Domain 3 - Security Architecture and Engineering Flashcards
Zero Trust Security
○ Addresses limitations of legacy network perimeter-based security model
○ Treats user identity as the control plane
Assumes compromise/ breach in verifying every request, no entity is trusted by default, verify identity, manage device, manage apps, protect data
Secure defaults (secure design principles)
default configuration reflects a restrictive and conservative enforcement of security policy, taken from NIST 800-160
Fail securely (secure design principles)
default configuration reflects a restrictive and conservative enforcement of security policy, taken from NIST 800-160
Trust but verify (secure design principles)
depends on initial authentication process to gain access to the internal “secured” environment then relied on generic access control methods, taken from NIST 800-160, given way to zero trust
Privacy by design (secure design principle)
making privacy and integral part of every system, tech, policy, and design process
§ Proactive and not reactive approach
§ Privacy as the default setting
§ Privacy embedded into design, not added later
§ Privacy should be positive-sum approach, not zero-sum, needs of everybody are met
§ End to end full lifecycle data protection
§ Visibility and transparency, i.e. privacy policy explaining what company does with data
Keep privacy user-centric, i.e. in GDPR the customer can request data and tell them to “forget” them
Security-aaS
cloud provider concept in which security is provided to an org through and online entity
internet of things (IoT)
class of devices connected to internet in order to provide automation, remote control, or AI processing in home or business, plugs, thermostats, speakers, etc
SIEM
sec information and event management, collects data from many sources, provides real time monitoring, traffic analysis of potential attacks, often use AI, ML and threat intel
SOAR
sec orchestration automation and response, threat specific playbooks, response may be fully automated or single click, domain 8, delivered with SIEM typically
Microservices
fine grained services with a discrete function, more modern version of SOA to cloud computing, run on Docker/ kubernetes
SOA (service oriented architecture)
creation of discrete services that may be accessed by users in black box fashion (don’t know whats going on under the hood)
code level vulnerabilities
should be identified early in development lifecycle via static code analysis and dynamic testing to identify deficiencies before release
containerization
lightweight, granular, portable way to package apps for multiple platforms, reduces overhead of server virtualization by enabling containerized apps to run on a shared OS kernel, containers don’t have their own OS, sharing OS of host, test focuses on devops security (container level) and application level security (Authentication and Authorization)
API
set of exposed interfaces allow for program interaction between services, REST uses HTTPS for web comms to offer API end points, all comms between client and server should be encrypted and access limited with API keys, storage/ dist/ transmission of access keys should be done in secure fashion
Embedded Systems
tech component of an IOT device, full computer system embedded inside a larger system, ie printers/ drones/ semi autonomous vehicles, consider authentication practices to ensure they meet security best practices (avoid implied trust)
high performance computing
alternative to client/ server computing model for intensive operations with large data sets, for problems that require large-scale parallel processing, SETI project where individuals can volunteer their compute time i.e. grid computing
grid computing
employs a centralized controller that makes computing assignments to grid members, secure the grid controller
edge computing
some compute operations require processing activities to occur locally not in the cloud, common in IOT scenarios like agricultural, science/ space, military, ie watering plants in a field by sensing moisture, kiosk in a drug store, consider encryption, spoofing protection and authentication
fog computing
places gateway devices in the field to collect and correlate data centrally at the edge, version of edge computing
Serverless (Function as a service FaaS)
different that PaaS, more granular, less decisions around service tier and scale, azure functions and AWS Lambda
IaaS
CSP: networking, storage, servers, virtualization
You: OS, middleware, runtime, data, apps
PaaS
CSP: networking, storage, servers, virtualization, OS, middleware, runtime
