sth to rem Flashcards
Atomicity
Isolation
Consistency
Durability
Atomicity – Transaction must be rolled back if not complete (committed).
Isolation – One transaction must complete before other can modify the same data.
Consistency – Transactional changes must ensure that the DB is consistent to the rules (unique primary key etc.)
Durability – Transactions once committed must be durable. Backups such as transaction logs ensure durability.
Concurrency
Lost Updates
Dirty Reads
Concurrency – enables users to lock the database to prevent changes by others during a transaction.
Lost Updates – two different processes make updates to the DB without being aware of each others transactions causing errors. Isolation solves this.
Dirty Reads – Process reads from a transaction that did not commit. Atomicity solves this.
Polyinstantiation
Polyinstantiation –tuple’s having multiple values with identical primary keys based on Security Clearance, to prevent lower-level inference attacks.
Cell Suppression
Cell Suppression – Hide individual fields based on security clearance.
Aggregation
Aggregation – Use access to multiple low-level database to gain information. Basically, person asks every question, receives every answer and thus gains information. (No deduction needed) (One DB has Employee ID and name, other has Employee ID and Salary. Aggregation allows to identify Salary of each employee)
Inference
Inference – speculation of information based on some information. (Weapon shipment increase in DB records can infer a possible mission)
Referential Integrity
Semantic Integrity
Entity Integrity
Referential Integrity – every foreign key matches a candidate key in the parent table.
Semantic Integrity – each column attribute value is consistent with the attribute data type. (Date in date column)
Entity Integrity – every tuple has a primary key which is unique and not NULL
Software Escrow Agreement
Software Escrow Agreement
Archive Source code with a third-party repository, to protect the customer in case the software vendor goes out of business..
Change Management Process
Request Control: Organized framework for users to request modifications, managers conduct cost/benefit analysis and developers prioritize tasks.
Change Control: Framework for multiple developers to develop and test a solution before rolling into production.
Quality Control restrictions
Documenting code changes
Restrict new code to minimize security
Develop tools for deployment of change.
Release Control: Review code before release. Review includes:
Remove any backdoors.
Approval of change
User Acceptance Testing
Configuration Control: Ensures that changes to software versions are made in accordance with change control and configuration management process.
Updates can only be made from authorized distributions.
Configuration Management Process
Configuration Identification: Documentation of all software configuration within organization.
Configuration Control: Configuration changes follow change management.
Configuration Accounting: Track all authorized configuration changes.
Configuration Audit: Configuration documentation meets actual configuration
SEI SW-CMMI
Measures Software Development Maturity.
Required by US Agencies and Contractors
Initial: Processes are chaotic, unpredictable, poorly controlled, reactive.
Repeatable: Processes are characterized for projects but reactive. Basic lifecycle mgmt.
Defined: Processes are defined (written) and proactive.
Quantitatively Managed: Processes are defined and measured.
Optimizing: Processes are measured and improved.
Defect Prevention, Technology Change Management, Process Change Management
SEI IDEAL
IDEAL model for software development and Change management.
Initiating: Business reasons behind change, approval/support, requirements in place.
Diagnosing(診斷): Engineers analyze current state and make recommendations.
Establishing: Recommendations are developed into plan of actions.
Acting: Develop, test, refine and implement solution.
Learning: Continuous analysis of desired goals, new plans for achieving goals.
AGILE
Developed in response to rigid Development processes like Waterfall.
Individuals and interactions over processes and tools
Working software over comprehensive documentation
Customer collaboration over contract negotiation
Responding to change over following a plan
Sashimi
Overlapping Waterfall Model.
Steps overlap, leading to faster-integrated development cycle.
NIST SP 800-14
Generally Accepted Principles and. Practices for Securing Information. Technology Systems Initiation Development/ Acquisition Implementation Operation / Maintenance Disposal
SECURE SOFTWARE DESIGN
Fail-Open
Fail-Open: bypasses security at failure to allow operations to continue.
SECURE SOFTWARE DESIGN
Fail-Secure
Fail-Secure: puts system in high-security state at failure and does not allow operations until administrator diagnoses and resolves problems.
Database Backup
Electronic Vaulting
Electronic Vaulting: Remote site database backup using bulk transfers. Smaller time to backup to remote site, then sending tape.
Significant delay to recover as backup has to be obtained from vault and then restored.
Database Backup
Remote Journaling
Remote Journaling: Transaction logs backed up remotely. Some delay (ex.hourly), technicians retrieve logs transaction logs and apply to production DB.
Database Backup
Remote Mirroring
Remote Mirroring: Live Backup via copying any changes to the production database to the backup. (also called Shadowing)
No delay. Can be migrated as is.
Recovery Types
Trusted Recovery
Trusted Recovery: System is as secure as before failure or crash.
Recovery Types
Manual Recovery
Manual Recovery: If system does not fail in a secure state, an admin has to manually implement security before recovery.
Recovery Types
Automated Recovery
Automated Recovery: System performs trusted recovery activities against failure. Ex: RAID.
Recovery Types
Automated Recovery with Undue Loss
Automated Recovery with Undue Loss: System performs trusted recovery activities against failure, but also protects specific objects against loss.
Recovery Types
Function Recovery
Function Recovery: Systems that can automatically recovery functions.
e-Discovery Reference Model
eDiscovery Reference Model
- Identification :The identification phase locates relevant information but does not preserve it.
- Preservation :During the preservation phase, the organization ensures that information related to the matter at hand is protected against intentional or unintentional alteration or deletion.
- Collection :The collection phase occurs after preservation and gathers responsive information
- Processing :The processing phase performs a rough cut of the collected information for relevance.
- Review of the data to ensure it is relevant.
- Analysis of the data for proper context.
- Production of the final data set to those requesting it.
- Presentation of the data to external audiences to prove or disprove a claim.
Real Evidence
Physical, can be brought to court. (Hard disks etc)
Documentary Evidence
Original / copies of business records, computer-generated/stored logs. Must comply with Hearsay rule
Circumstantial Evidence
Doesn’t directly prove, but makes reasonable inference. (Tickets to the opera infers person was at opera)
Direct Evidence
Oral / Written Testimonial evidence witnessed by a persons 5 senses.
Demonstrative Evidence
Aid understanding of case via Expert opinion or non-expert facts.
Secondary Evidence
A duplicate copy such as photocopy, tape backup, screenshot, logs
Best-evidence
Best-evidence: Original, unaltered, requires integrity. Computer-generated records.
Hearsay-evidence: Inaccurate, unreliable, unable to prove integrity. Computer-stored records.
Hearsay-evidence
Best-evidence: Original, unaltered, requires integrity. Computer-generated records.
Hearsay-evidence: Inaccurate, unreliable, unable to prove integrity. Computer-stored records.
Federal Rules of Evidence states if data stored on pc, or printout is demonstrated to be accurate and reliable, it is ??
it is Best Evidence.
Enticement
Make a crime more enticing. Criminal already has mindset to commit crime. E.g. He has already hacked in, so Honeypot can be used to contain, gain knowledge.
Best Evidence Rule
Best Evidence Rule: Admissability
Parol Evidence Rule
Parol Evidence Rule – Only written agreements acceptable.
Hearsay Rule
Hearsay Rule – Hearsay evidence only admitted if maker of the statements is able to testify in court.
Best Evidence Rule
Competent / Legally Permissible
Obtained through legal means, and not via:
Illegal Search & Seizure: without warrant.
Illegal Wiretap & Phonetaps
Entrapment
Coercion: force to testify.
INVESTIGATIONS
Administrative Investigation
Administrative Investigations: Operational investigations to internal IT system faults, functions & processes. No set guideline for evidence. Evidence is Voluntarily Surrendered to investigation personnel.
INVESTIGATIONS
Criminal Investigation
Criminal Investigation: Evidence must meet Beyond a reasonable doubt, investigated by law enforcement.
INVESTIGATIONS
Civil Investigation
Civil Investigation: Evidence meets More likely than not, investigated by employees and consultants.
INVESTIGATIONS
Regulatory Investigation
Regulatory Investigation: Evidence meets Standard of proof, investigated by government or regulatory bodies if companies are suspected of violating compliance or administrative laws.
INVESTIGATIONS
Compliance Assessment
Compliance Assessment: Evidence meets Proof of compliance, Periodic assessment to meet compliance standards, investigated by third-party auditors appointed by regulatory bodies.
Evidence gathered for Investigation must maintain their ???
Integrity
Honeypots
Honeypots
Offer enticement to attackers, so that the attacker may spend time attacking the honeypot without gaining any information leading to discouragement.
Honeynet
Honeynet: Two or more networked honeypots to simulate a network.
PsuedoFlaws
PsuedoFlaws
False vulnerabilities or loopholes present in a system, enticing attacker to attack.
Padded Cell
Padded Cell
Detection of attack, attacker transmitted to virtual network with exact look and feel of real.
Security As A Service
Security As A Service: Managed Detection & Response, Vulnerability Assessment & Mitigation etc.
SYN Flood Attack
SYN Flood Attack
Sends multiple SYN packets, but does not respond to the SYN-ACK with an ACK.
Fraggle Attack
Fraggle Attack
Send UDP Port 7 and 19 traffic spoofing Victims IP as source. All hosts then send traffic to the victim.
Smurf Attack
Smurf Attack
Sends ICMP echo packets spoofing the Victim’s IP as source to a broadcast network via directed broadcast in a router. RFC 2644 defaults to no directed broadcast.
Sabotage(破壞)
Sabotage
Criminal destruction or disruption against an organization by an employee.
Espionage
Espionage
Spy and steal secrets / intelligence.
INCIDENT RESPONSE MANAGEMENT
Detection
First responders analyze to classify alarm as incident and Activate the CIRT. Reporting
Response
Investigate, Assess damage, collect evidence, determine the response (containment action)
Mitigation
Determine Cause that leads to RCA, take action to Contain incident and Eradicate to stop incident.
Reporting
Technical: Technical details of incident.
Non-Technical: Seriousness of incident to management.
Recovery
Restore system to operational status (BU approves). Monitor for persistence. Recovery in off-peak hours.
Remediation
Long term mitigation. Prevent Recurrance. Root cause Analysis. Eg: Password was compromised, mitigation changes password. Remediation adds Multifactor authentication.
Lessons Learned
Final Incident Report.
What could be done to prevent further incidents, response analysis, shortcomings, feedback.
INCIDENT RESPONSE MANAGEMENT
Root Cause Analysis
Determine what caused an incident: very critical to Mitigation, Recovery and Remediation. If root cause is not properly identified, an incident can persist for a longer time.
INCIDENT RESPONSE MANAGEMENT
CIRT
Computer Incident Response Team: Responsible for Investigation, Containment and Recovery.
NIST 800-61r2
Computer Security Handling Guide=>INCIDENT RESPONSE MANAGEMENT
Common Vulnerabilities and Exposures (CVE)
Standard convention to identify vulnerabilities among vendors. MITRE maintains the CVE database.
Change Review Board
Comprised of experts from different departments. Review and Approve/Reject a change.
CHANGE MANAGEMENT
Request Change Review Change(w/ Impact Analysis) Approve/Reject Test Implement Document
Types of Logs
Application Logs
Types of Logs
Application Logs: Related to application events.
Security Logs: Related to security events such as logon,lockout.
System Logs: Related to system events such as hardware errors.
Proxy Logs: Related to web events.
Audit Logs: Related to admin actions.
Types of Logs
Security Logs
Types of Logs
Application Logs: Related to application events.
Security Logs: Related to security events such as logon,lockout.
System Logs: Related to system events such as hardware errors.
Proxy Logs: Related to web events.
Audit Logs: Related to admin actions.
Types of Logs
System Logs
Types of Logs
Application Logs: Related to application events.
Security Logs: Related to security events such as logon,lockout.
System Logs: Related to system events such as hardware errors.
Proxy Logs: Related to web events.
Audit Logs: Related to admin actions.
Types of Logs
Audit Logs
Types of Logs
Application Logs: Related to application events.
Security Logs: Related to security events such as logon,lockout.
System Logs: Related to system events such as hardware errors.
Proxy Logs: Related to web events.
Audit Logs: Related to admin actions.
Duress
Duress: Duress(脅迫) systems for safety of personnel working alone or in remote area. (Signal to indicate hazard). Example: Code word for security guard if he is surrounded or in danger.
ADMINISTRATIVE SECURITY
Segregation of Duties
Segregation of Duties
No single person is completely responsible/assigned all functions of a process. Mandatory requirement of SOX compliance.
SOFTWARE TESTING
Fuzzing
Mutation Fuzzing
Fuzzing – Provides multiple invalid inputs to software to test it’s limits, in an attempt to produce crashes, vulnerabilities such as bounds, buffer overflows etc. Tools: zzuf
Mutation Fuzzing: Takes valid input, alters it and sends to the application.
Generational Fuzzing: Intelligent Fuzzing. Creates models based on the data types accepted by the program.
SOFTWARE TESTING
Fuzzing
Generational Fuzzing
Fuzzing – Provides multiple invalid inputs to software to test it’s limits, in an attempt to produce crashes, vulnerabilities such as bounds, buffer overflows etc. Tools: zzuf
Mutation Fuzzing: Takes valid input, alters it and sends to the application.
Generational Fuzzing: Intelligent Fuzzing. Creates models based on the data types accepted by the program.
SOFTWARE TESTING
Mutation(變異) Testing
Mutation(變異) Testing – Modifies a program in small ways and then tests the mutant to determine if it behaves as it should or fails. This is used to design new software tests and ensures the quality of the tests.
SOFTWARE TESTING
Interface Testing
Interface Testing – Tests the interfaces exposed by the application such as API, GUI for security vulnerabilities and proper handoff’s, data inputs.
Software Testing Levels
Acceptance Testing
Acceptance Testing: Software meets the customers / users requirements.
SOFTWARE TESTING LEVELS – COVERAGE ANALYSIS
Coverage Analysis
STRUCTURAL
STRUCTURAL
Branch Coverage: every branch at a decision point is TRUE or FALSE.
Condition Coverage: each Boolean expression is evaluated to both TRUE or FALSE.
Function Coverage: every Function or Subrotation is called.
Statement Coverage: every Statement is executed at least once.
Loop Coverage: every loop in the code to verify loop initialization problems, repetition issues, capacity/performance bottlenecks.
SOFTWARE TESTING LEVELS – COVERAGE ANALYSIS
Coverage Analysis
Functional
Functional
Normal Testing: Normal inputs (expected user behavior) are fed and results are tested with expected outcomes.
Misuse Case Testing: Wrong or unexpected inputs sent to program for testing robustness.
CODE REVIEW
Fagan Inspections
Planning Overview Preparation Inspection Rework Follow-up
SOFTWARE TESTING: STATIC & DYNAMIC
Dynamic
Dynamic Testing tests code while executing i.e. functions it performs, actions it takes.
Test code Actively.
Organizations deploying third party software typically use this approach.
SOFTWARE TESTING: STATIC & DYNAMIC
Static
Static Testing reviews raw source code looks for known insecure practices, functions, libraries or characteristics. Test code passively. Walkthrough Syntax Checking Code Review Lexical Analysis Control flow graphs Data Flow analysis Can use automated tools to perform Static Testing.
Internal Audits
Internal Audits
Performed by organization appointed auditors. Continual review of controls. Separate line of reporting to CEO/Business owners.
External Audits
External Audits
Performed by outside organizations. No conflict of interest. High validity. Big Four: E&Y, PwC, Deloitte, KPMG
Third Party Audits
Third Party Audits
Performed on behalf or conducted by another organization, like a regulatory body. Scope decided by the Third Party. Example: PCI-DSS, SOX
Auditing Standards
Auditing Standards
CoBIT – common security requirements for systems
ISO 27002 – granular specifics information systems security control
SSAE18 – SOC2
Type 1 – Point in time controls.
Type II – Period of time controls, testing. More reliable and preferred, auditor opinion
Soc3– Service Provider 3rd party audit.
NIST SCAP
NIST Security Content Automation Protocol (SCAP): interface with the NVD for vulnerability information exchange.
Common Vulnerabilities and Exposures (CVE)
Common Vulnerability Scoring System (CVSS)
Common Vulnerabilities and Exposures (CVE): naming system and describes vulnerabilities.
Common Vulnerability Scoring System (CVSS): Scoring for Severity.
NIST SP800-53A
NIST SP800-53A – Assessing Security & Privacy Controls:
Specifications: documents of system being audited, policies, requirements.
Mechanisms: Controls used to meet specifications.
Activities: Actions carried out by individuals, procedures and processes.
Individuals: People who access the system and perform the activities.
Whaling
Whaling
SpearPhishing for VPs, CXOs.
Spear Phishing
Spear Phishing
Targeted Phishing – specific users of an organization (RnD, Marketing). Considerable research before launching this attack. Involves exploits crafted for target. Awareness, Patching, reputation filtering.
DAC – Discretionary Access Control
DAC – Discretionary Access Control
Security of object is at Data Owner’s Discretion.
Access granted through ACL.
Owner of Object decides permission.
Identity based.
Subject has no knowledge of the object’s sensitivity.
Scalable and Flexible as each owner decides access.
MAC – Mandatory Access Control
MAC – Mandatory Access Control
Data Owners cannot grant access.
Security Labels of Subject and Object define decision.
Access granted by Security Officer.
Subject label must dominate Object Label.
Subject has knowledge of the object’s sensitivity.
Lattice-based Access control.
Can be compartmented further for Label+Compartment for enforcement of Need to Know.
3 Types: Compartmented, Hierarchical, Hybrid.
RBAC– Role Based Access Control
RBAC– Role Based Access Control
Group based Access Permissions.
Non-discretionary.
Each Role has a set of rights over objects as defined by the Data Owner.
The Security Admin configures the rights.
Subject focused.
RuBAC– Rule Based Access Control
RuBAC– Rule Based Access Control
Rule based – Global focused rules that apply to all subjects.
Called restrictions or filters.
If/then statements (group=admin allow social-networking time:800)
Attributed Based Access Controls
Attributed Based Access Controls
Policies that include multiple attributes for rules (memory=8gb, os=windows)
SDNs use ABAC
RADIUS
RADIUS
Authentication, Authorization, Accounting
Ports: UDP 1812,1813 or 1645,1646(unofficial)
Uses Attribute Value Pairs (AVPs) that can be used to enhance authentication and Authorization. 256 Pairs possible.
Logs privileged access once logged in.
Only encrypts the Password exchange.
RADSEC enables RADIUS over TCP/TLS
TACACS+
TACACS+
Authentication, Authorization, Accounting
Ports: TCP 49
TACACS+ enhancement allows Two-factor authentication.
Separates AAA into different processes that can be implemented on multiple servers.
Encrypts all authentication information.
Better accountability compared to Radius.
Diameter
Diameter
Supports wide range of protocols: IP, Mobile IP, VoIP.
Better Reliability and Flexibility than RADIUS.
Authentication, Authorization, Accounting
Ports: TCP / SCTP 3868
Supports IPSec & TLS Encryption.
Not backwards compatible with RADIUS
Uses AVP’s and increases to use 32 bits i.e. billions of Pairs.
Security Association Markup Language (SAML)
Security Association Markup Language (SAML)
Log-In to Federated sites via SSO. Enterprise websites and apps.
Uses XML
Components:
Assertions: Authentication, Attribute, Authorization
Protocols: HTTP, SMTP, SOAP, FTP
Bindings: SAML over SOAP, SAML over HTTP
Roles:
Identity Provider (IdP): Validate user identity.
Service Provider (SP): The Service
Principal: User
Circle of Trust between all parties before Assertions.
OAuth 2.0
OAuth 2.0
Provides Authorization to API’s such as GoogleID, LinkedIn, Facebook etc.
Roles:
OAuth Provider: Hosts the resource to be accessed.
OAuth Consumer: Requesting the resource.
End User: Granting access
Example: Facebook App (Consumer) asking for permission from (End User) to grant access to your Facebook Profile (Provider)
No Encryption – Relies on TLS for Session encryption.
OpenID
OpenID
SAML based SSO, consumer websites and apps.
Roles:
OpenID Provider: Verifies End user.
Resource Party: Wants to verify the user.
End User: who wants access
Example: Facebook App (Consumer) asking for permission from (End User) to grant access to your Facebook Profile (Provider)
OpenID Connect(OIDC): Uses JSON Web Tokens (JWT) and REST to retrieve JWT. Can retrieve user profiles.
Vulnerable to Phishing attacks.
Kerberos
Kerberos:
Uses Symmetric encryption.
Port: UDP 88
The Principal / client’s password is never transmitted on the network.
Time Sensitive: All systems clocks need to be in sync.
Single Point of Failure.
KERBEROS - COMPONENTS
Resource Server
Resource Server
The Target Service (TS) that the User/Principal needs access to.
KERBEROS - COMPONENTS
Kerberos Key Distribution Center
Kerberos Service that includes:
Authentication Server (AS) – Grants Ticket Granting Tickets (TGT) to access the TGS Ticket Granting Service (TGS) – Grants tickets to target services.
KERBEROS - COMPONENTS
Session Key
Ticket Granting Ticket (TGT)
Service Ticket
Session Key – Encrypts communication for a session between client and KDC or TS
Ticket Granting Ticket (TGT) – access to TGS.
Service Ticket – access to Target Service.
Lightweight Directory Access Protocol & port
Lightweight Directory Access Protocol: Directory based on Subjects (users) and objects (resources) Ports: 389 – Plain LDAP 636 – LDAP-S over SSL 3268 – Global Catalog 3269 – Secure Global Catalog
IDaaS
IDaaS
Identity As A Service offering cloud based Identity services and management. Example: PingID, OneIdentity, Okta
BIOMETRICS
Fingerprint:
Retina:
Iris:
Fingerprint: Widely used, scans minutae.
Retina: Scans capillaries at back of eye. Most accurate, but intrusive. Health Risk and privacy issues.
Iris: Second most accurate, passive.
BIOMETRICS
Palm scan:
Hand Geometry scan:
Voice Print:
Palm scan: Scan’s the veins, establish unique identity without another factor.
Hand Geometry scan: Scan’s the length, width and thickness of hand. Not reliable.
Voice Print: Voice sampling. Vulnerable to capture and replay of voice.
BIOMETRICS
Facial Scanning:
Keyboard dynamics:
Facial Scanning: Scans facial features against DB. Passive.
Keyboard dynamics: typing style capture (how hard/fast). Change in behavior can cause FRRs.
Biometric Accuracy
Type I Error
Type II Error
Crossover Error Rate: (CER)
Type I Error - False Reject Rate: (FRR)Valid authorized user is rejected.
Type II Error - False Accept Rate: (FAR) Invalid Unauthorized user is accepted.
Crossover Error Rate: (CER) When FRR and FAR are equal.
If the CER of a biometric system is not acceptable:
Evaluate other biometric systems.
SOMETHING YOU HAVE
Synchronous Dynamic Tokens
ASynchronous Dynamic Tokens
NIST SP800-63B recommends Push notifications over SMS.
SOMETHING YOU KNOW
Passwords
Passphrases:“IamtheLordofDarkness”
NIST SP 800-63B Recommends
Compare user passwords against known weak passwords like “password” etc.
Don’t enforce complex passwords or users will write it down.
Salt passwords with random value and store as hash.
AUTHENTICATION FACTORS
TYPE I~IV
AUTHENTICATION FACTORS
TYPE I – Something You Know
Something that the user knows such as a Password, Passphrase PIN or Response.
TYPE II – Something You Have
Something that the user has such as a Token, Smartcard.
TYPE III – Something You Are
Biometric Authentication such as Fingerprint, Retina, Iris, Facial or Hand Geometry scans.
TYPE IV – Some place you are
GPS, Geolocation, Device
TYPES OF ACCESS CONTROL
Preventive
Preventive
Prevent or stop unwanted activities from occuring.
Ex: Encryption, mantrap, Firewall, security awareness
TYPES OF ACCESS CONTROL
Detective
Detective
Detect unwanted / unauthorized activities.
Ex: CCTV, IDS, EDR, Job rotation, mandatory vacations.
TYPES OF ACCESS CONTROL
Corrective
Corrective
Restore or resolve problems after security incident. (Short-term recovery – damage isn’t extensive)
Ex: AV Scan, Data Restore, IPS TCP Reset
TYPES OF ACCESS CONTROL
Deterrent
Deterrent
Discourage people from making security violations.
Ex: Fences, Guards, Warnings.
TYPES OF ACCESS CONTROL
Recovery
Recovery
Long term recovery, if damage is extensive.
Ex: Backup & restore (ransomware attack), RAID, Load-balancing, System re-imaging.
TYPES OF ACCESS CONTROL
Directive
Directive
Direct and control user actions.
Ex: Acceptable use policy, Exit signs, warnings, procedures.
TYPES OF ACCESS CONTROL
Compensating
Compensating
Backup access control in case primary fails or not available.
Ex: Smartcard – primary, temporary id – secondary.
DNP3
DNP3 – multi-layer TCP/IP Protocol that enables Industrial systems such as SCADA to intercommunicate. DNP3 is very good at communicating over low-bandwidth links, making it ideal for utilities, power grids and Oil and Gas management systems. DNP3 supports unsolicited messages that exposes Industrial systems to large remote attack surfaces. The Maroochy-Shire Sewage System attack
AirGap
AirGap Separation (ideally physical) of Protected systems and the internet. The idea is to prevent internet based attacks.
ICS Terms
OT – Operational Technology
ICS Terms
OT – Operational Technology: computing systems that manage industrial systems.
ICS – Industrial Control Systems: systems that are used to monitor and control industrial processes like conveyor belts, power consumption on electric grids.
PLC – Programmable Logic Controllers: ruggedized device that manages an ICS.
SCADA – Supervisory Control and Data Acquisition: Control and monitor Industrial facilities locally and remotely.
MES – Manufacturing Execution Systems: track and document transformation of Raw material to finished goods.
ICS Terms
ICS – Industrial Control Systems
ICS Terms
OT – Operational Technology: computing systems that manage industrial systems.
ICS – Industrial Control Systems: systems that are used to monitor and control industrial processes like conveyor belts, power consumption on electric grids.
PLC – Programmable Logic Controllers: ruggedized device that manages an ICS.
SCADA – Supervisory Control and Data Acquisition: Control and monitor Industrial facilities locally and remotely.
MES – Manufacturing Execution Systems: track and document transformation of Raw material to finished goods.
ICS Terms
PLC – Programmable Logic Controllers
ICS Terms
OT – Operational Technology: computing systems that manage industrial systems.
ICS – Industrial Control Systems: systems that are used to monitor and control industrial processes like conveyor belts, power consumption on electric grids.
PLC – Programmable Logic Controllers: ruggedized device that manages an ICS.
SCADA – Supervisory Control and Data Acquisition: Control and monitor Industrial facilities locally and remotely.
MES – Manufacturing Execution Systems: track and document transformation of Raw material to finished goods.
ICS Terms
ICS Terms
OT – Operational Technology: computing systems that manage industrial systems.
ICS – Industrial Control Systems: systems that are used to monitor and control industrial processes like conveyor belts, power consumption on electric grids.
PLC – Programmable Logic Controllers: ruggedized device that manages an ICS.
SCADA – Supervisory Control and Data Acquisition: Control and monitor Industrial facilities locally and remotely.
MES – Manufacturing Execution Systems: track and document transformation of Raw material to finished goods.
ICS Terms
SCADA – Supervisory Control and Data Acquisition
ICS Terms
OT – Operational Technology: computing systems that manage industrial systems.
ICS – Industrial Control Systems: systems that are used to monitor and control industrial processes like conveyor belts, power consumption on electric grids.
PLC – Programmable Logic Controllers: ruggedized device that manages an ICS.
SCADA – Supervisory Control and Data Acquisition: Control and monitor Industrial facilities locally and remotely.
MES – Manufacturing Execution Systems: track and document transformation of Raw material to finished goods.
Phone Hackers are known as ??
Phreakers.
SIP (the registration protocol for VOIP)
SIP (the registration protocol for VOIP) uses clear text, if a hacker can capture these messages, that hacker is able to read subscribers’ sensitive information such as their public and private identities, and use it to spoof the subscriber.
NETWORK SECURITY: EMAIL
SMTP over TLS
SMTP over TLS: encapsulate SMTP traffic between server transmissions to prevent eavesdroppers. Does not protect from the compromise of the server itself.
Opportunistic: TLS connection forms if both servers are capable of TLS, or else reverts to Plain-Text.
Mandatory: TLS Connection is required else connection is not established.
NETWORK SECURITY: EMAIL
DKIM
DKIM: Valid mail is sent by verification of the Domain Identity.
NETWORK SECURITY: EMAIL
S/MIME
S/MIME: Provides confidentiality and authentication by encrypting email messages and using Digital signatures to provide authentication of sender using the RSA asymmetric cryptosystem and PKCS (Public Key Cryptography)
NETWORK SECURITY: EMAIL
PGP
PGP: Provides confidentiality and authentication by using IDEA for encryption and RSA for Digital signatures and key distribution. Uses a decentralized Trust model.
WPA2: Wi-Fi Protected Access 2
WPA2: Wi-Fi Protected Access 2
Uses CCMP (based on AES) to encrypt communications from Client to AP.
Used along with EAP to provide Enterprise grade security:
EAP-TLS – Every client and Controller/AP has a unique certificate. Server-Client validation. Difficult to deploy and maintain, most secure.
PEAP – Client Credentials (typically AD) and Controller certificate. Cert validated before client credentials are sent. Easy to deploy and maintain, good security.
802.11i – RSN (Robust network security)
WPA: Wi-Fi Protected Access
WPA: Wi-Fi Protected Access
Uses TKIP with RC4 to improve security over WEP.
Adds Key regeneration every 10000 packets, IV and key mixing.
Limits of 30 users per SSID.
Captive Portal
Captive Portal
Open network with a captive page ideally used to provide temporary access by hotspots (airport etc.)
Open networks, are prone to sniffing, always use a VPN on them.
Can be enhanced further by offering Self registration, Sponsor confirmation, billing and advertisements.
WEP
WEP
Uses RC4, CRC32 for confidentiality and integrity with 24bit IV.
Broken in 2001, not at all recommended.
Bastion Host
Bastion Host : is a hardened system exposed to the internet to securely expose services to the internet. A Reverse Proxy is also a Bastion Host. Also called Screened Host.
Example: An Antivirus server has the same port for management and user updates. If directly exposed, it can lead to attacks on the mgmt. console. A Bastion Host securely exposes only user-updates service and restricts management access from the internet.
FIREWALLS
Packet Filter
Packet Filter: Checks an ACL and only the message header to determine access. Is not Stateful. Layer 4.
FIREWALLS
Stateful Inspection firewall
Stateful Inspection firewall: Verifies the state (connection originator) and allows access based on IP/Port combination in message header.. Layer 4. (example: A telnet on Port 80 will be allowed if Port 80 (HTTP) is allowed)
FIREWALLS
Application Layer Proxy
Application Layer Proxy: Filters Layer 7 content, like a web-filter or a VOIP gateway. Proxies connections on behalf of the client, improving confidentiality and preventing exposure of internal users to the internet.
FIREWALLS
Deep Inspection Firewalls
Deep Inspection Firewalls: Filter connections at Layer 7 and add services such as Malware protection, IPS etc.
FIREWALLS
Next Generation Firewalls
Next Generation Firewalls: As apps shifted to HTTP/S, firewalls shift focus from Port based to Application based, sampling traffic to determine the actual application (example: A telnet on Port 80 is now categorized as Telnet app)
DNS
UDP? for ?
TCP? for ?
DNS is a hierarchical database with a tree structure. Root -> TLD -> Domain -> Sub-domain.
DNS uses UDP Port 53 for lookups, and TCP Port 53 for Zone Transfers.
SFTP & SCP port at ?
SFTP – TCP 22: Uses SSH for FTP to make it secure.
SCP – TCP 22: Secure Copy Protocol.
L4 UDP
UDP on the other hand is a Connection-less protocol and relies on Application Layer protocols for Reliability. Uses IP Protocol number 17.
QUIC is a google protocol that uses UDP for Web traffic, aimed at faster transmission.
Block UDP and only allow Apps needed.
L4 TCP
TCP is a connection oriented Protocol, that segments Payload/Data received from the higher layers, performs Error Detection and correction and performs the actual session setup. Reliability.
TCP uses unique ports from 0-65535 for differentiating application data. Destination are well known ports (such as 80 for HTTP) and source ports are always random.
URG – Packet contains Urgent Data.
ACK – Acknowledge received Data
PSH – Clear Buffer, Push Data to Application Layer.
RST – Reset (Tear down) TCP Connection
SYN – Synchronise a connection
FIN – Graceful Tear down.
CWR – Congestion Window Reduced
ECE – Explicit Congestion Notification Echo.
NS – Nonce Sum
L3 ICMP
ICMP: Internet Control Message Protocol is used for IP Investigations of Reachability.
ICMPv6 is used for IPv6
ICMP has it’s own Transport layer protocol.
IP Protocol number: 1
Important ICMP messages:
ICMP Echo Request: Request a reply, check reachability. Type 8 message.
ICMP Echo Reply: Reply to an Echo req. Type 0 message.
ICMP Time Exceeded: Used in Traceroute to check distance.
Destination Unreachable: Router reports that the Destination is unreachable.
0 – Network Unreachable
1 – Host Unreachable
2 – Protocol Unreachable
3 – Port Unreachable
ICMP Redirect: Redirects Datagrams or Segments to the correct host.
L3
RFC 1918 Addresses
Loopback Addresses
APIPA Address
RFC 1918 Addresses: Private address, non routable:
Class A – 10.0.0.0-10.255.255.255
Class B – 172.16.0.0-172.31.255.255
Class C – 192.168.0.0-192.168.255.255
Loopback Addresses: Test the local TCP/IP stack
127.0.0.1 ( although the whole 127.0.0.0/8 is reserved)
APIPA Address: Used by Microsoft Windows, when DHCP IP is not received.
169.254.x.x
WAN TYPES
ISDN
ISDN– Digital voice, video, data.
BRI – Two data and one control channels – 144kbps.
