Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Database Theory And Design > Security > Flashcards

Security Flashcards

Just pain and suffering really

1
Q

What are some methods of authentication

A

-Something you know(Password)
-Something you are(Biometrics)
-Something you have(keycard)
-Context location(e.g current location)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Passwords are widely used but hard to remember - good passwords should be long and random. What should good systems do in regards to passwords?

A

They should:
-Allow passwords to be an arbitrary length
-Store passwords hashed and salted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What should good two factor authentication do?

A

Should combine the known and the unknown
E.g password and generated key sent via email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why is Biometric security not that useful upon further inspection

A
  • Once data is leaked Biometrics are useless
  • No longer all that hard to replicate Biometrics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Access control models are created to ensure only certain users have access to certain features, what is an example of a simple request.

A

AC = subject x object x request
E.g (Will, Ecm_2426_Exam, set)
where Subject is the set of users of a system, Object is the set of resources (to which access should be controlled), and Request is the set of possible actions
(e.g., read, write) a user might want to apply to a resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How can roles be applied to an access control module to help reduce the stress of large systems

A

Roles can be created, each having different permissions that allows them to do different tasks. Roles can then be applied to users who inherit their permissions, this means each user no longer needs a long list of their allowed permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the fundamental goals of information security

A

Confidentiality: Protecting information from disclosure to unauthorized parties.
Integrity: Protecting information from being modified by unauthorized parties.
Availability: Ensuring that information is available (accessible) to authorized parties.
(CIA triad)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why is the CIA triad hard to implement in actuality?

A

A system that is very secure, preventing all access to stored information, might not have a good availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define identification

A

Associating an identity with a subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define Authentication

A

Verifying the validity of something (usually the identity claimed by a system entity).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define Authorization

A

Granting (or denying) the right or permission of a system entity
to access an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define Access control

A

Controlling access of system entities (on behalf of subjects) Access to objects based on an access control policy (“security policy”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Name some potential issues with using passwords

A

-It can be hard to keep them secret when attackers are using social engineering attacks
-Users may choose passwords that are weak and easy to remember over secure passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define a policy enforcement point(PEP)

A

The enforcement of access control happens in each layer in a component called policy enforcement point policy enforcement (PEP). For deciding if a specific request should be granted or not, the PEP contacts a (central) policy decision point (PDP) that manages and evaluates the access control policy of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Policy decision point (PDP)

A

manages and evaluates the access policy decision point (PDP) control policy of the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does an access control policy define?

A

An Access control policy defines access control policy
what is allowed (or forbidden) in a system, it is similar to a set of rules or laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How does the Access control matrix work

A

The access control matrix is based on the idea of privileges of subjects on objects.
Examples for subjects, objects, and privileges are:
Subjects: users, processes, agents, groups, …
Objects: data, memory banks, other processes, files, …
Privileges: right to read, write, modify, …

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How can a security policy that uses an access control matrix be described

A

As a table, there is a column for each file and a row for each user. The table describes the permissions that the user has and the operations they can perform on this file. However this isn’t feasible for large systems as it will grow quadratically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In Role Based Access Control(RBAC) we have this equation, what does it mean.
AC := PA ◦ UA

A

ROLES is the set of roles,
USERS is the set of users (subjects),
UA ⊂ USER × ROLES is a relation mapping users to their roles, and
PA ⊂ ROLES × PERMSSON is a relation mapping roles to their permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How can i add hierarchies to RBAC?

A

To define hierarchic RBAC, we introduce a relation RH ⊂ ROLES × ROLES that defines the role hierarchy
For example RH {(lecturer, student), (demonstrator, student)}
-Demonstrator and lecturer will assume all the permissions of students

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define data classification in access control

A

Instead of grouping objects we group subjects with permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does Break-Glass access control mean

A

That access control can be overridden if needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Discretionary access control

A

Discretionary access control (DAC): owners can chance permissions
- for example Unix/Linux file system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is usage control

A

Usage control is controlling how documents are used, not who can use them. E.g you can read a book but not forward it or you are allowed to watch a movie only three times a week

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How can access/usage control be overridden

A

Denied access can be overridden by a user, accepting liability that their actions can be logged. Often referred to as break glass access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Refined vs course break-glass access Control

A

Refined has a greater integration of break-glass into
various access control models by using pre-defined emergency levels that can be activated or de-activated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define Cryptography, Steganography and Cryptanalysis

A

Cryptography: the science of secret writing,i.e., cryptographers design messages that can only be read by certain people knowing a secret. The encrypted message does not need to be kept secret.

Steganography: the science of hiding messages in other messages or images, e.g., one can hide a message by encoding its content in the least significant bits of an image. Steganography is different from cryptography.

Cryptanalysis: the science of analyzing a cryptographic system to break/circumvent its protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does Cryptography allow us to establish communication channels with?

A

Confidentiality, integrity, and authenticity even in the presence of an attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define Asymmetric encryption and why it works

A

Key1 != Key2
(cannot be easily derived from each other)
The public key (Key1) can be published without compromising the private key (Key2)
Without the knowledge of the necessary key, the (decryption)
operation should be computationally (very) hard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define a Ceaser cipher

A

Each plaintext character is replaced by the character
three to the right modulo 26

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Why are substitution cipers easily cracked?

A

Due to frequency analysis of letters

32
Q

How can subsitiution cipers be improved?

A

By adding multiple symbols/ letters for each letter in the plaintext, this is called a homophonic Substitution Cipher

33
Q

What is a polyalphabetic Substitution Ciper?

A

Another idea to make frequency analysis harder, is to conceal distribution using a family of mappings

34
Q

What is a one-time-pad and one advantage of using one

A

Where a plaintext is converted to binary and then encrypted with a binary string via XOR.
If the one time pad key is only used once it is unconditionally unbreakable

35
Q

Why are one-time-pads(Vernam Cipher) unreusable?

A

They can be attacked using a frequency analysis

36
Q

Can frequency analysis be used on a transposition ciper?

A

Yes as transpositions r do not change plaintext alphabet and, hence, the frequencies of the elements of the plaintext alphabet

37
Q

Can we create a better cipher by using two substitution and transpositon ciphers?

A

combining two substitution ciphers does not result in a better cipher. Similarly, combining two transposition are really only one transposition. However combining substitution and transposition ciphers does create a better ciper

38
Q

Why are ciphers often developed in the public

A

So cryptoanalysts can attempt to break them and provide feedback, additionally to ensure that there are no secret backdoors involved

39
Q

What are the steps required to encrypt something in RSA

A

Generate a public/private key pair:
1. Generate two large distinct primes p and q.
2. Compute n = pq and φ = (p − 1)(q − 1).
3. Select an e, 1 < e < φ, relatively prime to φ.
4. Compute the unique integer d, 1 < d < φ where ed mod φ = 1.
5. Return public key (n, e) and private key d.

Encryption with key (n, e).
1. Represent the message as an integer m ∈ {0, . . . , n − 1}.
2. Compute c = me mod n.

Decryption with key d: compute m = c
d mod n

40
Q

Define modification detection code

A

Allows to check if a message has been altered during sending, the receiver can compute the hash of the message and compare it with the code given by the sender. This only works assuming the hash is hard to forge

41
Q

A hash function is a cryptographic hash function if it is:

A

-One-way(pre image resistant) Given y, it is hard to compute an x where h(x) = y.

And usually either
2nd-preimage resistance It is computationally infeasible to find a second input that has the same output as any specified input, i.e., given x to find an x^1 != x such that h(x) = h(x^1).
Collision resistance (implies 2nd-preimage resistance) It is difficult to find two distinct inputs x, x^1 where h(x) = h(x^1).

42
Q

What is a Ciphertext only attack and what are some techniques used?

A

An attack in which the attacker has only access to the
ciphertext and tries to gain access to the plaintext. Techniques for mounting a ciphertext only attack include brute force attacks (i.e., testing of all possible combinations) or frequency analysis (e.g., used on character or word frequencies).

43
Q

What is a known plaintext attack and what are some methods used??

A

A known plaintext attack (PKA) is an attack in which the attacker has access to attack (PKA) a plain text (could be a part of a message) and
the cipher text of the plain text (or a message containing the plain text and tries to get access to the encryption key. Modern ciphers are not susceptible to KPA

44
Q

What is a random number generator attack?

