Security Architecture and Design Flashcards
Linux/Unix File Permissions (3)
- Read (r)
- Write (w)
- Execute (x)
NTFS Permissions (5)
- Read
- write
- Read & Execute
- Modify
- Full Control
*nix Privileged Programs
- setuid (set User ID) : Makes an executable run with the premissions of the file’s owner and NOT the running user.
- setgid (set Group ID): programs run iwth the permissions of the file’s group.
passwd
This *nix program runs as root allowing users to change their passwords.
Define “Virtualization”
Virtulization adds a software layer between an OS and the underlying computer hardware. This allows mulitple “guest” operating systems to run simultaneously one one physical “how” computer
Types of Virtualization (2)
- Transparent Virtualization (Full Virtualization) - Runs on stock OS (e.g. Windows, Ubuntu) as virtual guest. No changes to the OS are required.
- Paravirtualization - Requires changing the guest OS
Hypervisor
Virtualization Security - controls access between virtual guests and host hardware.
- Type 1 hypervisor (bare metal) - is part of an OS that runs directly on host hardware.
- Type 2 hypervisor - runs as an application on a normal OS.
VMEscape
The risk of virtualization escape - where an attacker exploits the host OS or a guest from aonther guest.
Many network-based security tools (e.g. NIDS) can be blinded by virtualization.
Three common Cloud Service levels
- Infrastructure as a Service (IaaS)
- Platorm as a Service (Paas)
- Software as a Service (SaaS)
Thin Client
Thin Client Applications
Thin clients are system which rely on central servers for OS, kernel, applications, etc. May be a diskless workstation
A Thin Client Application run a system with full OS but use a web browser as a universal client providing access to application downloaded from the thin client server. Typically use TCP port 80 (http) and 443 (https)
TEMPEST
NSA standards for shielding electromagnetic emanations from computer equipment
Buffer Overflow
These occur when a programmer fails to perform “bounds checking”. That is, if a given input excedes the prescribed length, then excess input may overwrite the memor buffer.
TOCTOU/Race Conditions
Time of Check, Time of Use attacks. An attacker attempts to alter a condition AFTER it has been checked by the OS but BEFORE it is used.
Backdoors
A shortcut in a system that allows a user to bypass security checks to log in. Attackers may install a backdoor after gaining access to a system.
A maintenance hook is a type of backdoor using by system designers and programmers during development.
Malware
Malicious Code
A generic term for any type of software that attacks an application or system. Includes viruses, worms, trojans and logic bombs
Computer Virus
Viruses require a carrier to infect a system. Often introduced via human contact.
Worms
Malware that self-propagates. Typically cause damage in two ways.
- First, from the malware they deliver to a system
- Secondly, from the loss of network availability they cause from aggressive self-propagation
Trojan
Malware that performs TWO functions
- One is begnin (the carrier program), such as a free computer game
- One is malicious - often launched from the begnin program
Rootkits
Malware that replaces protions of the kernel and/or OS. A user-mode rootkit operates in ring 3 on most systems. commonly rooted binaries include the “ls” or “ps” commands. Also “dir” or “tasklist”
A kernel-mode rootkit replaces the kernel or loads malicious loadable kernel modules. Operates in ring 0.
Packers
Provide runtime compression of executables. The original exe is compressed and a small executable decompresser is prepended.
Many types of malware use packers to evade signature-based malware detection.
Logic Bomb
A malware program that is triggered when a specific condition is met. For example, a set number of transactions, a specific date and time, etc.
Server-side Attack
Attacks launched directly from an attacker to a listening service. For example, the Conficker worm attacked TCP port 445.
Server-side attach exploit vulnerabilties in installed services.
Client-side Attach
Attacks that occur when a user downloads malware. Client-side attacks initiate from the victim who downloads content from the attacker.
Java
An object-oriented language. Platform independent, interpreted by the Javal Virtual Machine (JVM). Java applets run in a sandbox - which segregates the code from the OS.
ActiveX
Applets, like JAVA. A Microsoft technology available only on Windows OS. Uses digital certificates instead of a sandbox to provide security.
Polyinstantiation
Allows two different objects to have the same name (databases).
Inference and Aggregation
Inference requires dedution. Based are “clues” a conclusion may be inferred.
Aggregation asks every questions and receives every answers. Phone directory example - performing every lookup and reverse lookup t aggregate the entire phonebook.
Bell-LaPadual Model
Data protection model - focuses on maintaining the confidentiality of objects. Operates using two rules.
- Simple Security Property - there is no READ UP.
- *Security Property - There is no WRITE DOWN. SIPR system cannot send email to NIPR system.
Biba Model
Business version of Bell-LaPadula. Focuses on integrity instead of confidentiality. Two simple rules:
- Simple Integrity Axiom - No Read Down
- *Integrity Axiom - No Write Up
Clark-Wilson Model
Another integrity model. Uses two concepts to ensure security policy is enforced.
- Well Formed Transactions
- Separation of Duties
Orange Book
National Computer Security Center (NIST) and NSA,
Trusted Computer System Evaluation Criteria (TCSC)
Provides defined computer security standards and definitions for systems. Classes A - C
- D: Minimal Protection
- C: Discretionary Protections (DAC)
- B: Mandatory Protection (MAC)
- A: Verified Protection
Red Book
Trusted Network Intrepretations (TNI)
Security standards for networks.
PCI-DSS
Payment Card Industry Data Security Standard
Security standards for payment cards
Core Principals:
- Build and maintains secure network
- Protect cardholder data
- Maintain a vulnerability management program
- Implement strong access control measures
- Regularly monitor and test networks
- Maintain an INFOSEC policy
What type of memory is used often for CPU registers?
Cloud Computing - Services
- Infrastructure as a Service (IaaS) - Hosted OS
- Platform as a Service (Paas) - Web service hosting
- Software as a Service (SaaS) - Webmail
Layering
Secure Software Design Concept
Separates hardware and softward functionality into modular tiers.
- Hardware
- Kernel and device drivers
- OS
- Applications
Abstraction
Secure System Design Concepts
Hides unnecessary details from the user. The users does not see the details of a “click” or action.
The Ring Model
CPU hardware layering model
- Ring 0 - Kernel
- Ring 1 - OS components
- Ring 2 - Device drivers
- Ring 3 - User applications
Multitasking & Multiprocessing
- Multitasking - Multiple tasks run simultaneously on ONE cpu
- Multithreading - Running multiple threads on ONE cpu
- Multiprocessing - Runing multiple processes on multiple cpu’s.
