3
read
write

21
Q

Where is Capability used?

A

iOS permission control

Data is segregated into classes (contacts, calendar, photos, etc.)

Only allow basic permission at installation

At runtime, app must ask user to get permissions

22
Q

What is a vulnerability of DAC?

A

Does not distinguish between user and process

Vulnerable to a process executing malicious programs (trojan horse), exploiting the authorization of the user.

23
Q

Give an example scenario of using a Trojan horse

A

Hacker: Creates file steal.txt and gives CEO permission to write it, without the CEO’s knowledge

Two hidden operations (Trojan horse) is added to the CEO’s app. One operation reads the steal.txt file, the other operation writes to it.

CEO executes the app. The app executes on behalf of the CEO (Access control only checks the user, it does not check the process). Reading and writing to the secret file is allowed, without the CEO’s knowledge.

24
Q

What is Mandatory Access Control? (MAC)

A

A system enforces a security policy independent of the user’s action. Enforces access control on the basis of regulations mandated by a central authority.

Access class is assigned to each object and subject.

25
Q

What are the types of Object classificaion?

A

TOP SECRET
SECRET
CONFIDENTIAL
UNCLASSIFIED

26
Q

What are the types of Subject classification?

A

TOP MANAGER
MIDDLE LEVEL MANAGER
EMPLOYEE
GENERAL PUBLIC

27
Q

What is the Bell-LaPadula model?

A

A state machine model used for enforcing access control.

Main focus: enforce confidentiality, only allows operations on the same level

No read up (NRU)
No write down (NWD)

28
Q

What is the Biba model?

A

Another state machine used to enforce access control.

Main focus: Enforce integrity

No read down (NRD)
No write up (NWU)

29
Q

Why is the Biba model useful for integrity?

A

No improper modification of high integrity objects from low classified subjects. E.g. a downloaded software cannot write to the OS.

High integrity objects are not contaminated because they do not read lower-level data, which can be unreliable.

30
Q

How can Bell-LaPadula and Biba be combined?

A

Combined when we want integrity and confidentiality.

Objects and subjects have to be assigned two access classes:
- One for confidentiality control
- One for integrity control

31
Q

What are the pros and cons of MAC?

A

Pros:
- Strict control over information flow
- Strong exploit containment

Cons:
- Cumbersome administration

32
Q

What are the pros and cons of DAC?

A

Pros:
- Simple and efficient access right management
- Scalability

Cons:
- Weak control over information flow

33
Q

What is Role-Based Access Control? (RBAC)

A

Based on the idea of assigning permissions to users based on their roles. Analyses needs of users, and group them intro roles based on the same responsibilities and needs.

More manageable approach to access management that is less prone to error than assigning permissions to users individually.

34
Q

What are some benefits of RBAC?

A

Easy authorization management

Maps to real-world role hierarchy

35
Q

What is attribute-Based Access Control? (ABAC)

A

Access control model that evaluates attributes (characteristics) rather than roles, to determine access.

Each user has a set of attributes

36
Q

What access control model is used for coarse-grain access control?

A

RBAC

37
Q

What access control model is used for fine-grain access control?

A

ABAC, but this is more difficult to use correctly

38
Q

How should RBAC and ABAC be combined?

A

RBAC before ABAC

Decide who can see what module, BEFORE deciding what they can see inside a module

39
Q

What is the Browser Same-origin policy?

A

Only communicate with the IP you originated from

40
Q

when does two URLs have the same origin?

A

Protocol, port and host are the same

41
Q

What is a Sandbox?

A

Restricted environment, separates running programs so that they are unable to affect other applications.

Software security (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions