Domain 3 - Security Engineering Flashcards
Common Criteria ISO 15408
Structured methodology for documenting security requirements, documenting and validating
What is a Protection Profile (PP)?
Set of security requirements for a category of products that meet specific consumer security needs
What is the Target of Evaluation (TOE)?
The product
What is the Security Target (ST)?
Identifies the security properties of TOE
Security Functional Requirements (SFRs)
Specific individual security functions
EAL0
Inadequate assurance
EAL1
Functionally tested
EAL2
Structurally tested
EAL3
Methodically tested and checked
EAL4
Methodically designed, tested and reviewed
EAL5
Semi formally designed and tested
EAL6
Semi formally verified design and tested
EAL7
Formally verified design and tested
NIST SP 800-27
Engineering Principles for IT Security
A Baseline for Achieving Security
NIST SP 800-27 - Step 1
Initiation; need expressed, purpose documented, impact assessment
NIST SP 800-27 - Step 2
Development/Acquisition; system designed, purchased, programmed, developed or constructed.
NIST SP 800-27 - Step 3
Implementation; system tested and installed, certification and accreditation
NIST SP 800-27 - Step 4
Operation/Maintenance; performs function, security operations, audits
NIST SP 800-27 - Step 5
Disposal; disposition of information, HW and SW
CMM (Maturity Model)
I Regularly Drink My OrangeJuice
Initial Repeatable Defined Managed Optimizing
What are the functions of OS Kernel?
Loads & runs binary programs,
schedules task swapping, allocates memory &
tracks physical location of files on computers hard disk,
manages IO/OP requests from software, &
translates them into instructions for CPU
Primary Storage
A temporary storage area for data entering and leaving the CPU
Random Access Memory (RAM)
A temporary holding place for data used by the operating systems. It is volatile; meaning if it is turned off the data will be lost. Two types of RAM are dynamic and static.
Dynamic Ram
Needs to be refreshed from time to time or the data will be lost.
Static RAM
Does not need to be refreshed
Read-Only Memory (ROM)
Non-volatile, which means when a computer is turned off the data is not lost;
for the most part ROM cannot be altered.
ROM is sometimes referred to as firmware
Erasable and Programmable Read-Only Memory (EPROM)
Nonvolatile like ROM, however EPROM can be altered.
Multitasking
Execute more than one task at the same time
Multiprocessing
More than one CPU is involved
Multi-Threading
Execute different parts of a program simultaneously
Single state machine
Operates in the security environment at the highest level of classification of the information within the computer.
In other words, all users on that system must have clearance to access the info on that system.
Multi-state machine
Can offer several security levels without risk of compromising the system’s integrity.
CICS
Complex instructions. Many operations per instruction. Less number of fetches
RISC
Reduced instructions.
Simpler operations per instruction.
More fetches
1 GL
machine language (used directly by a computer)
2GL
assembler
3GL
FORTRAN. Basic pl/1 and C++
4GL
Natural / focus and SQL
5GL
Prolog, lisp artificial intelligence languages based on logic
In regards to memory protection, describe Segmentation.
Dividing a computer’s memory into segments.
In regards to memory protection, what is Protection Keying?
Numerical values, Divides physical memory up into particular sized blocks, each of which has an associated numerical value called a protection key.
In regards to memory protection, what is Paging?
Divides memory address space into even size blocks called pages. To emulate that we have more RAM than we have.
SYSTEM KERNAL KNOWS THE LOCATION OF THE PAGE FILE
Data Execution Prevention
A system-level memory protection feature that is built into the OS DEP prevents code from being run from data pages such as the default heap, stacks, and memory pools
ITIL
The ITIL Core includes five publications addressing the overall life cycle of systems. ITIL as a whole identifies best practices that an organization can adopt to increase overall availability, and the Service Transition publication addresses configuration management and change management processes.
- Service Strategy
- Service Design
- Service Transition
- Service Operations
- Continuous Service Improvemen
What are the Types of Security Models?
State Machine Model
Information Flow Model
Noninterference Model
State Machine Model
describes a system that is always secure no matter what state it is in. If all aspects of a state meet the requirements of the security policy, that state is considered secure.
A transition occurs when accepting input or producing output.
A transition always results in a new state (also called a state transition).
A secure state machine model system always boots into a secure state, maintains a secure state across all transitions, and allows subjects to access resources only in a secure manner compliant with the security policy.
Information Flow Model
Focuses on the flow of information. Information flow models are based on a state machine model.
The Bell-LaPadula and Biba models are both information flow models. Information flow models don’t necessarily deal with only the direction of information flow; they can also address the type of flow.
Information flow models are designed to prevent unauthorized, insecure, or restricted information flow, often between different levels of security (these are often referred to as multilevel models).
The information flow model also addresses covert channels by specifically excluding all non-defined flow pathways.
Noninterference Model
Loosely based on the information flow model. However, instead of being concerned about the flow of information, the noninterference model is concerned with how the actions of a subject at a higher security level affect the system state or the actions of a subject at a lower security level.
Basically, the actions of subject A (high) should not affect the actions of subject B (low) or even be noticed by subject B.
The noninterference model can be imposed to provide a form of protection against damage caused by malicious programs such as Trojan horses.
What are some Techniques for Ensuring CIA?
Confinement
Bounds
Isolation
Confinement
To restrict the actions of a program. Simply put, process confinement allows a process to read from and write to only certain memory locations and resources. This is also known as sandboxing.
Bounds
A process consist of limits set on the memory addresses and resources it can access. The bounds state the area within which a process is confined or contained.
Isolation
When a process is confined through enforcing access bounds that process runs in isolation. Process isolation ensures that any behavior will affect only the memory and resources associated with the isolated process.
List 7 Security Models
MATRIX BELL-LAPADULA BIBA CLARK WILSON Information flow model Brewer and Nash Lipner Model – Confidentiality and Integrity, BLP + Biba 1st Commercial
MATRIX
- Provides access rights to subjects for objects
- Access rights are read, write and execute
- Columns are ACL’s
- Rows are capability lists - Supports discretionary access control
BELL-LAPADULA
MAC SUBJECTS/OBJECTS/CLEARANECS/
- Confidentiality model
- developed by DOD, thus classification
- Cannot read up (simple e=read security rule)
- Cannot write down (* property rule AKA CONFINEMENT PROPERTY). Exception is a trusted subject.
- Uses access matrix to specify discretionary access control
- Use need to know principle
- Strong star rule: read and write capabilities at the same level
- First mathematical model defined
- tranquility principle in Bell-LaPadula prevents security level of subjects from being changed once they are created
- Bell-LaPadula is concerned with preventing information flow from a high security level to a low security level.
BIBA
MAC “if I in it INTEGRITY MODEL”
- Integrity model
- Cannot read down (simple e=read integrity rule)
- Simple integrity property - cannot write up (* integrity)
- lattice based (least upper bound, greatest lower bound, flow policy)
- subject at one level of integrity cant invoke subject at a higher level of integrity
- Biba is concerned with preventing information flow from a low security level to a high security level.
- Focus on protecting objects from external threa
CLARK WILSON
- integrity model
- Cannot be tampered, logged, and consistency
- Enforces segregation of duty
- Requires auditing
- Commercial use
- Works with SCI Constrained Data items, data item whose integrity is to be preserved
- Access to objects only through programs
- An integrity verification procedure (IVP) is a procedure that scans data items and confirms their integrity.
Information flow model
- Each object is assigned a security class and value, and information is constrained to flow in the directions that are permitted by the security policy. Thus flow of information from one security level to another. (Bell & Biba)
Brewer and Nash
The Chinese Wall model provides a dynamic access control depending on user’s previous actions. This model prevents conflict of interests from members of the same organization to look at information that creates a conflict of another member of that organization.
Lipner Model
Confidentiality and Integrity, BLP + Biba 1st Commercial Model
Graham-Denning
A computer security model that shows how subjects and objects should be securely created and deleted.
The model is based on the Access Control Matrix model
TAKE-GRANT
uses a direct graph to specify the rights that subjects can transfer to objects or that subjects can take from other subjects
- Uses STATES and STATE TRANSTIONS
Describe Composition Theories?
Some other models that fall into the information flow category build on the notion of how inputs and outputs between multiple systems relate to one another— which follows how information flows between systems rather than within an individual system.
These are called composition theories because they explain how outputs from one system relate to inputs to another system.
Cascading
Input for one system comes from the output of another system.
Feedback
One system provides input to another system, which reciprocates by reversing those roles (so that system A first provides input for system B and then system B provides input to system A)
Hookup
One system sends input to another system but also sends input to external entities
MAC
Mandatory Access Control
Subjects are labelled as to their level of clearance. Objects are labelled as to their level of classification or sensitivity.
User
perform work task
Data Owners
protect data
Data Custodians
classify and protect data
Information Technology Security Evaluation Criteria (ITSEC)
A structured set of criteria for evaluating computer security within products and systems.
Used in Europe Only
Addresses CIA
- refers to any system being evaluated as a target of evaluation
(TOE). - does not rely on the notion of a TCB, and it doesn’t require that a system’s security components be isolated within a TCB.
- includes coverage for maintaining targets of evaluation after changes occur without requiring a new formal evaluation.
Certification
TOE
Target of Evaluation refers to any system being evaluated
Certification
Evaluation of security features and safeguards if it meets requirements.
Certification is the comprehensive evaluation of the technical and nontechnical security features of an IT system and other safeguards made in support of the accreditation process to establish the extent to which a particular design and implementation meets a set of specified security requirements
Accreditation
The formal declaration by the designated approving authority (DAA) that an IT system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk.
Once accreditation is performed, management can formally accept the adequacy of the overall security performance of an evaluated system.
System accreditation
A major application or general support system is evaluated
Site accreditation
The applications and systems at a specific, self-contained location are evaluated
Type accreditation
An application or system that is distributed to a number of different locations is evaluated
Trusted Computer System Evaluation Criteria TCSEC: (Orange book)
From the U.S. DoD, it evaluates operating systems, application and systems.
It doesn’t touch the network part. It only addresses confidentiality!
ITSEC: 1
TCSEC: D
Minimal protection, any systems that fails higher levels
ITSEC: 2
TCSEC: C1
DAC; (identification, authentication, resource protection).
ITSEC: 3
TCSEC: C2
DAC; Controlled access protection (object reuse, protect audit trail).
ITSEC: 4
TCSEC: B1
MAC; (security labels) based on Bell LaPadula security model. Labeled security (process isolation, devices
ITSEC: 5
TCSEC: B2
MAC; Structured protection (trusted path, covert channel analysis). Separate operator/admin roles. Configuration management
ITSEC: 6
TCSEC: B3
MAC; security domain (trusted recovery, Monitor event and notification).
ITSEC: 7
TCSEC: A
MAC; Formal, verified protection
What are the Operational assurance requirements for TCSEC?
- System Architecture
- System Integrity
- Covert Channel analysis - Trusted Facility Management
- Trusted recovery
Rainbow series: Red
trusted network
Rainbow series: Orange
TCSEC evaluation
Rainbow series: Brown
Trusted facilities management
Rainbow series: Green
Password management
ISO 27001
Focus on the standardization and certification of an organization’s information security management system (ISMS), security governance, a standard; ISMS.
Info security minimum systems
ISO 27002
(inspired from ISO 17799) – a guideline which lists security control objectives and recommends a range of specific security controls;
more granular than 27001. 14 areas
BOTH INSPIRED FROM BS7799
Control Frameworks
Consider the overall control framework or structure of the security solution desired by the organization
COBIT
Control Objectives for Information and Related Technology, is a documented set of best IT security practices crafted by the Information Systems Audit and Control Association (ISACA).
It prescribes goals and requirements for security controls and encourages the mapping of IT security ideals to business objectives.
COBIT 5
Based on five key principles for governance and management of enterprise IT:
Principle 1: Meeting Stakeholder Needs
Principle 2: Covering the Enterprise End-to-End
Principle 3: Applying a Single, Integrated Framework
Principle 4: Enabling a Holistic Approach
Principle 5: Separating Governance from Management.
COBIT is used not only to plan the IT security of an organization but also as a guideline for auditors.
What is Virtualization?
Used to host one or more operating systems within the memory of a single host computer.
Such an OS is also known as a guest operating system. From the perspective that there is an original or host OS installed directly on the computer hardware, the additional Oses hosted by the hypervisor system are guests.
Virtual machine
Simulated environment created by the OS to provide a safe and efficient place for programs to execute
Virtual SAN
Software-defined shared storage system is a virtual re-creation of a SAN on top of a virtualized network or an SDN.
TOC/TOU attack
Race condition exploits, and communication disconnects are known as state attacks because they attack timing, data flow control, and transition between one system state to another.
RACE
Two or more processes require access to the same resource and must complete their tasks in the proper order for normal functions
Register
CPU also includes a limited amount of onboard memory, known as registers that provide it with directly acessible memory locations that the brain of the CPU, the arithmetic-logical unit (ALU), uses when performing calculations or processing instructions, small memory locations directly in the CPU.
Stack Memory Segment
Used by processors to communicate instructions and data to each other
Monolithic Operating System Architecture
All of the code working in kernel mode/system mode in an ad hoc and nonmodularized OS
Memory Addressing
When using memory resources, the processor must have some means of referring to various locations in memory. The solution to this problem is known as addressing.
Register Addressing
When the CPU needs information from one of its registers to complete an operation, it uses a register address (for example, “register 1”) to access its contents.
Immediate Addressing
Is not a memory addressing scheme per se but rather a way of referring to data that is supplied to the CPU as part of an instruction. For example, the CPU might process the command “Add 2 to the value in register 1.” This command uses two addressing schemes. The first is immediate addressing— the CPU is being told to add the value 2 and does not need to retrieve that value from a memory location— it’s supplied as part of the command. The second is register addressing; it’s instructed to retrieve the value from register 1.
Direct Addressing
In direct addressing, the CPU is provided with an actual address of the memory location to access. The address must be located on the same memory page as the instruction being executed. Direct addressing is more flexible than immediate addressing since the contents of the memory location can be changed more readily than reprogramming the immediate addressing’s hard-coded data. Indirect Addressing
Indirect addressing
uses a scheme similar to direct addressing. However, the memory address supplied to the CPU as part of the instruction doesn’t contain the actual value that the CPU is to use as an operand. Instead, the memory address contains another memory address (perhaps located on a different page). The CPU reads the indirect address to learn the address where the desired data resides and then retrieves the actual operand from that address.
Base + Offset Addressing
uses a value stored in one of the CPU’s registers as the base location from which to begin counting. The CPU then adds the offset supplied with the instruction to that base address and retrieves the operand from that computed memory location.
PaaS
Platform-as-a-Service is the concept of providing a computing platform and software solution stack as a virtual or cloudbased service.
Essentially, this type of cloud solution provides all the aspects of a platform (that is, the operating system and complete solution package).
The primary attraction of PaaS is the avoidance of having to purchase and maintain high-end hardware and software locally.
Customer supplies application code that the vendor then executes on its own infrastructure
SaaS
Software-as-a-Service, is a derivative of PaaS. SaaS provides on-demand online access to specific software applications or suites without the need for local installation. In many cases, there are few local hardware and OS limitations.
IaaS
Infrastructure-as-a-Service, takes the PaaS model yet another step forward and provides not just on-demand operating solutions but complete outsourcing options.
This can include utility or metered computing services, administrative task automation, dynamic scaling, virtualization services, policy implementation and management services, and managed/ filtered Internet connectivity.
Deployment Models, parent organization still responsible for patching OS of virtual hosts,
CaaS
not a TERM!
- Private; cloud-based assets for a single organization. Organizations can create and host private clouds using their own resources.
- Community; provides cloud-based assets to two or more organizations. Maintenance responsibilities are shared based on who is hosting the assets and the service models.
- Public; model includes assets available for any consumers to rent or lease and is hosted by an external CSP. Service level agreements can be effective at ensuring the CSP provides the cloud-based services at a level acceptable to the organization.
What methods can provide Database Security?
Aggregation
Inference
Aggregation
SQL provides a number of functions that combine records from one or more tables to produce potentially useful information.
Aggregation is not without its security vulnerabilities.
Aggregation attacks are used to collect numerous low-level security items and combine them to create something of a higher security level or value.
Inference
Involve combining several pieces of non-sensitive information to gain access to information that should be classified at a higher level. However, inference makes use of the human mind’s deductive capacity rather than the raw mathematical ability of modern database platforms.
