Introduction Flashcards
Define security
Minimizing the vulnerabilities of assets and resources
What are assets?
Anything of value, in information security these are information systems.
What is a vulnerability?
Any weakness that could be exploited to violate a system or the information is contains.
What is a threat?
A potential violation of security
What is the CIA triad?
Confidentiality
Integrity
Availability
What is confidentiality?
Preventing unauthorised disclosure of information
What is integrity?
Preventing unautherised (accidental or deliberate) modification or destruction of information
What is availability?
Ensuring resources are accessible when required by an authorised user
What is the OSI Security Architecture?
Systematic approach of providing security at each layer.
Defines security services and mechanisms that provide security for data transmitted over a network.
Defines threats (or attacks), services, mechanisms and how they are related
What are passive threats?
Threats that do not alter information in a system.
Eavesdropping, traffic analysis
hard to detect, focus on preventing their success
What is eavesdropping?
Attacker monitors communication.
E.g.: sniffing packets, tapping telephone
What is traffic analysis?
Attacker monitor the amount, source and destination of communication.
What are active threats?
Threats that alter information in the system.
These may be hard to prevent, focus on detection
What are some examples of active threats?
Masquerade
replay
modification of messages
Denial of service
What is the masquerade attack?
The attacker claims to be a different entity
What is the replay attack?
The attacker sends a message that has already been sent.
Retransmission of a passive capture of a data unit
What is the modification of messages attack?
Attacker changes messages during transmission
What is denial of service attack?
The attacker prevents legitimate users from accessing resources
What is a security service?
A processing or communication service to give a specific kind of protection to system resources (supports one or more of the security requirements: CIA, authenticity, accountability).
Implemented by security mechanisms.
What is a security mechanism?
Method of implementing one or more security services.
A process/device that is designed to detect, prevent or recover from attacks.
Name some security services (8)
Peer entity authentication
Data origin authentication
Access control
Data confidentiality
Traffic flow confidentiality
Data integrity
Non-repudiation
Availability services
What is Peer entity authentication?
Provides confirmation of the claimed identity of an entity.
Protects against masquerade or replay
What is Data origin authentication?
Provides confirmation of the claimed source (origin) of a data unit (message)
What is Access control?
Protection against unauthorized use of resources.
Usually provided in combination with authentication and authorisation services.
What is data confidentiality?
Protects data against unautherized disclosure.
Protection of transmitted data prom passive attacks.
What is traffic flow confidentiality?
Protects disclosure of data which can be derived from knowledge of traffic flows.
What is data interity?
Detects modification, insertion, deletion or replay of data in a message or a stream of messages
What is non-repudiation?
Protects against any attempt by the creator of a message to falsely deny creating the data or its content.
Protects against denial by the sender, or denial by the recipient
What is availability service?
Protects a system against denial of service
What are some mechanisms? (6)
Encipherment
Digital signature
Traffic padding
Authentication
Routing control
Notarization
access control mechanisms (passwords, tokens)
Integrity mechanisms (corruption detection)
What is encipherment?
Transformation of data in order to hide its information content.
What is digital signature?
Mechanism, cryptographic algorithms which transform data using a signing key.
Signed data can only be created with the signing key.
What are authentication exchange?
Protocols which exchange information to ensure identity of protocol participants.
E.g. TLS
What is traffic padding?
Spurious traffic generated to protect against traffic analysis.
Typically used in combination with encipherment
What are routing control mechanisms?
Use of specific secure routes
What is the notarization mechanism?
Uses a trusted third party to assure the source or receipt of data.
This third party is sometimes called a notary.
What are the 6 categories of security services?
Authentication
Access control
Data confidentiality
Data integrity
Nonrepudiation
Availability
What are the 8 categories of security mechanisms?
Crypto algorithms
Traffic padding
Data integrity
Routing control
Digital signature
Notarization
Authentication exchange
Access control
What is risk management?
Tool in information security management:
1. identifies threats
2. Classifies threats according to likelihood and severity
3. Apply security controls based on cost-benefit analysis
Define information security
Information security:
Preservation of CIA, in addition to authenticity, accountability, non-repudiation, reliability
Define network security
Protection of networks and their services from unautherized modification, destruction or disclosure. Assurance that the network performs its critical functions correctly.
What is privacy?
Assures that individuals control or influences what information related to them may be collected and stored, and by/to whom it may be disclosed.
What is data authenticity?
That the digital object is indeed what it claims to be.
What is system integrity?
That a system performs its functions correctly, free from unautherized manipulation.
What is accountability?
The security goal that relates to the requirement for actions of an entity to be traced uniquely to that entity.
What type of attack is a man-in-the-middle attack?
Masquerade
Masquerades as both client and server
