BOOK: Ch 1, 3, 4 & 5 Flashcards
Takes place when one entity pretends to be a different entity
A Masquerade
Limit information system access to authorized users, processes acting on behalf of authorizedusers, or devices (including other information systems) and to the types of transactions and functions thatauthorized users are permitted to exercise.
Access Control
Means that every access must be checked against theaccess control mechanism.
Complete mediation
Means that the design of a security mechanism should be openrather than secret. For example, although encryption keys must be secret, encryptionalgorithms should be open to public scrutiny.
Open Design
Can be viewed as a specific form of isolation based on object-oriented functionality.
Encapsulation
In the context of security refers both to the development of securityfunctions as separate, protected modules and to the use of a modular architecturefor mechanism design and implementation.
Modularity
Is a branching, hierarchical data structure that represents a set of potential techniques for exploiting security vulnerabilities
Attack Tree
In this type of attack, the attacker is able to interceptcommunication between the UT and the IBS.
Injection of Commands
Deals with computer-related assets that are subject to a variety of threats and for whichvarious measures are taken to protect those assets.
Computer Security
In the nature of eavesdropping on, or monitoring of, transmissions.The goal of the attacker is to obtain information that is being transmitted.
Passive Attacks
Involve some modification of the data stream or the creationof a false stream and can be subdivided into four categories: replay, masquerade,modification of messages, and denial of service.
Active Attacks
Four means of authenticating a user’s identity.
- Something the individual knows.2. Something the individual possesses.3. Something the individual is (static biometrics). [Retina, fingerprint]4. Something the individual does (dynamic biometrics). [voice pattern, typing rhythm]
How are hashed passwords are implemented?
The password and salt serve as inputs to ahashing algorithm to produce a fixed-length hash code. The hash algorithm isdesigned to be slow to execute in order to thwart attacks. The hashed passwordis then stored, together with a plaintext copy of the salt, in the password file forthe corresponding user ID.
Biometric Enrollment, Verification and Identification
- Each individual who is tobe included in the database of authorized users must first be enrolled in the system. This is analogous to assigning a password to a user.2. Verification is analogous to a user logging onto a system by using a memory card or smart card coupled with a password or PIN.3. The individual uses the biometric sensor butpresents no additional information. The system then compares the presented templatewith the set of stored templates.
Challenge-Response Protocol
In this case, the computer system generates a challenge, such as a random string of numbers. The smart token generates aresponse based on the challenge.
