Chapter 1 Flashcards
AAA
Identification
Authentication
Authorization
Auditing
Accounting
Security Management Planning
Strategic plan - long term 5 years
Tactical plan - 1 year
Operational plan - detailed short-term to support strategic and tactical plans
Most important to do for organization, hardware, software, service acquisition
Identify risks
Security roles (CISSP)
Senior management (approve policy)
Security professional (write policy and implement)
Asset owner (responsible for protection; security classifications)
Custodian (day to day protection activities)
User
Auditor
COBIT
- security framework reference
- used for auditing
6 Principles:
1. Provide Stakeholder Value
2. Holistic Approach
3. Dynamic Governance System
4. Governance Distinct from Management
5. Tailored to Enterprise Needs
6. End-to-End Governance System
4 Domains:
1. Plan and organize
2. Acquire and implement
3. Deliver and support
4. Monitor and evaluate
SABSA
(Sherwood Applied Business Security Architecture)
Risk-driven and business focused security architecture; often used by large orgs
- Risk focused
- Business driven
- Layered approach: business context, information domain, systems, technology, physical security
- is a Framework and Methodology
- offers Certification
PCI DSS
Key components:
- Data security
- Network security
- Access control
- Regular monitoring & testing
- Info security policies
- Vulnerability mgmt
- Physical security
- Incident response planning
- Compliance audits - thru Qualified Security Assessors (QSA) or internal security assessors (ISA)
FedRAMP
(Federal Risk and Authorization Mgmt Program)
- For cloud services used by fed agencies
- To standardize security assessment, authorization and continuous monitoring of cloud products and services
Key elements:
- Security standardization
- Authorization process
- Continuous monitoring
- Reuse authorizations - from one agency to another
- Collaboration - agency, CSP, 3rd party assessor
- 3 impact levels
- Provides a Compliance framework
Due Diligence - planning
Due Care - implementing
Senior management - show due diligence and due care
Due diligence - Do detect
Due care - Do correct
Documentation review
For gov’t agencies
ATO
Security Management Plan:
Policy, Standards, Procedures, Guidelines
Policy - scope
Standards - support policy
Baseline - minimum level of security for all assets, systems, etc. must meet
Procedures - satisfy standards
Guidelines - recommendations only
Threat Modeling
- Identify
- Categorize
- Analyze
STRIDE - Microsoft, s/w development, threat categorization
PASTA - risk centric around value of assets
VAL - for agile development
STRIDE
Spoof
Tampering
Repudiation
Info disclosure
Denial of service
Elevation of privilege
PASTA
(Threat modeling)
7 stages:
Stage I: Definition of the Objectives (DO) for the Analysis of Risks
Stage II: Definition of the Technical Scope (DTS)
Stage III: Application Decomposition and Analysis (ADA)
Stage IV: Threat Analysis (TA)
Stage V: Weakness and Vulnerability Analysis (WVA)
Stage VI: Attack Modeling & Simulation (AMS)
Stage VII: Risk Analysis & Management (RAM)
Reduction analysis or decomposition of system
Diagram that shows:
Trust boundaries
Data flow
Input points
Privilege operations
Security policy
Threat modeling - Focus on threats
Risk assessment - Focus on assets
Rank threats (Threat modeling)
Probability x Damage
High/Med/Low Matrix
DREAD
DREAD
(Rank threats)
Damage potential
Reproducibility
Exploitability
Affected users
Discoverability
Security must be cost-effective
Select controls that provide most protection with lowest cost
Defense in breadth
Diversity of defense
Use range of security products from different vendors
Supply Chain Risk Mgmt
(SCRM)
SLR - requirements
SLA - agreement to satisfy requirements
Each link should be responsible and accountable to the next
SCRM should incorporate:
- silicon RoT
- PUF
- SBOM
Incorporate Silicon Root of Trust (RoT) - collection of sw and hw to ensure CIA of system’s boot process and software
- Tamper resistant
- Secure boot
- Crypto operations
- Remote attestation - allow remote entities to verify trustworthiness
PUF - physically unclonable function; hw component that creates unique signature for the electronic device or IC
SBOM - Software Bill of Materials