You: data, apps
SaaS
CSP: networking, storage, servers, virtualization, OS, middleware, runtime, data, apps
You: n/a
Public cloud
everything runs on CSPs hardware, advantages include scalability, agility, pay as you go, no maintenance, low skills
Private cloud
cloud environment in your own datacenter, legacy support (can support older versions vs public which will typically always be latest versions), control, compliance
Hybrid (cloud model)
combines public and private allowing every app to run in the right location, connect the 2 clouds with VPN, flexible in legacy, compliance, and scalability
CASB
cloud access security broker, security policy enforcement solution, ie ensuring specific users only use the applications we have in place, prevent sensitive information from being shared externally, solves problem of shadow IT
Post quantum cryptography
development of new kinds of cryptographic approaches that can be implemented using todays conventional computers, but will be resistant to quantum computing attacks of the future
Symmetric encryption (shared key)
bulk encryption, fast, holds up well to quantum, uses 1 shared secret key
Grovers algorithm
quantum computer speeds up attacks to halve the key length, 256 bit key is as strong against quantum as 128 bit
Shors algorithm
quantum can easily break all commonly used PK alogorithms, RSA is vulnerable, Elliptic curve is vulnerable, Lattice offers some resistance against quantum
lattice
makes up most publications on post-quantum cryptography, QUANTUM RESISTANT
Stream cipher
symmetric key, one character at a time
Block cipher
crypto key and algo are applied to a block of data at once as a group
Substitution cipher
replace each character with a different character
transposition
rearrange the letters of a plaintext message to form ciphertext
Initialization vector (IV)
random bit string (nonce) that is XORed with the message to reduce predictability and repeatability, same length as the block size or as large as the encryption key
Caesar, vigenere, one-time pad
similar STREAM ciphers, difference is key length, caeser=1, vigenere=longer key like a word/ sentence, one-time pad=same length as the message
one time pad
key must be generated randomely, as long as message to be encrypted, pads be protected against disclosure, pad must be used one-time then discarded
zero knowledge proof
communication concept, specific type of info is exchanged but no real data is transferred, ie digital signature and digital certificate, enables one to prove knowledge of a fact without revealing the fact
split knowledge
information/ priv required to perform an operation is divided among multiple users, ensures no single person has sufficient priv to compromise security, role seperation
work function
aka work factor, measure strength of crypto system by measuring cost/ time to decrypt, work function rating typically represents the amount of time to complete a brute-force attack against a crypto system, TIME AND EFFORT TO BREAK A PROTECTIVE MEASURE
key security
crypto keys provide security to crypto system, modern systems utilize keys of at least 128 bits
symmetric encryption
shared secret key, faster, lacks support for scalability/ easy key distro/ nonrepudiation
AES > block > 128
Blowfish > 64
DES > block > 64 > weak
3DES > block > 64 > moderate
RC4 > stream cipher
RC5 > RSA block mode cipher > 32/63/128 > VERY strong
Skipjack > 64
Twofish > 128
Asymmetric
PKI for communication between parties, supports scalability, easy key distribution, and nonrepudiation, public and private key pairs, stronger than symmetric, encrypt with recipients public key, digital signature signed with own private key
RSA > key transport > 512 > strong
Diffie Hellman > key exchange > moderate
El Gamal > key exchange > very strong
ECC > elliptic curve > very strong
Electronic Codebook Mode (ECB)
DES/3DES mode
simplest and least secure, 64-bit blocks, easy to break
Cipher block chaining (CBC)
DES/3DES mode
each block of unencrypted text is XORed w/ block of ciphertext immediately preceding. Decryption process simply decrypts ciphertext and reverse the XOR operation,
Cipher feedback (CFB)
streaming version of CBC, works on data in real time, uses chaining so errors propogate
Output feedback (OFB)
operates similar to CFB but XORs plaintext with a seed value, no chaining function so errors do not propogate
Counter (CTR)
incrementing value instead of a seed, errors do not propogate
XOR Cipher
exclusiveOR, flipping bits in a simple systemic fashion, when values match = 1, when values don’t match = 0.
