Chapters 1, 3, 4, 5 Flashcards
Takes place when one entity pretends to be a different entity
A Masquerade
Limit information system access to authorized users, processes acting on behalf of authorized
users, or devices (including other information systems) and to the types of transactions and functions that
authorized users are permitted to exercise.
Access Control
Means that every access must be checked against the
access control mechanism.
Complete mediation
Means that the design of a security mechanism should be open
rather than secret. For example, although encryption keys must be secret, encryption
algorithms should be open to public scrutiny.
Open Design
Can be viewed as a specific form of isolation based on object-oriented functionality.
Encapsulation
In the context of security refers both to the development of security
functions as separate, protected modules and to the use of a modular architecture
for mechanism design and implementation.
Modularity
Is a branching, hierarchical data structure that represents a set of potential techniques for exploiting security vulnerabilities
Attack Tree
In this type of attack, the attacker is able to intercept
communication between the UT and the IBS.
Injection of Commands
Deals with computer-related assets that are subject to a variety of threats and for which
various measures are taken to protect those assets.
Computer Security
In the nature of eavesdropping on, or monitoring of, transmissions.
The goal of the attacker is to obtain information that is being transmitted.
Passive Attacks
Involve some modification of the data stream or the creation
of a false stream and can be subdivided into four categories: replay, masquerade,
modification of messages, and denial of service.
Active Attacks
Four means of authenticating a user’s identity.
- Something the individual knows.
- Something the individual possesses.
- Something the individual is (static biometrics). [Retina, fingerprint]
- Something the individual does (dynamic biometrics). [voice pattern, typing rhythm]
How are hashed passwords are implemented?
The password and salt serve as inputs to a
hashing algorithm to produce a fixed-length hash code. The hash algorithm is
designed to be slow to execute in order to thwart attacks. The hashed password
is then stored, together with a plaintext copy of the salt, in the password file for
the corresponding user ID.
Biometric Enrollment, Verification and Identification
- Each individual who is to
be included in the database of authorized users must first be enrolled in the system. This is analogous to assigning a password to a user. - Verification is analogous to a user logging on
to a system by using a memory card or smart card coupled with a password or PIN. - The individual uses the biometric sensor but
presents no additional information. The system then compares the presented template
with the set of stored templates.
Challenge-Response Protocol
In this case, the computer system generates a challenge, such as a random string of numbers. The smart token generates a
response based on the challenge.