PRI: T1- 23 Data and one control channels – 1.544 Mbps
E1 – 30 Data and one Control channel – 2.048 Mbps
T3 – 28 bundled T1s – 45 Mbps
WAN TYPES
SONET
SONET: Optical network that connects continents.
WAN TYPES
DSL
DSL: Digital subscriber Line, symmetric, same upload/download speed.
ADSL – Asynchronous DSL, varying Upload and Download speed.
VDSL – High bandwidth DSL
WAN TYPES
ATM
ATM – Circuit switched network. Each site needs dedicated circuits for connection.
WAN TYPES
Frame Relay
Frame Relay – Packet switched network. Frame Relay supports Virtual Circuits – One single physical link can support multiple Private Virtual Circuits to connect to sites.
WAN TYPES
MPLS
MPLS – Fast, label-switching WAN, establishes pre-defined routes. Can route to multiple sites over single link without a PVC via routing protocols such as MP-BGP. Adds Label headers and can forward IP and Non-IP Packets.
WAN TYPES
SD-WAN
SD-WAN – The cost of dedicated WAN such as MPLS has driven SD-WAN. SD-WAN enables an enterprise to create a WAN fabric across an underlying multi-wan network such as MPLS, Internet etc. SD-WAN enhances traffic delivery by adding auto-failover, congestion detection and application bandwidth optimization.
ETHERNET Media Types:
10Base2 – ?
10Base5 – ?
ETHERNET Media Types: 10Base2 – Thinnet Coaxial, 2 Mbps 10Base5 – Thicknet Coaxial, 5 Mbps 10BaseT – UTP Cat 5, 10 Mbps, 100m 100BaseT – UTP Cat 5, 100 Mbps, 100m 100BaseFX – Fiber Optic 1000BaseT – UTP Cat 5e/6, 1Gbps, 100m 10GBaseT: Copper 10G on UTP, Cat 7 10GBase-SR/LR/ER: 10G fiber-optic. S = Short Range, L = Long range, E = Extended range.
ETHERNET Media Types:
10BaseT – ?
100BaseT – ?
ETHERNET Media Types: 10Base2 – Thinnet Coaxial, 2 Mbps 10Base5 – Thicknet Coaxial, 5 Mbps 10BaseT – UTP Cat 5, 10 Mbps, 100m 100BaseT – UTP Cat 5, 100 Mbps, 100m 100BaseFX – Fiber Optic 1000BaseT – UTP Cat 5e/6, 1Gbps, 100m 10GBaseT: Copper 10G on UTP, Cat 7 10GBase-SR/LR/ER: 10G fiber-optic. S = Short Range, L = Long range, E = Extended range.
ETHERNET Media Types:
100BaseFX – ?
1000BaseT – ?
ETHERNET Media Types: 10Base2 – Thinnet Coaxial, 2 Mbps 10Base5 – Thicknet Coaxial, 5 Mbps 10BaseT – UTP Cat 5, 10 Mbps, 100m 100BaseT – UTP Cat 5, 100 Mbps, 100m 100BaseFX – Fiber Optic 1000BaseT – UTP Cat 5e/6, 1Gbps, 100m 10GBaseT: Copper 10G on UTP, Cat 7 10GBase-SR/LR/ER: 10G fiber-optic. S = Short Range, L = Long range, E = Extended range.
ETHERNET Media Types:
10GBaseT: ?
10GBase-SR/LR/ER: ?
ETHERNET Media Types: 10Base2 – Thinnet Coaxial, 2 Mbps 10Base5 – Thicknet Coaxial, 5 Mbps 10BaseT – UTP Cat 5, 10 Mbps, 100m 100BaseT – UTP Cat 5, 100 Mbps, 100m 100BaseFX – Fiber Optic 1000BaseT – UTP Cat 5e/6, 1Gbps, 100m 10GBaseT: Copper 10G on UTP, Cat 7 10GBase-SR/LR/ER: 10G fiber-optic. S = Short Range, L = Long range, E = Extended range.
MAC Addresses
MAC Addresses
Mac Addresses are typically 48 bits and burned in from factory.
First 24 bits are called OUI – Organizational Unique Identifier and identify the manufacturer of the NIC card – such as Cisco, Juniper, Palo Alto etc.
The last 24 bits are the serial number, and unique to each NIC.
EUI-64 was created to increase the pool. The OUI is still 24 bits, but the serial number is now 40 bits.
IPv6 autoconfiguration is compatible to both MAC Types.
Modern OSes allow Mac Addresses to be changed via tools, thus allowing mac addresses to be spoofed.
You can quickly look up the OUI of a MAC address for IP Spoofing. (Example: A rogue Cisco router has the same IP as your Sonicwall Firewall). An arp –a on a windows PC will give you clues!
Collision Domains
Collision Domains: Two devices send packets at the same time on a shared segment.
A Hub is one collision domain, only one device can transmit at a time!
A switch breaks collision domains. Every port on a switch is one collision domain.
Broadcast Domains
Broadcast Domains: The entire Layer 2 network. Routers break break broadcast domains, VLANs reduce broadcast domains.
OSI Payload
Payload is Encapsulated as it travels down from the Transport layer into Segments, Packets, Frames and Bits.
Sprinkler Systems:
Wet Pipes – ?
Sprinkler Systems:
Wet Pipes – water right up to sprinkler head. Glass bulb melts / breaks at specific temperature. Each head independent.
Dry Pipes – Water held back by valve, compressed air in pipe. As head opens, pressure drops and water released.
Deluge – Sprinkler heads are always open and larger than dry pipers. Valve opens water flow via manual or fire alarm.
Preaction – combination of two, opens via two separate triggers.
Sprinkler Systems:
Dry Pipes – ?
Sprinkler Systems:
Wet Pipes – water right up to sprinkler head. Glass bulb melts / breaks at specific temperature. Each head independent.
Dry Pipes – Water held back by valve, compressed air in pipe. As head opens, pressure drops and water released.
Deluge – Sprinkler heads are always open and larger than dry pipers. Valve opens water flow via manual or fire alarm.
Preaction – combination of two, opens via two separate triggers.
Sprinkler Systems:
Deluge – ?
Sprinkler Systems:
Wet Pipes – water right up to sprinkler head. Glass bulb melts / breaks at specific temperature. Each head independent.
Dry Pipes – Water held back by valve, compressed air in pipe. As head opens, pressure drops and water released.
Deluge – Sprinkler heads are always open and larger than dry pipers. Valve opens water flow via manual or fire alarm.
Preaction – combination of two, opens via two separate triggers.
Sprinkler Systems:
Preaction – ?
Sprinkler Systems:
Wet Pipes – water right up to sprinkler head. Glass bulb melts / breaks at specific temperature. Each head independent.
Dry Pipes – Water held back by valve, compressed air in pipe. As head opens, pressure drops and water released.
Deluge – Sprinkler heads are always open and larger than dry pipers. Valve opens water flow via manual or fire alarm.
Preaction – combination of two, opens via two separate triggers.
FIRE DEFENCE
Detection Systems:
Detection Systems:
Fixed temperature
Rate of rise – speed of temp changes.
Flame actuated – infrared energy of flames.
Smoke Actuated – photoelectric or radioactive
Fire class:A
Ordinary – wood, paper
vs
Water or Soda Acid
Fire class:B
Liquid – petrol etc.
vs
Halon, FM200, Soda Acid,CO2
Fire class:C
Electrical Equipment
vs
Halon, FM200, CO2
Fire class:D
Combustible Metals
vs
Dry Powder
Electricity
Fault – ?
Blackout – ?
Electricity Fault – temporary loss of power. Blackout – prolonged loss of power. Sag – temporary low voltage. Brownout – prolonged low voltage. Surge – prolonged high voltage Spike – temporary high voltage.
Electricity
Sag – ?
Brownout – ?
Electricity Fault – temporary loss of power. Blackout – prolonged loss of power. Sag – temporary low voltage. Brownout – prolonged low voltage. Surge – prolonged high voltage Spike – temporary high voltage.
Electricity
Surge – ?
Spike – ?
Electricity Fault – temporary loss of power. Blackout – prolonged loss of power. Sag – temporary low voltage. Brownout – prolonged low voltage. Surge – prolonged high voltage Spike – temporary high voltage.
Heat, Ventilation & Cooling
Humidity – ?
Temperature – ?
Heat, Ventilation & Cooling
Humidity – 40-60%
Temperature – 60-75F (15-23 C degrees)
High Humidity – leads to corrosion
Low Humidity – leads to Static Electricity.
Prevent condensation with a positive drain system.
Heat, Ventilation & Cooling
High Humidity – leads to ?
Low Humidity – leads to ?
Heat, Ventilation & Cooling
Humidity – 40-60%
Temperature – 60-75F (15-23 C degrees)
High Humidity – leads to corrosion
Low Humidity – leads to Static Electricity.
Prevent condensation with a positive drain system.
PHYSICAL SECURITY – ACCESS DEFENSES
Mantrap
Mantrap
One door must close, before second opens. Two different authentication forms. Security guard’s may also verify authenticity for second door.
PHYSICAL SECURITY – ACCESS DEFENSES
TurnStile
TurnStile
One person per access. Revolving door concept. Authenticated via Smartcard or Security Guard
PHYSICAL SECURITY – PERIMETER DEFENSES Gates Class 1 – ? Class II – ? Class III – ? Class IV – ?
Gates Class 1 – Residential Class II – Commercial (parking) Class III – Industrial (loading dock) Class IV – Restricted Access (Airport / Prison)
PHYSICAL SECURITY – PERIMETER DEFENSES Fences 3 feet – ? 6 feet – ? 8 feet with barbed wire – ?
Fences
3 feet – Deterrent
6 feet – Deter most intruders.
8 feet with barbed wire – Preventive – deter most determined.
Data Diddling / Salami
Data Diddling / Salami – small random, incremental changes to a system or data.
Electromagnetic Radiation – TEMPEST
Electromagnetic Radiation – TEMPEST : monitors/keyboard/mice
SCADA Security<===protect
SCADA Security:
Deploy separate network for SCADA.
Deploy endpoint security on SCADA systems.
Restrict Management interface access to SCADA / ICS devices.
Implement AirGap design.
Trusted Paths
Trusted Paths protect data between a user and a security control, such as a login window.
Defined by Common Criteria.
Protects from attacks such as Login spoofing.
Trusted Channels
Trusted Channels protect data on a link or between communicating peers.
Protects from attacks like Man in the Middle.
APPLETS
APPLETS
Act like a program and execute code on user machine rather than on the server. Example: Cisco UCS Manager. Rules/templates config happens locally, only commands sent to server.
ACTIVE-X
ACTIVE-X Microsoft’s, runs in IE. Full access to system resources. Can perform privileged actions. Restrict Active-X in environment.
Address Space Layout Randomization
Address Space Layout Randomization
Randomize executing memory space of programs. Example: Attacker develops an exploit on his pc for a memory address, won’t work on client as the process address changes due to ASLR.
Data Execution Prevention
Data Execution Prevention
Prevent processes from executing instructions in memory locations that are not predefined in the code.
MEMORY ADDRESSING
Register Addressing
Register Addressing: used by the CPU to access one of it’s registers to store/ access data in the register.
MEMORY ADDRESSING
Immediate(立即) Addressing
Immediate Addressing: Instructions supplied as part of a command that does not require the CPU to fetch anything.
MEMORY ADDRESSING
Direct Addressing
Direct Addressing: CPU is given the memory address to fetch instruction.
MEMORY ADDRESSING
Indirect Addressing
Indirect Addressing: CPU is given a memory address to another memory address that has the instruction.
MEMORY ADDRESSING
Base+Offset Addressing
Base+Offset Addressing: Use a value stored in a register as base, and begin counting using the offset.
Primary Memory:
Primary Memory:
Readily available information accessed by the CPU. Temporary. Ex. RAM
Volatile(易揮發的):
Volatile(易揮發的):
Temporary. Wiped after power loss. Ex. RAM
Random Access:
Random Access:
Info can be randomly accessed based on addresses. Ex. RAM, HDD, Flash
Secondary Memory:
Secondary Memory:
Long-term storage. Ex. HDD, SSD, Tape
Non-Volatile:
Non-Volatile:
Long-term. Retains data. Ex. HDD
Sequential Access:
Sequential Access:
Info has to be accessed in the written sequence. Ex. Tape
MEMORY
ROM – ?
ROM – Read-only, non-volatile memory. Content burned in at factory. Non-modifiable.
PROM – Programmable Read-only memory: end user/oem burns in chips contents. Only allowed once.
EEPROM – Electronically Erasable PROM: Can be erased and re-written via electronic voltages. Only full erase and write functions.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
PROM – ?
ROM – Read-only, non-volatile memory. Content burned in at factory. Non-modifiable.
PROM – Programmable Read-only memory: end user/oem burns in chips contents. Only allowed once.
EEPROM – Electronically Erasable PROM: Can be erased and re-written via electronic voltages. Only full erase and write functions.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
EEPROM – Electronically Erasable PROM: Can be erased and re-written via electronic voltages. Only full erase and write functions.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
ROM – Read-only, non-volatile memory. Content burned in at factory. Non-modifiable.
PROM – Programmable Read-only memory: end user/oem burns in chips contents. Only allowed once.
EEPROM – Electronically Erasable PROM: Can be erased and re-written via electronic voltages. Only full erase and write functions.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
Flash Memory – ?
ROM – Read-only, non-volatile memory. Content burned in at factory. Non-modifiable.
PROM – Programmable Read-only memory: end user/oem burns in chips contents. Only allowed once.
EEPROM – Electronically Erasable PROM: Can be erased and re-written via electronic voltages. Only full erase and write functions.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
CACHE – ?
CACHE – volatile, used to store frequently accessed data.
CPU’s have L1 and L2 cache which are registers that store information which the ALU executes.
Registers – Any data ALU manipulates must be inside a register.
