GRC Concepts Flashcards
Information Flow model
A model that focuses on the flow of information to ensure that security is maintained and enforced no matter how information flows.
Noninterference model
A model that seeks to ensure that objects and subject of different levels don’t interfere with objects and subjects of other levels. The noninterference model can be used to avoid convert channel attacks.
Lattice Model
Subjects are assigned security clearances. Objects are assigned security labels.
Take-Grant model
A model that dictates how rights can be passed from one subject to another or from a subject to an object
Bell–LaPadula model
A confidentiality focused security model built on a state machine model employing no read up, no write down mandatory access controls.
Biba model
An integrity focused security model employing no read down, no write up mandatory access controls.
Simple Security Axiom
Subjects cannot read information at a higher classification level (no read up)
Star Security Axiom
Subjects cannot write information at a lower classification level (no write down)
Simple Integrity Axiom
subjects cannot read information at a lower classification (no read down)
Star Integrity Axiom
subjects cannot write information at a higher classification (no write up)
Clark-Wilson model
An integrity focused security model enforced through well-formed transactions. It uses a relationship of subject, program and object. Subjects do not have direct access to objects. Objects must be accessed through programs.
Brewer and Nash model (aka Chinese Wall)
A security model designed to avoid conflicts of interest. It creates a conflict class that defines which security domains are potentially in conflict and prevents any subject with access to one domain that belongs to a specific conflict class from accessing other domains that belong to the same conflict class.
Graham–Denning model
A security model focused on the secure creation and deletion of both subjects and objects.
Fourth Amendment
Protection from unreasonable search and seizure by the government.
Computer Fraud and Abuse Act (CFAA)
A US law enacted in 1984 to exclusively cover computer crimes that cross state boundaries to avoid infringing on states’ rights.
Federal Information Security Management Act (FISMA)
A US law passed in 2002 that requires that federal agencies implement an information security program. The National Institute of Standards and Technology (NIST), is responsible for developing the FISMA implementation guidelines, outlining the elements of an effective information security program.
Digital Millennium Copyright Act
A law that establishes the prohibition of attempts to circumvent copyright protection mechanisms placed on a protected work by the copyright holder and limits the liability of Internet service providers when their circuits are used by criminals violating the copyright law.
Economic Espionage Act of 1996
A law that states that anyone found guilty of stealing trade secrets from a US corporation with the intention of benefiting a foreign government may be fined up to $500,000 and imprisoned for up to 15 years and that anyone found guilty of stealing trade secrets under other circumstances may be fined up to $250,000 and imprisoned for up to 10 years.
Copyrights
Law that guarantees the creators of “original works of authorship” protection against the unauthorized duplication of their work (70 years after creator’s death or 95 years after creator’s death for corporations).
Trademark
A registered word, slogan, or logo used to identify a company and its products or services–renew every 10 years.
Patent
Allows invention’s creator the sole right to make and sell that invention for a set period of time (20 years).
Trade Secret
Intellectual property that is absolutely critical to a business and would cause significant damage if it were disclosed to competitors and/or the public. To preserve trade secret status, you must implement adequate controls within your organization to ensure that only authorized personnel with a need to know the secrets have access to them. You must also ensure anyone with type of access is bound by a non-disclosure agreement (NDA) that prohibits them from sharing the information with others.
Privacy Act of 1974
A law that mandates that government agencies maintain only records that are necessary to conduct their business and destroy those records when they are no longer needed for a legitimate function of government. It provides a formal procedure for individuals to gain access to records the government maintains about them and to request that incorrect records be amended.
Electronic Communications Privacy Act (ECPA)
The law that makes it a crime to invade an individual’s electronic privacy. It protects against the monitoring of email and voicemail communications and prevents providers of those services from making unauthorized disclosures of their content.
