Chapter 9: Cybersecurity and Privacy

Question 1

Provide examples of security failures that can result in a privacy breach

Answer 1

Unpatched software bugs
Poorly configured security mechanisms
Reuse of credentials

Question 2

List the NICE framework security categories

Answer 2

• Securely provision
• Operate and maintain
• Protect and defend
• Investigate
• Analyze
• Oversee and govern
• Collect and operate

Question 3

What does securely provision encompass within the NICE framework?

Answer 3

The tasks narrowly focused on developing software to be secure

Question 4

What does operate and maintain encompass within the NICE framework?

Answer 4

The operation and maintenance of a system is just as critical to its security and privacy goals as the way the system is created in the first place

Other aspects of operating a system as defined by the NICE framework include systems analysis, which examines the interoperation of an organization’s systems, and knowledge management, which focuses on the processes and tools for ensuring that an organization can keep track of the systems it has created and how to operate them

Question 5

What does protect and defend encompass within the NICE framework?

Answer 5

Part of attempting to ensure that a system will not be compromised is actively protecting the system

This includes vulnerability assessment and management

Question 6

What does investigate encompass within the NICE framework?

Answer 6

(1) discovering what specific data may have been compromised
(2) discovering the specific method of compromise
(3) identifying who perpetrated an attack

Question 7

What infrastructure can be used to protect and defend?

Answer 7

Firewalls that prevent malicious network traffic and monitoring systems that make it possible to detect attacks

Question 8

What is cyber defense analysis?

Answer 8

Using defensive components to prevent or detect attacks

Question 9

What is incident management?

Answer 9

It is the process of documenting the details of the attack, determining the impact of the attack on the system and then deciding on the appropriate actions

Question 10

What are software vulnerabilities?

Answer 10

The software bugs that an attacker can take advantage of to carry out an attack

Not every bug is a vulnerability

Question 11

How does malware get on a computer?

Answer 11

Malware is installed on a victim user’s computer either by the exploitation of a software vulnerability or at a time when the attacker has unfettered access to the computer—for example, when software is being loaded onto the computer before the computer is sold

Question 12

What do you call malware that has modified system functions to disguise itself?

Answer 12

Rootkit

Question 13

What is a bot-net?

Answer 13

When malware coordinates with command-and-control servers to put large sets of computers under the control of a single organization; such a set of computers is called a botnet, and each of the infected computers a bot

Question 14

How do bot-nets mount distributed denial-of-service (DDoS) attacks?

Answer 14

The computers that are part of a botnet are instructed to connect to or interact with a victim server; if the botnet is large enough, the victim server may be overwhelmed with requests and crash

Question 15

What is phishing?

Answer 15

A type of social engineering attack in which a victim is tricked into logging in to what they think to be a legitimate site

Question 16

What is spear phishing?

Answer 16

Attackers customize their messages to include personal information they have already uncovered about the victim

Question 17

What is whaling?

Answer 17

Spear phishing attacks directed at high-value individuals

Question 18

Define the confidentiality property

Answer 18

Refers to keeping sensitive data away from unauthorized users, including attackers
Also called secrecy

Question 19

Define the integrity property

Answer 19

Refers to preventing unauthorized modification of data, which could include replacing a correct value with an incorrect one or deleting data

Question 20

Define the availability property

Answer 20

Focuses on ensuring that computer systems are available to legitimate users even when they are under attack

Question 21

What are the 2 major parts of access control?

Answer 21

Authentication

Authorization

Question 22

Define the authentication step in access control

Answer 22

Determining the identity of the user who is attempting to access a resource

Question 23

Define the authorization step in access control

Answer 23

Determining whether a request to access a resource (typically, but not always, by an authenticated user) should be granted

Question 24

What does authorization consist of?

Answer 24

Mechanism - technical means for allowing or denying access

Policy - specification of who should be allowed or denied which kind of access and under what circumstances

Question 25

List the different access control models

Answer 25

Access-control lists (ACL)
Role-based access control (RBAC)
Attribute-based access control (ABAC)
Policy-based access control (PBAC)

Question 26

How do access-control lists (ACL) work?

Answer 26

Every object is annotated with a list of the subjects who are allowed to access it, as well as the type of access that they are allowed

Question 27

How do RBAC work?

