Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Secure Engineering > Flashcards

Secure Engineering Flashcards

1
Q

Open/Closed System

A

Proprietary software, harder to integrate with.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Confinement

A

Allows process to w/r to only certain memory locations and resources. Sandboxing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Bounds

A

The area in memory/resources process can operate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Isolation

A

When process is confined when enforcing bounds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Mandatory Access Control

A

Static attributes of the subject/object are considered to determine access. RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Discretionary Access Control

A

Subject has some ability to define objects to access. Access control list - dynamic access rule set that hte subject can modify. Often relates to subject’s identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Trusted System

A

all protection mechanisms work together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Assurance

A

Degree of confidence in satisfaction of security needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Trusted computing base

A

Hardware + software + controls to enforce security policy

Subset of system. Small as possible. Doesn’t require all other systems be trutsted.

Security perimeter -> trusted paths.

Reference monitor validates access to every resources prior to granting. Stands between every subj/obj

Security kernel: collection of components in TCB that implement RefMon functins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Orange Book

A

DoD 5200.28 / TCB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

State Machine Model

A

Always secure no matter what state it’s in. Finite state machine, each state evaluate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Information Flow Model

A

Based on SMM. Bell-LaPdaula and Biba models.

Designed to prevent unauthorized/insecure/restricted info flow, often between ddiff levels of security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Noninterference model

A

Concerned w/ how actions of subject at higher securit level affect system state of actions of a subject at a lower security level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Composition Theories

A

Cascading / Feedback / Hookup

Cascading: input for sy1 comes from output of sys2
Feedback: sys2 provides feedback input to sys1
Hookup: sys1 sends info to sys2, another external system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Take-Grant model

A

Directed graph how rights can be passed from one subject to another from a subject to an object.

Take rule, Grant Rule, Create Rule, Remove rule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Access Control Matrix

A

Table of subjects and objects indicating which actions the subject can perform.

Each column is an ACL. Each row is a capabilities list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Bell-LaPaluda Model

A

Focused on maintaining confidentiality. State machine model security

Simple Security Property: no read up
* security property: no write down (confinement property)
Discretionary security property: Access matrix to enforce DAC

18
Q

Biba model

A

Addresses integrity. State machine model concept. Commercial orgs

Simple Integrity Prop: no read-down
* Integrity Property: no write-up

Drawbacks: only integrity (no CA). No internal threat handling. No access control mgmt. Doesn’t prevent covert channels

19
Q

Clark-Wilson model

A

Commercial application. Subject/program/object (triple). Subjects access objects through programs. Integrity.

  • Constrained Data Item
  • Unconstraited data item.
  • Integrity verification procedure
  • Transformation procedures. only procedures allowed to modify a CDI.

Security labels. Restricted interface model.

20
Q

Brewer and Nash (Chinese Wall) model

A

Puts a ‘wall’ around data from domains in the same conflict class.
At moment of action, access to any conflicting data is temporarily blocked.

21
Q

Goguen-Meseguer Model

A

Integrity model. Noninterference theories/model. Users can only perform predetermined actions on predetermined objects

22
Q

Sutherland Model

A

Integiry model. SMM + info flow model. Defines a set of system states, initial states, and state transitions…

23
Q

Graham-Denning Model

A

Secure creation/deletion of subjects and objects.

Rules for: create and object/subj, delete and obj/subj, provide read/grant/delete/transfer access.

Usually defined in an Access Control matrix

24
Q

TCSEC

A

repealed and replaced by Common Criteria. Orange book. Focused on confidentiality

Trusted Computer System Evaluation Criteria. Part of Rainbow Series

Categories:

  • A: verified protection. Highest level of security
  • B: mandatory protection
  • C: discretionary protection
  • D: minimal protection. Reserved for systems that have been evaluated but do not meet other category requirements

Levels

  • D: Minimal Protection
  • C1: Discretionary Protection
  • C2: Controlled Access Protection
  • B1: Labeled Security
  • B2: Structured protection
  • B3: Security domains
  • A1: Verified protection
25
Q

ITSEC

A

European model. Replaced with Common Criteria. Address CIA. Doesn’t required TBC. Coverage for maintaining targets of evaluation after changes without re-evaluating.

Functionality of system rated F-D to F-B3.
Assurance from E0 to E6.

26
Q

Common Criteria

A

ISO 15408. Protection Profiles + Security Targets

PPs: security reqs and protections for a TOE. “I want”
STs: claims of security from the vendor. “I will”

3 parts:

  1. Intro and General Model
  2. Security Functional Requirements
  3. Security Assurance

EALs (eval assurance levels), EAL1-7.

27
Q

Rainbow Series

A

Orange book: TCSEC
Red book: TCSEC for network connected systems.
Green book: password management guidelines.

Yellow: Guidance for applying TCSEC to spec environments
Tan Book: Audit in trusted systems

28
Q

Discretionary protection

A

Categories C1-C2 of TCSEC.
Systems provide basic access control. Lacking more sophisticated/stringent controls.

C1: Discretionary security protection: controls access by User IDs/groups. Weaker

C2: Stronger than C1. users must be identified individually to gain access to objects. Enforces media cleaning.

29
Q

Mandatory Protection

A

Categories B1,B2,B3

Provide more security controls than C or D systems. Based on Bell-LaPadula.

Labeled Security B1: each subj/obj has a label. Sufficient for classified data

Structured protection B2: B1 + no covert channels. Process isolated maintained, operators/admin functions are separated.

Security Domains B3: Further separate and isolate unrelated processes. Secret data.

30
Q

Verified Protection

A

Category A1

Similar to B3, difference in dev cycle. Each phase of design is documented, evaluated, and verified before next step.

31
Q

Certification

A

First phase in total evaluation process. Comprehensive evaluation of the technical and nontechnical security features of an IT system, other safeguards made in support of accrediation process.

Select criteria > apply to system components > eval results.

32
Q

Accreditation

A

Degree to which system/cert meets the needs of an org Formal declaration.
Often done by 3rd party

33
Q

Risk Management Framework (RMF)

A

DoD standard for cert/accredit

34
Q

Committee on NS Systems Policy (CNSSP)

A

Standard for all other USG depts, consultants.

35
Q

Cert/Accred systems phases

A
  1. Definition. Assigning personnel, documentation of mission need, created of a System Security Authorization Agreement (SSAA)
  2. Verification. Refine for SSAA, cert analysis
  3. Validation. Certification, development of a recommendation to the DAA, accreditation decision
  4. Post Accreditation. Maintenance of SSAA, change man, etc.
36
Q

Memory Protection

A

A security capability of Info Systems.

Used to prevent an active process from interacting with an area of memory that was not specifically assigned/allocated to it.

37
Q

Virtualization

A

Host multiple OSs within memory of a single host.

38
Q

Trusted Platform Module

A

TPM: both specification for cryptoprocessor chip and name of impl of the specification.

TPM chip used to store and process crypto keys for purposes of a hardware supported/implemented hard drive encryption system.

39
Q

Interfaces

A

constrained/restricted interface. Restricts what users can do or see based on privileges.

40
Q

Fault Tolerance

A

Suffer a fault but continue to operate.

Add Redundant Array of Inexpensive Disks (RAID), or additional servers.

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions