Security Flashcards
Strategies to reduce risk of data confidentiality
Provider ensured data fully destroyed
Multiple encryption keys
Logical isolation of multiple customers
Federated identity management
Arrangement between two or more trust domains
Use same digital idenity
Security risks of user identity federation
Less control over use lifecycle
Single point of failure
____ Identity Server can act as a hub that connects multiple identity providers to authenticate users to a particular service provider
WSO2
The Google ____ 2.0 system supports server-to-server interactions such
as those between a web application and a Google service
0Auth
Difference between WSO2 and 0Auth
0Auth supports server to server interactions
WSO2 acts as a hub, “more frontend”
RACI stands for
Responsible Accountable Consulted Informed Model
Bussiness COntinuty
Activity performed to ensure bussiness continues in case of disaster
What is it important contracts define froma bussienss continuity and resilience perspective
Recovery time
Objects
Monetary Penalty if downtime
BS 259999
Now ISO 22301
International Standard for implementing and maintaining effective business continuity plans
Usage of data consideration
- Personal died used without consent
- Data sent across borders
- No opt out features
- Lack of individual control
- Local law
What can be done to data to make it be used for more general purposes?
De-identification
Risks of multi-tenancy if managed uncorrectly
- Inadequate local seperation
- Co-mingled tenant data
- Uncoordinated change controls
- Performance risks
Visually descriobe a multi-tenant application
Ref img
Multi-tennacy - keys
Per Tenant Key management
What is important to manage risk
Third Party Assessments
In the event of a security incident, applications and services hosted at a Cloud provider are
difficul to investgate
distributed logging
Infrastructure Security Architecture- Cloud
Tiered zones
Only allow required access in each zone
Examples of third party audit lifecycle
Vulnerability identification
Results Analysis
Risk Assessment
Redmediation
Improving security of network and apps is referred to as
Hardening
Are non-prod enviroments immune to exposure?
No - even more at risk due to
generic authentication crdes
security flaws
then PIVOTING into production
Use cloud for secret app?
no
Security MEtric
Measurable value - how well company doing to reduce cyber security risks
Types of security metrics
Process
Network
Software
What do process security metrics usually refer to?
Measure processes and procedures
Compliance/Governance driven
Generally support better security
Actual impact hard to define
What type of security metric would be associated with the following:
No. of policy violations
% of systems with formal risk assessments
% of system with tested security controls
% of weak passwords
No. of identified risks and their severity
% of systems with contingency plans
Process Security Metric
Network Security Metric - common features
- Driven by products
- Readily available
- Widely used
- Gives sense of control
Examples of network security metrics
- Succesfull/unsucceful logs
- No of incidents
- No of cirus blocked
- No of virus inections
- No of port probes
- Traffic analysis
What type of security metric is associated with the following:
Successful/unsuccessful logons
No. of incidents
No. of viruses blocked
No. of patches applied
No. of spam blocked
No. of virus infections
Network Security Metric
Charateristics of software security metric
Complex
Context sENSITIVE
eNVIROMENT dEPENDENT
Levels of software seucrity metric
System Level
Design level
Code level
Follow are examples of what security metric?
Size and complexity Defects over time Cost per defect Layers of security Design Flaws
Software Security Metric
Threat Modelling to do with
Explore vulnerabiles, threats and create strategies for these
Who released Bitcoin
Pen name Satoshi Nakamoto 2008
What type of blockchain is bitcoin
Distributed ledger
Three parts of a chain in a blockchain
Data
Hash
Previous Hash
What ensures the integrity of a proof of work blockchain?
The number of blocks in chain - to change one piece of data would require to rehash the entire change, impossible
Explain how a blockchain links up
Ref to img
Different blockchain consensus mechanism
Proof of Work
Proof of Stake
Disadvantages of proof of work
Lack of speed
Poor Scalability
Inefficient Energy COnsumption
What consensus mechanism does Ethereum use
Proof of stake
Role of validators in Proof of Stake chain
no energy-intensive computational process to earn the right to validate. Instead of working to solve proofs of work, validators “stake” some of the blockchain’s native tokens to become eligible for selection as a validator node. The prospective validator will essentially stake crypto tokens native to the blockchain to serve as collateral.
Distributed LEdger TEchnology (DLT) is often associated with what type of blochain
Consortium / Private blockchain
Is hashing alone enough to secure a block chain? If not, what else is used?>
No
*Consensus Mechanism
*Distributed peer-to-peer network
Proof of work conesus mechanism
achieving agreement on Blockchain network to confirm transactions and addnew blocks to the chain
solve mathematical problem
How does adding proof of work increase bitcoin security?
Takes alot of time to recalculate each block
Centralized, Decentralized and Distributed Difference
Ref img
To succefully tamper with a proof of work blockchain you would have to
Temper with all blocks
Redo proof of work for each block
Take control of > 50% of peer-peer network to generate consensur
How can blochcain support confidentiality
encrypt block data
Future component of blocbhain
*Smart Contract - Get rid of need for intermedieries
*Blockbhain Cloud Storage
*IoT BLockchain
Smart Contract Use Cases
- Supply chain
- REal estate
- Insurnace
- Personal Identity
Describe Blockchain Cloud Storage
- Shard data
- Encrypt shards
- Distributed shards across nodes with synched ledger
- Record transactions on blockhain ledger
What is this an example of?
Smart Contracts in a supply chain
Each level validated it has received product and performed their respective process
