Domain 3 - Security Architecture and Engineering Flashcards
Principle of split knowledge
Split knowledge means that the information or privilege required to perform an operation is divided among multiple users. example: role separation
This ensures that no single person has sufficient privileges to compromise the security of the environment. M of N Control is an example of split knowledge used in key recovery and other sensitive tasks.
key escrow arrangement, M of N Control, a cryptographic key is stored with a third party for safekeeping, requires that a minimum number of agents ( M ) out of the total number of agents ( N ) work together to perform high-security tasks. So, implementing three of eight controls would require three people out of the eight with the assigned work task of key escrow recovery agent to work together to pull a single key out of the key escrow database
Asymmetrics vs Symmetric Cryptographic System
Symmetric cryptosystems use a shared secret key available to all users of the cryptosystem.
Weakness: Key distribution is problem, not scalable, keys must be regenerated often, does not implement nonrepudiation
Asymmetric cryptosystems use individual combinations of public and private keys for each user of the system.
Weakness: Slow
Types of Ciphers
Stream > Symmetric Key cipher, plaintext combined with pseudorandom digit stream
Block Ciphers > Encrypting text to block of data at once rather than to one bit
Substitution > is a random bit string (a nonce) that same length as block size that is XORed with the message, IVs are used to create unique chipher text every time the same message is encrypted with the same key
Transposition > rearrange the letters forming ciphertext
Initialization Vector (IV) is random bit string that is the same length as the block size that is XORed with the message.
Caesar, Vigenere, One time pad : similar stream cipher, different is key length
Caesar: 1 key
Vigenere: word or sentence
One time pad: use same length as text
One time pad success factors
> Key must be generated randomly without any known pattern
Pads must be protected against physical disclosure
Each pad must be used only one time then discarded
What is zero knowledge proof?
is a communication concept, prove knowledge fact to another individual without revealing the fact itself
What is work function/factors?
measure the strength of cryptography system by measuring the effort (cost/time).
The time and effort required to break protective measure
5 basics operation on DES
DES : Data Encryption Standards is basic methods for encryption data
3DES : use DES 3 times with 2 or more different key
ECB : Electronic Codebook > Simple & Least Secure, processes 64-bit blocks, encrypt block with the chosen key, if same block encountered multiple time, same encrypted block is produces, making it easy to break
CBC : Cipher Block Chaining > Each block of unencrypted text is XORed with the block of ciphertext immediately preceeding, decrypting process simply decrypt ciphertext and reverses the XOR operation
CFB : Cipher Feedback > like CBC but in streaming mode
OFB : Output Feedback > No chaining function, XOR plaintext with seed value
CTR : Counter > uses a incrementing counter instead of seed.
XOR Cipher
Exclusive OR, Method for flipping bit
1 1 > 0
1 0 > 1
0 1 > 1
0 0 > 0
Key Clustering
A Weakness in cryptography where a plain-text message generates identical ciphertext mesages using same algorithm but using different keys, similar with collision
Asymmetric Key Types
Public keys are shared among communicating parties
Private keys are kept secret
> Data
to encrypt using public key
to decrypt using private key
> Digital Signature, provide non-repudiation
to sign a message, use you own private key.
to valid a signature, use senders public key
5 Requirements of good hash function
They must allow input of any length Provide fixed-length output Easy to compute the hash function for any input Provide one-way functionality Must be collision free
Cryptographic Salts
to prevent rainbow tables attacks
a salt is random data that used as additional input in one way function.
rainbow tables : precomputed values to identify commonly used password
Digital Signature Standard
DSS rely on public key cryptography and uses message digest function, must use SHA-2 hashing function as a standards
Work in conjuction with one of three encryption algorithms
DSA : Digital Signature Algorithm, specified in FIPS 186-4
RSA : Rivest Shamir Adleman Algorithm, specified in ANSI X9.31
ECDSA : Elliptic Curve DSA Algorithm, specified in ANSI X9.62
What is Public Key Infrastructure?