Key clustering
weakness where plaintext message generates identical ciphertext message using same algo but different keys, similar to hash collision, same reason why MD5 is no longer used
Hash functions
allow input of any length, provide fixed length output, easy to compute hash function, must be irreversible, must be collision free. MD5 not used anymore, sha-256 is the standard
HMAC - variable hash value length > very strong
MD5 > 128 > weak
SHA1 > 160 > weak
SHA2 > 256 > strong > current standard
SHA3 > 384 > strong
SHA5 > 512 > strong
Salt
random data added before hashing, reduces effectiveness of rainbow table attacks`
Digital signature standard (DSS)
uses SHA-1, SHA-2 (must use SHA-256 these days), and SHA-# message digest functions, works with Digital signature algo (DSA), Rivest, Shamir, Adleman (RSA) algo, and Eliptic Curve DSA (ECDSA) algo, FIPS-186-4 (digital signature standard)
PKI
Certificate authorities (CAs) generate digital certificates containing public keys of system users, Users then distribute certificates to people with whom they want to communicate, recipients verify a certificate using CAs public key, used for web/ network/ email security
Email encryption
standards for encrypted messages include S/MIME and Pretty Good Privacy (PGP)
Web encryption
standard is HTTP over TLS (HTTPS), this has replaced SSL
Network encryption
Ipsec is standard
IPsec
secure communication over IP, transport mode or tunnel mode, establish direct communication between computers or over VPN, windows OS can Ipsec between computers, uses 2 protocols - Authentication header (AH) and encapsulating security payload (ESP)
Meet in the middle attack
exploits protocols using 2 rounds of encryption
Man in the middle attack
fools both parties into communicating with the attacker instead of directly with each other
Birthday attack
attempts to find collisions in hash functions
Replay attack
attempt to reuse authentication requests
Digital rights management (DRM)
allows content owners to enforce restrictions, common in entertainment ie music/ movies/ books, occasionally found in enterprise to protect sensitive info
Rivest, Shamir, and Adleman (RSA)
most famous public key crypto system
El Gamal
Public key cryptosystem, Based on Diffie-Hellman key exchange, less common than RSA
Elliptic Curve
public key cryptosystem, provides more security than other algos with same length key
Security Model
formalize security policy, implemented by enforcing integrity, confidentiality, or other controls, lay out broad guidelines (not specific), up to the developer to decide how models will be integrated into specific designs, map abstract statements into sec policy, determines what subjects can access system and what objects they will have access to
Simple security property (sec model)
describes rules for read, subject cannot read data at a higher classification level (no read up)
Star * security property (sec model)
describes rules for write
Invocation property (sec model)
rules around invocation (calls), such as to subjects
State machine (sec model)
system that is always secure no matter what state its in, based on finite state machine (FSM), “state” is a snapshot of a system at a moment in time, all state transitions must be evaluated, if each transition results in a secure state then the system is a “secure state machine”,
Information flow model
focuses on flow of information, Biba and Bell-Lapadula
Bell-LaPadula (sec model)
prevent info flow from high security to low security level, no read up no write down, CONFIDENTIALITY, government (DoD), uses mandatory access control (MAC) to enforce DoD multilevel sec policy, simple security property and star * sec property, no read up no write down, lattice based
Biba (sec model)
focuses on flow from low to high security level, INTEGRITY, no read down no write up, simple integrity property (no read down), star * integrity property (no write down), lattice based, invocation property prohibits subject from invoking subject at a higher integrity level
Non-interference (sec model)
how actions of a subject at a higher security level affect the system or actions of a subject at a lower security level, ensures that actions of different objects/ subjects arent seen by/ interfere with other objects/ subjects on the same system
Lattice (sec model)
based on interaction between objects (resources, computers, and applications) and subjects (individuals, groups, organizations), used to define levels of security that an object may have and that a subject may have access to
Clark Wilson (sec model)
access control triple, INTEGRITY, uses security LABELS to grant access, constrained data item (CDI), unconstrained data item (UDI), integrity verification procedure (IVP), Transformation procedures (TPs), access control triplet!!
