Domain 3 Flashcards
Characteristics of Biba Model
All about Integrity Write down, read up STAR Integrity Simple Integrity Property Invocation Property
Characteristics of Bell Lapadula Model
All about Confidentiality Write up, read down Star Property Simple Property Strong STAR
Types of Fire Extinguishers
Class A. Common Combustible B. Liquid C. Electrical D. Metal
What is the State Machine Security Model
Based on Finite State Machine
Map out the finite possible operational outcomes
verify that all
Common Security Models
MATRIX - (Access Control) Bell - Lapadula (Confidential control) Biba (Integrity Control) Information Flow Model Clark Wilson (Integrity Model) Multi Level Lattice
Information Flow Model
Extends The State Machine Model
Finite State Machine; you specify well defined paths for information to flow on those paths
Uses lots of reference monitors
Non-Interference Model
Make sure objects and subjects are not affected on the level you’re at
Mandates that there is a hierarchy of levels
MATRIX Model
Provides Access rights
Matrix to match users to privileges
Clark Wilson Model
Integrity Model
Invented “Triple Security” which is now know as reference modeling
Very Commercial
Dictates
-Separation of Duties
- subjects access DTA through arbiter app
- Heavy Auditing Requiring
Brewer Nash (Chinese Wall)
Stopping conflicts of internet problems
poster child of where BN should have been used in Arthur Anderson in Houston
Graham Denning
Integrity and Confidentiality
Assigns
Cloud Types
Public (AWS or AZURE)
Private (Data Center)
Community (Group of students sharing a space)
Hybrid (Hosting your website to public on private cloud
Deployment Models
IaaS (provide your own software)
PaaS (cloud provider uses software and your software)
SaaS ( All software is Cloud providers)
Traits of Cloud
Rapid Elasticity On Demand Self Service Metered Service Broad Network Access Resource Pooling
Cloud Security Issues
Lose controls over security implementation
All security actions must be documented and put in contract BEFORE signing
Who is cloud provider, need to trusted
Limited authentication capabilities
Lack of Access to logs
Cryptography Goals
P.A.I.N.
Privacy (confidentiality)
Authentication
Integrity
Non-repudiation
Types of Security Models
State Machine Models Multi Lattice Models Matrix Models noninterference Models Information Flow Models Confinement Data in Use
List the 7 EAL levels
Common Criteria Assurance Level
EAL 1 Functionally tested
EAL 2 Structurally tested
EAL 3 Methodically tested and checked
EAL 4 Methodically designed, tested and reviewed
EAL 5 Semi-formally designed and tested
EAL 6 Semi-formally verified design and tested
EAL 7 Formally verified design and tested
Define Certification
evaluation of security and technical/non-technical features meet requirement (verify it does what it says it does)
Define Accreditation
Declare that an IT system is approved to operate in predefined conditions (verify it is right for out system, network)
Use of Cryptography
Confidentiality Integrity Proof of Origin Non-repudiation Protect Data at Rest Protect Data in Motion
What is the Orange Book
Collection of criteria based on the Bell-Lapadula Model used to grade or rate the security offered by a computer system product.
Trusted Computer System Evaluation (TCSEC)
Evaluates OS, application and system.
What is Green Book
Password Management
What is Red Book
Similar to Orange book, but addresses network Security
Chain of Custody
Important to Maintain to prove integrity of evidence to be admissible in court
