CH 4 Host Security

Question 1

Access Control List (ACL)

Answer 1

..Work from the top down

. Implicit deny clause at the end

Question 2

Host-based firewalls

Answer 2

.Adds defense-in-depth by creating another layer of controls

.Inspects and controls inbound and outbound traffic from host where installed

Question 3

Persistent Agents

Answer 3

.Always on.

.Performs compliance and authentication before allow system to have network access.

Question 4

Non-persistent agents

Answer 4

.Do not run continuously.

.Check the systems and terminate the process

Question 5

Trusted Operation System

Answer 5

.One that has implemented sufficient controls to support multilevel security
.Can handle information at different security levels

Question 6

Common Criteria

Answer 6

. Examines different areas (physical, logical) of the trusted OS to establish an evaluation assurance level (EAL).

EAL 0: Inadequate assurance
EAL 1: Functionally tested
EAL 2: Structurally tested
EAL 3: Methodically checked and tested
EAL 4: Methodically designed, tested and reviewed
EAL 5: Semi-formally designed and tested
EAL 6: Semi-formally verified, designed, and tested
EAL 7: Formally verified, designed and tested

Question 7

Trusted OS Basic Attributes

Answer 7

. Hardware protection - secure HW
. Long-term storage protection - storage protection that lasts across power cycles and other events
. Isolation - Able to isolate programs
. Separation of User Processes from Supervisor Processes

Question 8

Trusted Computer Base

Answer 8

.The sum of all the protections mechanisms withing a computer
. Is responsible for enforcing computer policies
. HW, SW, controls process.

Question 9

Bell-LaPadula Security Model

Answer 9

. Confidentiality is the primary focus
. Subject must clear and meet or exceed the information classification level
> Simple Security
. NO READ UP - not allow to read information at a higher classification level

> Star
. NO WRITE DOWN - a subject at one information level is not allows to write information to a lower level of confidentiality

> Strong Star Security - subject cannot write up or read down.

Question 10

Biba Security Model

Answer 10

. Integrity is the primary focus
> Simple Integrity
. NO READ DOWN - subject at one level of integrity is not permitted to read as object of lower integrity

> Start Integrity - an object at one level of integrity is not permitted to write to an object of higher integrity.

> Invocation - prohibits a subject at one level from invoking a subject at a higher level of integrity

Question 11

Clark - Wilson Security Model

Answer 11

. Capability-based security

. Data can only be manipulated in a way that protects consistency

Question 12

Brewer- Nash

Answer 12

.Chinese wall
.Designed to prevent conflicts of interest.
Subject working one one side of the wall cannot see data on the other side of the wall.

Question 13

Clearances

Answer 13

Government: Top Secret - Secret - Unclassified

Private: Restricted - Private - Public

Question 14

Least Functionality Control

Answer 14

Organization configures the IS to provide only essential capabilities and specifically prohibits and /or restricts the use of these functions to certain users.

Question 15

Incremental Attacks

Answer 15

. Goal is to make changes slowly over a long period of time in hopes of remaining undetected.
> Data Diddling- small changes to databases

> Salami Attack - small changes to financial records

Question 16

Heuristic

Answer 16

behavior

Question 17

Multipartite Infectors

Answer 17

Target both boot records and programs

Question 18

Polymorphic viruses

Answer 18

.Change their signature every time they replicate and infect a new file.

. Makes it much harder for AV to detect the virus.

Question 19

Host hardening

Answer 19

Series of steps carried out to remove unwanted services and features for the purpose of making it harder for an attacker to attack a computer successfully

Question 20

Warning banners

Answer 20

Crucial in that they warn the user about specific activity or behavior that may or may not be allowed.

Question 21

IDS/ IPS Types

Answer 21

.Signature Recognition
.Anomaly detection
.Protocol decoding - 
 >Uses models based on the TCP/IP stack
 >Has the ability to reassemble packets to look for high-level activity.

Question 22

Command shell restrictions

Answer 22

Restricting users access to the command prompt in order to tighten security.