Goguen-Meseguer (sec model
THE non-interference model, INTEGRITY
Sutherland (sec model)
preventing interference (Information flow and SMM)
Brewer and Nash (sec model)
Chinese wall, CONFIDENTIALITY, prevent conflict of interest problems
Take Grant (sec model)
employs a directed graph, CONFIDENTIALITY, 4 operations (take, grant, create, and revoke)
Constrained data item (CD)
Clark Wilson model, any data item whose integrity is protected by the sec model
Unconstrained data item (UDI)
Clark Wilson model, any data item that is not controlled by the sec model
Integrity verification procedure (IVP)
Clark Wilson model, scans data items and confirms integrity
Transformation procedures (TPs)
Clark Wilson model, procedures that are allowed to modify a constrained data item (CDI)
Access control triplet
authenticated principal (subjects/ users) > programs (transformational procedures) > data items (Objects/ UDIs/ CDIs), refers to relationship between users, programs and a set of data items, used in Clark Wilson model
Graham-Denning (sec model)
protections rules where each object has an owner and a controller, focused on secure creation and deletion of both subjects and objects, 8 primary protection rules that define the boundaries of certain secure actions, securely create object/ subject, securely delete object/ subject, securely provide the read/ grant/ delete/ transfer access right
Dedicated mode (sec modes)
clearance that permits access to ALL info, approval for ALL info, valid need-to-know for ALL info
Multilevel mode (sec modes)
can process info at different levels even when all system users do not have required sec clearance
System high mode (sec modes)
each user must have valid clearance, access approval for ALL info, and valid need-to-know for SOME info on a system. Offers most GRANULAR control over resources and users of these models
Compartmented mode (sec modes)
one step further than system high, each user must have valid clearance, access approval for ALL INFO processed by a system, but requires valid need to know for ALL INFO they will have access to on the system
Trusted Computing Base (TCB)
combo of hardware, software, and controls that work together to form a “trusted base” that enforces sec policy, subset of the complete information system, portion that can be trusted to adhere/enforce sec policy, separated by a security perimeter from the untrusted parts of the system, creates secure channels to communicate w/ rest of system
Reference monitor
logical part of TCB that confirms whether subject has right to use a resource prior to granting access, ENFORCES ACCESS CONTROL
security kernel
collection of TCB components that implement the functionality of the reference monitor, IMPLEMENTS ACCESS CONTROL
Common Criteria (ISO-IEC 15408)
enable objective evaluation to validate a product/ system satisfies a defined set of sec requirements, gold standard, has replaced BOTH TCSEC and ITSEC
1. description of assets
2 identification of threats
3 analysis and rating of threats
4 determination of sec operations
5 selection of sec functional requirements
levels 1 through 7 vary from minimal/no protection up to verified security design
Community protection profile (cPP)
flavor of common criteria (ISO-IEC 15408), black box
Evaluation assurance level (EAL)
flavor of common criteria (ISO-IEC 15408), white box, see chart below!! White box
Trusted Computer System Evaluation Criteria (TCSEC)
set of criteria for evaluation computer sec within products and systems, REPLACED BY COMMON CRITERIA
Information Technology Security Evaluation Criteria (ITSEC)
represents initial attempt to create sec evaluation criteria in Europe. ITSEC uses 2 scales to rate functionality and assurance, REPLACED BY COMMON CRITERIA
Covert Channel
method to pass info over a path that is not normally used for comms, since its not used it may not be protected by sec controls, i.e. steganography, 2 types: covert timing and covert storage
Trusted Platform Module (TPM)
chip that lives on motherboard, storage/ management of keys used for disk encryption, provides OS with access to keys but prevents drive removal and data access
Mandatory Access Control (MAC)
enforces access policy determined by the system not the object owner, relies on classification labels that are representative of sec domains and realms, every object/ subject has one or more labels, labels are predefined and system determines access based on labels
Hierarchical environment (MAC type)
classification labels are assigned in an ordered structure from low to medium to high security, type of MAC
Compartmentalized environment (MAC type)
requires security clearances over compartments/ domains instead of objects, type of MAC
Hybrid Environment (MAC type)
contains levels with compartments that are isolated from the rest of the sec domain, combines both hierarchical and compartmentalized environments so that sec levels have sub compartments, type of MAC
Discretionary Access Control (DAC)
permits owner of an object to control/ define its accessibility, because the owner has full control by default, at the discretion of the owner
Non-Discretionary access control (NDAC)
enables enforcement of system-wide restrictions that override object specific access control
Role based access control (RBAC)
well-defined collection of named job roles to endow each one with specific permissions, ensures users in each role have access to get their jobs done, i.e. global admin/ security reader/ normal user
Certification
technical evaluation of each part of a comp system to assess its alignment with sec standards
Accreditation
formal acceptance of certified configuration from a designated authority
Open system
designed using industry standards, easy to integrate with other open systems
Closed system
proprietary hardware and software, specifications are not normally published, harder to integrate with other systems
Confinement
restricts process to reading from and writing to certain memory locations
Bounds
are the limits of memory a process cannot exceed when reading or writing