A

Works on the premise that numbers that are randomly generated are not totally random and instead based on physical sources of entropy. Meaning it’s possible to reduce the level of computation needed to derive the key

45
Q

What are some reasons not to invent own cryptographic algorithms

A

-complicated maths
-must be fast and efficient
-depends on subtle assumptions

46
Q

What is cipher block chaining?

A

Making the encryption of each block dependent on the value of the previously encrypted block

47
Q

What does the phrase it’s hard to make collisions mean in cryptographic hashing?

A

It’s difficult to find two inputs that create the same has value, the security of the hash function is measured by how hard it is to create collisions

48
Q

What does a digital signature schema need to provide?

A

Signing procedure:: A creates a signature for m ∈ M by: Compute s = SA(m) and transmit pair (m, s).
Verification procedure: B verifies A’s signature of (m, s) by: Compute u = VA(m, s). Accept signature only if u = true.

49
Q

A Public Key Infrastructure (PKI) is an infrastructure that allows principals to recoginize which public key belongs to whom, what does a user need to join the PKI

A

The user needs to:
-have their own public/private key pair
-Take their public key to a certification authority and bind the public key to themselves
-The CA verifies the user is who they say and signs a certificate that says that their public key is valid
then:
any other user can check the certificate to obtain the original users public key

50
Q

Describe how the homomorphic property can be used to exploit RSA

A

The product of two cipertexts is equivalent to the encryption of the product of the corresponding plaintexts

51
Q

What is a simple case where an SQL injection can be used?

A

The addition of ‘ OR 1 = 1 - in the username field with a blank password to bypass the password check
If the site would constructs a query like “SELECT token FROM users WHERE user = ‘“+user+”’ AND password = ‘“+pass””’”
The resulting string would be
SELECT token FROM users WHERE user = ‘bob’ AND password = “ OR 1=1 -‘

52
Q

What are the stages in the Secure Software development lifecycle

A

Preparation
Development
Security testing
Transition
Ulitization

53
Q

In the SSDL what is the preparation phase?

A

Trainings for developers and managers need to raise
awareness for the security implications of using third party software during product development. Scurity implications of using third party software during product development. During Risk Identification, the development teams, together with the local security experts, organize, e. g., threat modeling workshops. During the risk and threat identification, the application specific risks of the third party components and their attack surface needs to be identified.

54
Q

In the SSDL what is the Development phase?

A

Includes a security testing strategy that ensures security measures are implemented correctly.
This stage is the actual development of software components that should take security into consideration right from the beginning. This includes defensive programming techniques as well as measures for secure consumption of 3rd part libraries

55
Q

In the SSDL what is the Security testing phase?

A

Executes the security testing plan and the results are documented in a security testing report. Will cover the whole product incuding 3rd party components.

56
Q

In the SSDL what is the Transition phase?

A

Security validation team acts like the first customer and executes a security analysis and test of the final product. This could include an architectural security analysis, code reviews or penetration tests. All security issues must be fixed

57
Q

In the SSDL what is the Utilisation phase?

A

The Security response team handles communication with customers and external security and ensures the dev and maintenance team fix all reported issues

58
Q

What does a CVE(common Vulnerabilities and Exposures) entry contain?

A

textual description of the vulnerability
description of the affected software and version
type of vulnerability (CWE)
patch/fix instructions (if available)
availability of an exploit (a proof of concept that shows how to make use of a vulnerability)
standardized risk assessment: CommonVulnerability Scoring System (CVSS)

59
Q

What is the Common Vulnerability Scoring System?

A

Industry standard for rating the severity of software vulnerabilities. Focuses on three areas of concern:
-Base Score Metrics: assessing exploitability and impact
-Temporal Score Metric: assessing current status (may change over time)
-Environmental Score Metrics: assesses the environment of the vulnerable system

60
Q

What is a case where an XML injection can be used

A

I’m not sure when tho icl

alert(document.cookie)
in the title of the message box
61
Q

What are the scores in the Common Vulnerability Scoring system?(scored from 0 -10 )

A

Access Vector - shows how vulnerability may be exploited
Attack Complexity - how easy it is to exploit a vulnerability
Privileges required - how many layers of authentication an attacker must pass
User interaction - : Is an action by a user different than the attacker required
Scope (S): Can the vulnerability impact other components or systems
Confidentiality (C): impact on the confidentiality of the processed data
Integrity (I): impact on the integrity of the system
Availability (A): impact on the availability of the system

62
Q

What is the difference between static and dynamic security testing?