Answer 27

Specifies who is allowed access in terms of roles

Question 28

How do attribute-based access control (ABAC) and policy-based access control (PBAC) work?

Answer 28

Allows access-control policy to be specified in terms of attributes that could describe users, objects or properties of the environment

For example, the policy “Charlie is allowed to access sensitive files related to his projects only from the corporate network, but may access nonsensitive files related to his projects from anywhere” might use roles to give Charlie access to specific projects and attribute-based rules to capture the constraint that sensitive files should be accessible only from the corporate network

Question 29

What 2 methods exist to control who makes changes to access levels?

Answer 29

Mandatory access control (MAC)

Discretionary access control (DAC)

Question 30

How does mandatory access control (MAC) work?

Answer 30

Policy is set by administrators; users have no ability to change the policy, even for their own data

Question 31

How do discretionary access control (DAC) work?

Answer 31

Allows users to change the access-control policies for the data they own

Question 32

What is federated identity management?

Answer 32

The practice of outsourcing authentication not just to a different service within an organization, but to a different organization
AKA single sign-on

Question 33

In federated identity management, what do you call the service that authenticates users?

Answer 33

The identity provider (IdP)

Question 34

In federated identity management, what do you call the services that rely on the IdP to authenticate users?

Answer 34

Service providers (SPs)

Question 35

How can IdPs be used to increase privacy?

Answer 35

They can store personal information in addition to authentication data
For example, if a service only cares that users are at least 18 years old, then the identity provider’s assertion to the service provider could include just this information, without any additional information about the user’s identity

Question 36

What are the advantages of federated identity management?

Answer 36

Users no longer have to remember multiple sets of authentication credentials
Service providers are relieved of the burden of implementing authentication and protecting user’s authentication information

Question 37

What are the risks of federated identity management?

Answer 37

Every time a service provider needs to authenticate a user, the identity provider will be consulted; hence, the identity provider learns all the service providers each user visits as well as in what order, at what times of day and from what locations

Question 38

What is cross-enterprise authentication and authorization?

Answer 38

Two enterprises may each run their own identity provider, primarily intended to authenticate users within each enterprise. For business reasons, however, the two (or more) enterprises may decide to trust each other’s identity providers

Question 39

List the 7 principles for building and operating systems to be more secure

Answer 39

Economy of mechanism
Open design
Complete mediation
Least privilege
Multiple layers of defense
Psychological acceptability
Safe defaults

Question 40

Describe the economy of mechanism principle for building and operating systems to be more secure

Answer 40

A simpler mechanism is less likely to have flaws than a more complex one

Question 41

Describe the open design principle for building and operating systems to be more secure

Answer 41

The defender should not rely on the details of their security mechanisms remaining secret from the attacker—also called security by obscurity—as a means to keep their system secure

The open-design principle does not unequivocally point to using open-source software; it merely asserts that if closed-source software is used, then it should not be considered more resistant to attack merely because the attacker cannot readily access it

Question 42

Describe the complete mediation principle for building and operating systems to be more secure

Answer 42

Achieved when every avenue by which a resource can be accessed is protected by a security check (putting a lock on every door of the house)

Also implies that access-control policy must be carefully protected so that, for example, a user who is not authorized to change a file also cannot change the policy so as to allow themselves to change the file

Question 43

Describe the least privilege principle for building and operating systems to be more secure

Answer 43

Any user, computer system or component of a computer system should have only the privileges it needs to do its job, and no more

Question 44

Describe the multiple layers of defense principle for building and operating systems to be more secure

Answer 44

System should be protected redundantly or with complementary mechanisms that are unlikely to be all compromised by the same attack

Question 45

Describe the psychological acceptability principle for building and operating systems to be more secure

Answer 45

Security mechanisms that make unreasonable demands on the users—on their attention, their knowledge, or their ability—are likely to fail

Question 46

Describe the safe defaults principle for building and operating systems to be more secure

Answer 46

Systems should be configured to provide security out of the box, without any intervention

Systems that fail to do so run the risk of being attacked before they are reconfigured to be more secure; they also encourage users to leave them in an unsafe default state, since that may be more convenient for users, who may not have sufficient awareness of the consequences