Isolation
mode a process runs in when it is confined through the use of memory bounds
MFA
something you know (pin or password), something you have (trusted device), something you are (biometric)
Authentication (AuthN)
process of proving that you are who you say you are, IDENTITY
Authorization (AuthZ)
act of granting an authenticated party permission to do something, ACCESS
Multitasking
simultaneous execution of more than one application on a comp and is managed by the OS
Multithreading
permits multiple concurrent tasks to be performed within a single process
Multiprocessing
use of more than one processor to increase compute power
Multiprogramming
similar to multitasking, takes place on mainframe systems and requires specific programming, MULTITASKING FOR MAINFRAME
Single vs Multi state processors
operate at only one security level at a time vs multiple sec levels
User mode (processor operating)
apps operate in a limited instruction set environment known as user mode, normal end user operations
Privileged mode (processor operating)
controlled ops are performed in privileged mode aka system mode, kernel mode, supervisory mode
Read only memory (ROM)
contents burned in at factory, read only
RAM
static RAM (SRAM) uses flip flops, dynamic RAM (DRAM) uses capacitors
PROM
programmable chip similar to ROM, subtypes: erasable (EPROM) for overwriting with unclassified data, Ultraviolet (EPROM) uses UV light to erase, Electronically erasable PROM (EEPROM) uses electrical voltage to erase
Flash memory
derivative of EEPROM, nonvolatile, can be electronically erased and rewritten
Primary storage
same as memory
Secondary storage
consists of magnetic, flash, and optical media that must first be read into primary memory before the CPU can use the data, 3 SECURITY ISSUES: removable media can be used to steal data ie USB drives, access controls and encryption must be applied to protect data, data can remain after deletion/ formatting
Random access storage
devices can be read at any point
Sequential access storage
require scanning through all the data physically stored before the desired location
Firmware
software stored on a ROM chip containing basic instructions to start computer, provide OS instructions in peripherals like printers/ keyboards etc
Process isolation
ensures that individual processes can only access their own data
Layering
creates different realms of security within a process and limits comms between them
Abstraction
creates a black box interface for programmers to use without requiring knowledge of algo/ devices inner workings
Data hiding
prevents info from being read at a different sec level, hardware segmentation enforces this with physical controls
Security policy
inform design/ development/ implementation/ testing/ maintenance of systems,
cloud computing
processing/ storage are performed over a network connection instaed of locally (Azure, AWS, GCP)
Hypervisors
Virtual machine management/ creator/ operator, Type 1 = 1 bare metal, type 2 = runs on a standard OS and the hypervisor is an app ie virtualbox/ vmware workstation
CASB
cloud access sec broker, sec policy enforcement, prevents shadow IT, installed on-prem or in the cloud, ensure only secure apps are used in your environment, ensure data is not stored in unauthorized repos (only approved storage locations)
Security-aaS
security is provided to an org by an online entity
Smart devices
mobile devices offering app installs, may use on-device or cloud AI processing
IoT
class of devices connected to internet to provide automation, remote control, or AI processing in a home/ business ie smart switches/ thermostats/ alexa/ cars
Mobile device security
encryption, remote wiping (can be selective for business data), screen locking, GPS, app control, apps and functions NEED TO BE SECURED, concepts include key management/ cred management/ authentication/ geotagging/ encryption/ app whitelisting/ transitive trust and authentication
BYOD
policy that allows employees to use their personal mobile devices to access business info/ resources, may improve morale but INCREASES SEC RISKS, MDM platforms like intune offer solutions
Embedded system
designed around a limited set of specific functions, in relation to the larger product of which it’s a component, ie motion sensors/ lighting system/ wifi routers/ cash registers
Static environments
apps/ Oss/ hardware sets/ networks that are configured for a specific need, capability, or function and then set to remain UNALTERED
Least privilege
ensures a minimum number of processes are authorized to run in supervisory/ system mode, also applies to role based access where people are given what they need to do their jobs and not more
Separation of privilege
separating privs that any one entity can perform, aka role separation
accountability
ensures that an audit trail exists
Buffer Overflow
occurs when programmer fails to check size of input data prior to writing data into a specific memory location, overwrites the bounds of memory for which it has been granted access, programmers can also leave backdoors and privileged programs on system after deployment, some systems are susceptible to time-of-check-to-time-of-use (TOTTOU) attacks where state change presents opportunity for attacker to compromise system
time-of-check-to-time-of-use (TOTTOU) attacks
where state change presents opportunity for attacker to compromise system
Order of sec controls
as each one fails they move to the next Deterrence > denial > detection > delay > determine (what is occuring) > decide (whether to aprehend, collect evidence)
Administrative controls
(site management/ personnel controls/ awareness training/ emergency response and procedures/facility selection and management/ policy)
Logical/ Technical Controls
(access control/ IDS/ alarms/ CCTV/ fire detection)
Physical controls
for physical security, fences/lights/locks/mantraps/dogs/guards, VERY IMPORTANT, no amount of admin or logical/technical controls can provide adequate security without control over physical environment!!
Fence heights
deter casual trespasser (3-4 feet), too hard to climb easily (6-7 feet), will deter intruders (8 feet+ with barbed wire)
Temp (physical security)
humidity (40-60%, any higher causes corrosion any lower causes static), temps for computers 60-75 F damaged at 175F, storage devices damaged at 100F
Electrical impacts (physical security)-
blackout=prolonged loss of power, brownout=prolonged low voltage, fault=short loss of power, surge=prolonged high voltage, spike=temporary high voltage, sag=temporary low voltage
Lights (physical security)
8 feet high with 2 feet candle power
Fire suppression
Class A (ASH)=common combustibles ie wood/paper=extinguish with water or soda acid, Class B (BOIL)=burning alcohol/oil/other petroleum=extinguish with gas or soda acid NOT water, Class C (CONDUCTIVE)=electrical=extinguish with any type of gas, Class D (DILYTHIUM)=burning metals=extinguished with dry powder, Class K (KITCHEN)=oil or grease=extinguish with wet chemicals
Fire detection
smoke, heat, or flame sensing
Fire damage
smoke damages storage devices, heat damages electronics, suppression mediums can cause short circuits
Water based fire suppression
preaction systems= BEST FOR COMPUTER SYSTEMS closed sprinkler heads, pipe is charged with compressed air instead of water / wet pipe systems=filled with water, dry pipe systems= compressed air until water is needed (useful for parking garages etc where water freezes) / Deluge systems=sprinkler heads are open and larger than dry pipe heads, empty at normal air pressure and water is held back by deluge valve / NOT FOR ELECTRICAL FIRES
Gas discharge systems
more effective than water but shouldn’t be used near people because it removes O2 from the air, Halon is effective but bad for environment and toxic at over 900F, Halon replacements = FM-200, CEA-410, NAF-S-III, FE-13, ARGON, Inergen, Aero-K
Electromagnetic interference
common mode noise=difference in power between hot and ground wires of a power source operating electrical equipment, traverse mode noise=difference in power between hot and neutral wires of a power source operating electrical equipment,
Radio frequency interference (RFI)
generated by electrical applicances/ light sources/ cables/ circuits/ etc.
Static voltages
40 - destroys sensitive circuits
1000 scrambles monitors
1500 destroys hard drive data
2000 abrupt shutdown
4000 printer jam
17000 - permanent circuit damage
Locks
○ Electronic combo locks - aka cipher lock, something you KNOW
○ Key card systems - something you HAVE
○ Biometric systems - something you ARE
Conventional locks - easily picked/ bumped, keys easily duplicated, least secure, pick and bump resistant exist
site selection
visibility, accessibility, effects of natural disasters
facility design
understand level of security needed and plan for it before construction begins
secure work area
should NOT be equal access to all locations, high value assets require restricted access, should be located at CENTER OF PROTECTION, centralized server rooms don’t need to be human compatible
Threats to physical access controls
propping doors, bypassing locks or access controls, masquerading is using someone elses ID, guard or monitoring system MUST be present, piggybacking/ tailgating is following someone through secure gateway/ doorway
Visitors
assign an escort, monitor activities and access, badges
evidence logs
used to retain logs, drive images, VM snapshots, PROTECTIONS INCLUDE: locked cabinets/ safes, dedicated isolated storage facilities, offline storage, access restrictions and activity tracking, hash management and encryption
`audit trails/ access logs
useful for managing physical access control, may need to be created manually by security guards or automatically by smartcards etc, monitor with CCTV, important to reconstruct the events of an intrusion/ attack
clean power
most electronic equipment requires clean power, UPS self charging battery that can supply consistent clean power to sensitive equipment, can supply power for minutes or hours depending on size, then generators after that
open relay (SMTP)
does not authenticate users before relaying their message, if internet exposed they are typically quickly exploited
motion detector
capacitance=electromagnetic field
X.509
governs digital certificates and PKI, defines processes used by CAs, international telecommunications union (ITU) standard