A

Static security testing testing is done automatically via a program while dynamic is done manually using tools.
static is typically conducted during early stages of development while dynamic is later
Static can cover the entire codebase as it analyses the source ode while dynamic only covers behaviour during runtime

63
Q

Define the halting problem

A

states that we cannot build
a computer program that takes an arbitrary computer program as input and decides, if that program terminates for a given input or not.

64
Q

What is an issue with too many false positives in security testing tools?

A

“The boy who cried wolf problem”
-Developers can be overwhelmed with too many false positives, making it challenging to prioritize issues
-Loss of trust in tool accuracy
-Failure to prioritise real threats
Increased costs

65
Q

What is an issue with not enough false positives in security testing tools?

A

-Actual vulnerabilities can go undetected
-Incomplete security coverage
-There is a potential that vulnerabilities could be exploited

66
Q

What is mutation based fuzzing and what’s some advantages

A

Mutate existing data samples to create test data
Advantages:
easy to setup and automate
requires little to no knowledge of the input format/protocol
Disadvantages:
effectiveness limited by selection of initial data set
has problems with file formats/protocols that require valid checksums

67
Q

What are some problems with dynamic security testing tools?

A

Dynamic test require a (dedicated) test system (it can take weeks or even month to get one …)
Dynamic test need to parse the output of the system under test (again, a parsing problem)
Dynamic tests need to generate input for various frameworks, which are often less standardised as programming languages (e.g., XML, REST, ODATA,
generating good test cases is hard

68
Q

What is stride modelling

A

STRIDE:
Spoofing Identity
Tampering with Data
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

69
Q

What is the definition of the things in stride modelling
STRIDE:
Spoofing Identity
Tampering with Data
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

A

Definition 13.2.1 (Spoofing Identity). An example of identity spoofing is illegally accessing and then using another user’s authentication information, such as username and password. „
Definition 13.2.2 (Tampering with Data). Data tampering involves the malicious modification of data. Examples include unauthorized changes made to persistent data,
such as that held in a database. „
Definition 13.2.3 (Repudiation). Repudiation threats are associated with users who
deny performing an action without other parties having anyway to prove otherwise.
„
Definition 13.2.4 (Information Disclosure). Information disclosure threats involve
the exposure of information to individuals who are not supposed to have access to
it. „
Definition 13.2.5 (Denial of Service). Denial of service (DoS) attacks deny service
to valid users—for example, by making a Web server temporarily unavailable or
unusable. „
Definition 13.2.6 (Elevation of Privilege). In this type of threat, an unprivileged user
gains privileged access and thereby has sufficient access to compromise or destroy the entire system.

70
Q

What does DREAD stand for?

A

Damage: How big would the damage be if the attack succeeded?
Reproducibility: How easy is it to reproduce an attack?
Exploitability: How much time, effort, and expertise is needed to exploit the threat?
Affected Users: If a threat were exploited, what percentage of users would be affected?
Discoverability: How easy is it for an attacker to discover this threat?

71
Q

What are some things we need for threat modelling?

A

-Knowledge of how data flows
-attackers goals
-how to defeat an attack, e.g. planned security techniques
- team of experts
-a structured process so no aspects get forgotten

The result of threat modelling should be a list of identified threats with the severity, description, catagory, likelihood and a mitigation strategy

72
Q

Define full disclosure

A

Publish vulnerabilities to the public immediately
-creates pressures on vendors to fix the vulnerabilities immediately

73
Q

Define Responsible Disclosure

A

Publishing vulnerabilities after a mitigation period to the public.
Creates pressures on vendors to react within mitigation period typical mitigation period: 90 days (might be negotiated, case by case, with vendor)
Allows vendors to distribute patches to their customers “in private”
If they fail to react, vulnerability is published without restrictions

74
Q

Advantages of bug bounties

A

Guides researchers to look for vulnerabilites and rewards them

75
Q
A

Database Theory And Design (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions