Security Architecture and Engineering Flashcards
Which type of public key (Asymmetric) algorithm are “quantum resistant”?
Lattice
3 Categories of Fire Detection
- Smoke Sensing
- Flame Sensing
- Heat Sensing
Types of Ciphers
Stream cipher
Block cipher
Substitution Cipher
API types
- REST
- Web
- SOAP
In REST API, What REST stands for…
Representational State Transfer
About REST API
- REST Architectural Style
Web Services for; Web, mobile and desktop applications - Uses HTTP; GET POST PUT DELETE
- Uses JSON and XML
- Stateless client-server model
- Scalable and Easy to maintain
When to use REST API?
- Non complex simple applications uses CRUD ops
- Building web services that require a stateless, scalable, & easy-to-main architecture.
- Apps with CRUD(creating, reading, updating & deleting data)
- e.g. WhatsApp
What is Web API?
- Stateless or Stateful
- Primary purpose is to provide a platform-independent interface
- it uses HTTP, HTTPS, and TCP/IP to communicate between the clients and servers
- Doesn’t follow a special architecture or structure
- Flexible interface
- Good for complex applications with integration
When to use Web API?
When building complex applications that require integration with different systems and technologies
SOAP (API) stands for
Simple Object Access Protocol
About SOAP API
- Used for exchanging structured data between different applications
- uses XML
- Wide range of data types; text numbers, dates and binary
- Supports; HTTP, SMTP, and FTP
- Set of rules
- WSDL or UDDI protocol
- Digital Signatures
- Enterprise level apps
When to use SOAp?
- Apps require a highly secure and reliable method of exchanging data between applications.
- Complex data structures and logic apps
- Digital Signatures and Encryption
CASB stands for
Cloud Access Security Broker.
It is a security policy enforcement solution
CASB - 2 Primary deployment methods
- On Premise based solution
- Cloud based solution
CASB Roles
- Provide Visibility into cloud use. Shadow IT
- Data Loss Prevention (DLP) Services
- Inject Encryption into the cloud
Which type of encryption algorithms hold up to the power of Quantum Computing
- Symmetric
- Shared key, bulk encryption (fast)
- Holds up fairly well to quantum computing
Code Vs. Cipher
- Code is sometimes secret and dont always provide confidentiality
- Ciphers are always mean to hide the true meaning of a message
Example of Stream Ciphers
Caesar
Vigenere
One-time pad
(Difference is key length)
Fast and Strong Crypto keys
- Symmetric —> Fast
- Asymmetric —> Strong
HASH function Requirements
- They must allow input of any length
- Provide fixed-length output
- Make relatively easy to compute the hash function for any input
- Provide one-way functionality
- Must be Collusion free.
DoS Examples
- SYN Flood attack
- Smurf attack
- Ping-of-death attack
- Teardrop attack
- Fraggle attack
- Land Attack
An Architecture describes
- The designed structure of something.
- A system architecture, then, is a description of how specific components are deliberate put together to perform some actions.
Client-Based Systems are
Embodied in applications that execute entirely on one user device such as workstation or smartphone.
Sever-Based Systems ( client/server systems)
Require that two or more separate applications interact with each other across a network connection in order for users to benefit from them.
A Database Management System (DBMS) is a
Software system that allows you to efficiently create, read, update and delete (CRUD) any given set of data.
DBMS transactions
Which a term describes the sequence of actions required to change the state of the database.
A foundational principle in database transactions is referred to as their ACID Properties, which stands for:
- A - atomicity: Entire transaction succeed or roll backs
- C - consistency: strictly follows all applicable rules
- I - isolation: parallel transactions happen in isolation to avoid corruption
- D - durability: completed transactions stored.
DBMS: database introduces 2 specific issues:
- Aggregation: is an act of combining information from separate sources.
- Inference: is the ability to derive information not explicitly available
DBMS:
- content-dependent access control
- context-dependent access control
- content-dependent access control: is based on the sensitivity of the data
- context-dependent access control: that software understands what actions should be allowed based on the state and sequence of the request
High-Performance Computing Systems
HPC is the aggregation of computing power in ways that exceed the capabilities of general-purpose computers for the specific purpose of solving large problems.
Industrial Control Systems ( ICS)
Consist of information technology that is specifically designed to control physical devices in industrial processes.
Paramount of the Industrial Control Systems (ICS) is
- Safety of the workers
- Availability
A good resource for ensuring ICS (Industrial Control Systems) safety, security, and availability is NIST….
NIST SP 800-82 Revision 2
Industrial Control Systems (ICS) 3 devices
- Programmable Logic Control (PLC)
- Human-Machine Interface (HMI)
- Data Historian
Distributed Control System (DCS) is a
Network of control devices within fairly close proximity that are part of one or more industrial processes.
Supervisory Control and Data Acquisition (SCADA) systems were…
Developer to control large scale physical processes involving nodes separated by significant distances.
Main Conceptual differences between DCS and SCADA are
Size and distances.
SCADA systems typically involve three kinds of devices:
- Endpoints (Remote Terminal Unit)
- Backends (Data acquisition server)
- User Stations (Human Machine Interface)
The most important principle in defending OT systems is to isolate them from the….
Public Internet, either logically or physically
Virtual systems are…
Those that exist in a software-simulated environments
Virtual Machines (VMs) are..
Entire computer systems that reside inside a virtual environment.
Hypervisor is the…
Central program that controls the execution of the various guest operating systems and provides the abstraction level between the guest and host environments
Type 1 Hypervisor…
Runs directly on hardware or bare metal and manages access to it by its VMs.
Type 2 Hypervisor…
Runs as applications on OS
Hypervisors allow you to have…
One computer running several different operating systems at one time
Containerization
- As Virtualization matured, a new branch called containerization emerged. A container is an application that runs in its own isolated user space.
Example of Container
(Big names)
- Dockers on the commercial side
- Kubernetes as the open-source alternative
NIST on Container…Application Container Security Guide
NIST SP 800-190
Microservices…
A common use of containers is to host microservices, which is a way of developing software where, rather than building one large enterprise application.
Microservices….log aggregation
Where as Microservices are decentralized, we want to log them in a centralized fashion so we can look for patterns that spans multiple services and can point to malicious intent.
Serverless
In a server-less architecture, the services offered to end users, such as compute, storage, or messaging, along with their required configuration and management, can be performed without requirement from the user to set up any server infrastructure.
Cloud Computing is the
Use of shared, remote computing devices for the purpose of providing improved efficiencies, performance, reliability, scalability, and security.
Generally three models for cloud computing services, they are
- Software as a Service (SaaS)
- Platform as a Service (PaaS)
- Infrastructure as a SeService (IaaS)
Cloud Deployment Models
- A Public Cloud
- A Private Cloud
- A Community Cloud
- A Hybrid cloud
Pervasive Systems
Pervasive Computing ( ubiquitous computing or Unicomp) is the concept that small (even tiny) amounts of computing power are spread out everywhere computing is embedded into everyday objects that communicate with each other, often with little or no user interaction, to do very specific things for particular customers.
Embedded systems
(aka Cyber-Physical Systems)
Is a self-contained computer system ( that is, it has its own processor, memory, and IO devices) designed for very specific purpose.
IoT (Internet of Things)
IoT is the global network of connected embedded systems.
Each node is connected to the internet and is uniquely addressable
Issues with IoT
- Authentication
- Encryption
- Updates
Distributed Systems
- Is one in which multiple computers work together to do something.
- we could then say that a distributed system is any system in which multiple computing nodes, interconnected by a network, exchange information for the accomplishment of collective tasks.
- Another approach to distributed computing is found in peer-to-peer systems, which are systems in which each node is considered an equal to all other.
Popular examples of peer-to-peer systems
- BitTorrent
- Onion Router (TOR)
- Cryptocurrency like bitcoin
Edge Computing Systems
Is a distributed system in which some computational and data storage assets are deployed close to where they are needed in order to reduce latency and network traffic.
Edge Computing architecture has 3 layers
- End devices
- Edge Devices
- Cloud Infrastructure
Cryptography is the
Practice of storing and transmitting information in a form that only authorized parties can understand
Cryptanalysis is the
Name collectively give to techniques that aim to weaken or defeat cryptography
Together Cryptography and Cryptanalysis comprise….
Cryptology
Around 600 B.C. Hebrew invented cryptographic method called….
atbash
atbash is an example of ________ cipher
Substitution
Mono alphabetic substitution uses
Only one alphabet
Polyalphabetic substitution cipher uses
Multiple alphabets
Around 400 B.C. the Spartans used a system of encrypting information in which
They would write a message on a sheet of papyrus (a type of paper) that was wrapped around a staff which was then delivered and wrapped around a different staff by recipient. Scytale cipher is and example transposition cipher
In Rome, Julius Caesar (100-44 B.C.) developed a simple method of shifting letters of alphabet…
Simply shifted the alphabet by three positions
DES (Data Encryption Standard) was used worldwide for financial and other transactions, and was embedded into numerous commercial applications. Adopted from…
IBM developed Lucifer
DES was cracked in ______, and after few years replaced by ______
1990s, Advanced Encryption Standard (AES)
