ChatGPT Introduction Flashcards
What is the first principle of secure systems?
Secure systems do not exist: all systems have vulnerabilities due to bugs, design flaws and human errors. Security is about MINIMIZING risks.
What determines the security level of a system?
The time, money and resources required to break the system, and probability of success.
Why does complexity reduce security?
More complexity increases vulnerabilities, as errors in design, implementation, or usage are more likely.
What is the KISS rule in security design?
Keep it Simple and Stupid: Simplify protection mechanisms to reduce potential vulnerabilities.
What are the three entities composing a system?
Software, hardware and humanware.
Why is software a critical part of system security?
It has a large exposed attack surface, can be accessed remotely, and often contains vulnerabilities.
What is firmware?
Piece of software embedded in hardware to control its functionality - and can be modified by attackers.
What is the Evil Maid Attack?
A physical attack where an unauthorized person tampers with a device, such as flashing a modified firmware.
*Flashing firmware is updating it
Why is humanware often the weakest link in security?
Humans are vulnerable to fatigue, social engineering, bad habits and lack of knowledge.
What is social engineering?
Manipulating individuals into divulging confidential information (phishing)
Why is security considered a process, not a product?
What is considered secure today may not be secure tomorrow, must constantly update, monitor and adapt to address emerging threats.
What challenges are associated with updating systems?
May not be available for all devices, can introduce new bugs (which can be vulnerabilities), and require careful cost/benefit evaluation.
What does Kerckhoffs’s Principle state?
A cryptosystem should be secure even if everything about the system is public except the key.
What is Shannon’s Reformulation of Kerckoffs’s Principle?
The enemy knows the system, rely on robust design not secrecy!
What is Security Through Obscurity, and why is it flawed?
Relying on a closed system for security, flawed because they are not audited regularly by public communities for vulnerabilities.