PKI certificate authorities (CA) generate digital certificates containing the public keys of system users
users then distributes certificates to people with whom they want to communicate
Certificate recipients verify a certificate using the CA’s public key
Security Traffic (data in motion)
Email : standards, using S/MIME protocol and PGP (Pretty Good Privacy)
Web : using HTTP over Transport Layer Security (TLS)
Network : using IPSec
IPSec > secure communitcation over IP. 2 secure channel, transport mode or tunnel mode. can be used to establish direct communication between computer or over a VPN connection.
2 protocol: Authentication Header (AH) > assurances of message integrity and nonrepudiation Encapsulating Security Payload (ESP) > provides confidentiality and integrity of packet contents. It provides encryption and limited authentication and prevents replay attacks.
Common Cryptographic Attacks
Brute-force attacks - randomly find the correct cryptographic text
Meet in the middle attack, exploits protocol that use 2 rounds of encryption (ex, 2DES)
Man in the middle attack, fools both parties into communicating with the attacker instead of directly with each other
Birthday attack, attempt to find collisions in hash function
Replay attack, attempt to reuse authentication request (need to use mitm to intercept request)
Digital Rights Management
Allow content owners to enforce restriction on the use of their content by others
3 Major Asymmetric Cryptosystems
RSA > founded by 1977 depends on the difficulty of factoring the product of prime numbers
El Gamal > extension of Diffie-Hellman key exchange algorithm that depends on modular arithmetic (less common than RSA)
Elliptic Curve > more secure, depends on elliptic curve discrete logarithm
What is Security Models? and list 7 security model
In information security, models provide a way to formalize security policies.
> Integrity Biba Clark-Wilson Goguen-Mesguer Sutherland
> Confidentiality
Bell-Lapadula
Take Grant
Brewer and Nash
> Secure creation and deletion of both subjects and objects
Graham–Denning Model, uses 8 primary protection
Harrison–Ruzzo–Ullman Model, assignment of object access rights to subjects as well as the resilience of those assigned rights
What is Biba model?
focused on integrity, using Mandatory Access Control, Lattice-based model
Properties:
> The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-down).
> The * (star) Integrity Property states that a subject cannot modify an object at a higher integrity level (no write-up).
> Invocation Property : No Read or Write Up (subject can never access or alter data on higher level)
What is Bell-Lapadula model?
state machine model enforce confidentiality, uses mandatory access control to enforce the DoD multilevel security policy.
prevents the leaking or transfer of classified information to less secure clearance levels
The Simple Security Property states (no read up) > subject cannot read data at a higher level of classification
The * (star) Security Property (no write down) > subject cannot write info to lower level of classification
Strong * Property > subjects can Only access data on their own level (No Read or Write UP and Down)
The Discretionary Security Property > states that the system uses an access matrix to enforce discretionary access control. restricting access to objects based on the identity of subjects and/or groups to which they belong
What is Brewer-Nash Model?
Chinese Wall, focused on confidentiality, restrict users access based on activity, prevent conflict of interest (COI). For example, once consultant access data belonging Acme Cola, they may no longer access data belonging Acme Cola competitors.
When is fire detected though technology?
Incipient stage During such hey stage air ionization takes place and specialize incipient at fire detection systems can identify the changes early
What is Confinement
Technique to ensuring CIA, Software designers use process confinement to restrict the actions of a program. Simply put, process confinement allows a process to read from and write to only certain memory locations and resources. This is also known as sandboxing
The goal of confinement is to prevent data leakage to unauthorized programs, users, or systems.
What is Bounds?
Each process that runs on a system is assigned an authority level, enforce confinement, there may be only two authority levels: user and kernel
What is Isolation?
When a process is confined through enforcing access bounds, that process runs in isolation
What is Trust and Assurance?
Trust is the presence of a security mechanism, function, or capability, on the other hand Assurance is the degree of confidence in satisfaction of security needs
What is Maintenance Hook
When developer give feature to bypass normal security function, if not removed on production environment, this really risky if attacker find a way to use maintenance hook
List Industrial Control Systems (ICS)
An industrial control system (ICS) is a form of computer-management device that controls industrial processes and machines, also known as operational technology (OT)
> distributed control systems (DCS) : used to interconnect several PLCs, but within a limited physical range, in order to gain centralized control, management, and oversight through networking
programmable logic controllers (PLC) : used to control a single device in a standalone manner
supervisory control and data acquisition (SCADA) : expanded control to large-scale physical areas to interconnect multiple DCSs and individual PLCs. For example, a PLC can control a single transformer, a DCS can manage a power station, and SCADA can oversee a power grid.
Principle of Keep it simple
is the encouragement to avoid overcomplicating the environment, organization, or product design
What is Trusted Computing Base?
design principle is the combination of hardware, software, and controls that work together to form a trusted base to enforce your security policy
security perimeter is an imaginary boundary that separates the TCB from the rest of the systems
For the TCB to communicate with the rest of the system, it must create secure channels, also called trusted paths. A trusted path is a channel established with strict standards to allow necessary communication to occur without exposing the TCB to security exploitations. A trusted shell allows a subject to perform command-line operations without risk to the TCB or the subject
reference monitor is the access control enforcer for the TCB.
The collection of components in the TCB that work together to implement reference monitor functions is called the security kernel
What is Trusted Platform Module (TPM)?
Trusted Platform Module (TPM) is both a specification for a cryptoprocessor chip on a mainboard and the general name for implementation of the specification
A TPM is an example of a hardware security module (HSM). An HSM is a cryptoprocessor used to manage and store digital encryption keys, accelerate crypto operations, support faster digital signatures, and improve authentication.
What is A constrained interface?
is implemented within an application to restrict what users can do or see based on their privileges
Principle of Zero Trust
Zero trust is a security concept where nothing inside the organization is automatically trusted
Principle of Privacy by Design (PbD)
guideline to integrate privacy protections into products during the early design phase rather than attempting to tack it on at the end of development
7 Foundational Principles:
- Proactive not reactive; preventive not remedial
- Privacy as the default
- Privacy embedded into design
- Full functionality – positive-sum, not zero-sum
- End-to-end security – full lifecycle protection
- Visibility and transparency
- Respect for user privacy
Purpose of Common Criteria?
defines various levels of testing and confirmation of systems’ security capabilities, and the number of the level indicates what kind of testing and confirmation has been performed. a subjective security function evaluation tool that uses protection profiles (PPs) and security targets (STs) and assigns an Evaluation Assurance Level (EAL).
The Common Criteria process is based on two key elements:
> Protection profiles (PPs) specify for a product that is to be evaluated (the TOE) the security requirements and protections, which are considered the security desires, or the “I want,” from a customer.
> Security targets (STs) specify the claims of security from the vendor that are built into a TOE. STs are considered the implemented security measures, or the “I will provide,” from the vendor
Kerckhoff’s Principle on Cryptography
All cryptography relies on algorithms, a concept that makes algorithms known and public, allowing anyone to examine and test them
What is Clark-Wilson Model?
focused on integrity
Separates end users from the backend data through ‘Well-formed transactions’ and ‘separation of duties’
like Biba but added Invocation Property: prohibits subject at one level of integrity from invoking a subject at higher level of integrity
protect integrity using the access control triplet, three-part relationship of subject/program/object
Separation of duties:
> the certifier of a transaction and the implementer are different entities
> the person making purchase orders should not be paying the invoice
Well-formed transaction: series of operations that transition a system from one consistent state to another consistent state
What is Take-Grant Model?
focused on confidentiality, support 4 basic operation take, grant, create, and revoke
example, a subject (X) with the grant right can grant another subject (Y) or another object (Z) any right that subject (X) possesses
What is Goguen-Meseguer Model
focused on integrity
foundation of noninterference conceptual theories
When similar users are grouped into their own domain (that is, collective), the members of one subject domain cannot interfere with the members of another subject domain. Thus, subjects are unable to interfere with each other’s activities.
What is Sutherland?
focused on integrity
preventing interference in support of integrity.
use to prevent a covert channel from being used to influence the outcome of a process or activity
What is Graham-Denning Model?
focused on the secure creation and deletion of both subjects and objects
uses 8 primary protection
- securely create an object
- securely create an subject
- securely delete an object
- securely delete an subject
- securely provide the read access right
- securely provide the grant access right
- securely provide the delete access right
- securely provide the transfer access right
What is Harrison–Ruzzo–Ullman Model?
extension of Graham-Denning Model, but focuses on the assignment of object access rights to subjects as well as the resilience of those assigned rights
6 primitive operation: > create object > create subject > destroy object > destroy subject > enter right into access matrix > delete right into access matrix
What is open and closed systems
Open systems are designed using industry standards and are usually easy to integrate with other open systems. Closed systems are generally proprietary hardware and/or software. Their specifications are not normally published, and they are usually harder to integrate with other systems.
Principle of secure default
Never assume that the default settings of any product are secure
What is Fail Securely?
form of Error handling, programmer codes in mechanisms to anticipate and defend against errors in order to avoid the termination of execution
Difference between confinement, bounds, and isolation
Confinement restricts a process to reading from and writing to certain memory locations. Bounds are the limits of memory a process cannot exceed when reading or writing. Isolation is the mode a process runs in when it is confined through the use of memory bounds.
What is state machine model, information flow model, and noninterference model?
> The state machine model ensures that all instances of subjects accessing objects are secure.
> The information flow model is based on SMM, designed to prevent unauthorized, insecure, or restricted information flow.
> The noninterference model prevents the actions of one subject from affecting the system state or actions of another subject.
What is Authorization to Operate?
Authorization to Operate (ATO) (from the RMF) is a formal approval to operate IT/IS based on an acceptable risk level based on the implementation of an agreed-on set of security and privacy controls.
4 Security Mode
can be MAC or DAC,
Signed NDA, Proper clearance, Formal access approval and need to know
> Dedicated Mode
All users can access ALL data.
> System High Mode
All users can access SOME data, based on their need to know.
> Compartmented Mode
All users can access SOME data, based on their need to know and formal access approval.
> Multilevel Mode
All users can access SOME data, based on their need to know, clearance and formal access approval
What is Reference Monitor and Security Kernel?
Reference Monitor : enforce access control, logical part of TCB that confirm whether a subject has the right to use a resource prior to granting access
Security Kernel : Implement Access Control, collection of TCB component that implement the functionality of reference monitor
What is TCSEC and ITSEC?
predecessor of Common Criteria,
TCSEC (trusted computer system evaluation criteria) : set of criteria for evaluating computer security
ITSEC (Information Technology Security Evaluation Criteria) : initial attempt to create security evaluation criteria in Europe
What is covert channel?
a method that is used to pass information over path that is not normally used for communication
> may not be protected by system’s normal security control
Covert Timing : conveys information by altering the performance of a system component or modifying a resource’s timing in a predictable manner
> Blinking a light visible outside the building so that if a reading is taken every two seconds when the light is on count it as a 1 and when the light is off count it as a 0. With an external camera linked to a recording system, a slow transmission of binary data can occur.
Covert Storage : conveys information by writing data to a common storage area where another process can read it. When assessing the security of software, be diligent for any process that writes to any area of memory that another process can read.
> Writing data directly into a bad sector of an HDD or a bad block on an SSD
What is mandatory access control?
Enforces an access policy that is determined by the system, not the object owner, relies on classification tables
> every object and every subject has one or more labels, these labels is predefined and system determines access based on assigned labels
Requirement rule
Hierarchical environment
various classification labels are assigned in an ordered structure from low security to medium security to high security
Compartmentalized environment
requires specific security clearances over compartments or domains instead of object
Hybrid environemnt
Contains levels with compartments that are isolated from the rest of the security domain. Combines both hierarchical and compatrtmentalized environment so that security levels have subcompartments
What is Layering?
creates different realms of security within process and limits communication between them
What is Discretionary Access Control?
permits the owner or creator of an object to control and define its accessibility, because the owner has full control by default
What is non-discretionary Access Control?
enables the enforcement of system-wide restriction that override object-specific access control
What is rule-based access control?
Defines specific function for access to requested objects, commonly found in firewall systems
What is role-based access control?
uses well defined collection of named job roles, to endow each one with specific permission
What is Certification, Verification, Validation and Accreditation
Certification: Technical Evaluation of each part of computer system to access its agreement and alignment with security standards
Accreditation: The process of formal acceptance of certified configuration from designated authority
Verification - checking to make sure a system meets the stated requirements (did we build the thing right?)
Validation - checking to make sure the system (or whatever is being validated, security control, etc.) meets the original needs that it was intended to meet. (Did we build the right thing).