Static RAM – Uses Flip-Flops to store volatile data, refreshed at power outage. Expensive.
Dynamic RAM – Uses Registers to store volatile data, CPU must constantly refresh via electric voltages. Inexpensive.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
Registers – ?
CACHE – volatile, used to store frequently accessed data.
CPU’s have L1 and L2 cache which are registers that store information which the ALU executes.
Registers – Any data ALU manipulates must be inside a register.
Static RAM – Uses Flip-Flops to store volatile data, refreshed at power outage. Expensive.
Dynamic RAM – Uses Registers to store volatile data, CPU must constantly refresh via electric voltages. Inexpensive.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
Static RAM – ?
CACHE – volatile, used to store frequently accessed data.
CPU’s have L1 and L2 cache which are registers that store information which the ALU executes.
Registers – Any data ALU manipulates must be inside a register.
Static RAM – Uses Flip-Flops to store volatile data, refreshed at power outage. Expensive.
Dynamic RAM – Uses Registers to store volatile data, CPU must constantly refresh via electric voltages. Inexpensive.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
Dynamic RAM – ?
CACHE – volatile, used to store frequently accessed data.
CPU’s have L1 and L2 cache which are registers that store information which the ALU executes.
Registers – Any data ALU manipulates must be inside a register.
Static RAM – Uses Flip-Flops to store volatile data, refreshed at power outage. Expensive.
Dynamic RAM – Uses Registers to store volatile data, CPU must constantly refresh via electric voltages. Inexpensive.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
MEMORY
Flash Memory – ?
CACHE – volatile, used to store frequently accessed data.
CPU’s have L1 and L2 cache which are registers that store information which the ALU executes.
Registers – Any data ALU manipulates must be inside a register.
Static RAM – Uses Flip-Flops to store volatile data, refreshed at power outage. Expensive.
Dynamic RAM – Uses Registers to store volatile data, CPU must constantly refresh via electric voltages. Inexpensive.
Flash Memory – Uses NAND Flash. Can be written and erased in blocks. (single file write/deletes etc.)
CPU States
Ready: Process is ready to begin processing, CPU is not available.
Waiting: Process is waiting for device or access request (interrupt) to continue processing.
Running: Process is executing, Problem state in which CPU is trying to solve problem until it’s solved, blocked or time-slice expires.
Supervisory: Process requires greater privileges, any function not executing in Ring 3.
Stopped: Process finishes or terminates.
Multi-tasking:
Multitasking handles multiple processes on a single processor by switching between them using the operating system.
Multiprocessing uses multiple processors to perform multiple processes simultaneously.
SMP: Symmetric Multiprocessing – single OS, multiple CPUs on shared memory and databus.
MPP: Massively Parallel Processing – One OS per CPU, with software that coordinates activities and processing.
Multiprogramming requires modifications to the underlying applications.
Multithreading runs multiple threads within a single process.
Multi-threading:
Multitasking handles multiple processes on a single processor by switching between them using the operating system.
Multiprocessing uses multiple processors to perform multiple processes simultaneously.
SMP: Symmetric Multiprocessing – single OS, multiple CPUs on shared memory and databus.
MPP: Massively Parallel Processing – One OS per CPU, with software that coordinates activities and processing.
Multiprogramming requires modifications to the underlying applications.
Multithreading runs multiple threads within a single process.
Multi-processing:
Multitasking handles multiple processes on a single processor by switching between them using the operating system.
Multiprocessing uses multiple processors to perform multiple processes simultaneously.
SMP: Symmetric Multiprocessing – single OS, multiple CPUs on shared memory and databus.
MPP: Massively Parallel Processing – One OS per CPU, with software that coordinates activities and processing.
Multiprogramming requires modifications to the underlying applications.
Multithreading runs multiple threads within a single process.
Multi-Programming:
Multitasking handles multiple processes on a single processor by switching between them using the operating system.
Multiprocessing uses multiple processors to perform multiple processes simultaneously.
SMP: Symmetric Multiprocessing – single OS, multiple CPUs on shared memory and databus.
MPP: Massively Parallel Processing – One OS per CPU, with software that coordinates activities and processing.
Multiprogramming requires modifications to the underlying applications.
Multithreading runs multiple threads within a single process.
TCB
Security Perimeter
Reference Monitor
Security Kernel
TCB
Security Perimeter
Delineates the Trusted and the Untrusted components within a computer system.
Isolates the TCB.
Reference Monitor
The reference monitor is an abstract machine that mediates all access subjects have to objects, both to ensure that the subjects have the necessary access rights and to protect the objects from unauthorized access and destructive modification.
Security Kernel
Enforces the Reference monitor concept.
Must facilitate isolation of process.
Enforces the rules defined by the Reference monitor.
Certification vs Accreditation?
Certification是一種技術評審，用於評估安全機制並評估其有效性。
Accreditation是管理層對認證過程結果中的信息的正式接受。
Certification vs Accreditation? -2
Certified是對安全組件及其符合認證目的的合規性的全面技術評估。認證過程可以使用保障評估，風險分析，驗證，測試和審核技術來評估特定係統的適用性。
ACCREDITATION是管理層正式接受系統的整體安全性和功能性。 認證信息將提交給管理層或負責機構，由管理層提出問題，審核報告和調查結果，並決定是否接受產品以及是否需要採取任何糾正措施。
CERTIFICATION
CERTIFICATION
Certified to meet security requirements of the Data Owner. Considers the system, security measures and the residual risk. (Certified by the manufacturer to state what the system does)
ASSURANCE
ASSURANCE
Systems have designs accepted, development stages analyzed, reviewed, tested and evaluated. (Assurance is the analysis of how a system is made)
ACCREDITATION
ACCREDITATION
Data Owners acceptance of the certification and the residual risk before the system is put in production.
COMMON CRITERIA Target of Evaluation (ToE): Protection Profile: Security Target: Evaluation Assurance Level (EAL):
Target of Evaluation (ToE): System or product that is being evaluated.
Protection Profile: Independent Set of objectives and requirements for a specific category of products or systems, such as encryption software or firewalls. Protection Profile is the “I want” from a customer perspective.
Security Target: documentation describing the ToE, with the security requirements and operational environment. Security Target is the “What I can do” from the vendor’s perspective.
Evaluation Assurance Level (EAL): The evaluation score of the tested product.
COMMON CRITERIA
EAL1 – ?
EAL2 – ?
EAL1 – Functionally Tested
EAL2 – Structurally Tested
EAL3 – Methodically Tested and Checked
EAL4 – Methodically Designed, tested and reviewed.
EAL5 – Semi-formally designed and tested
EAL6 – Semi-formally verified, designed and tested
EAL7 – Formally verified, designed and tested.
COMMON CRITERIA
EAL3 – ?
EAL4 – ?
EAL1 – Functionally Tested
EAL2 – Structurally Tested
EAL3 – Methodically Tested and Checked
EAL4 – Methodically Designed, tested and reviewed.
EAL5 – Semi-formally designed and tested
EAL6 – Semi-formally verified, designed and tested
EAL7 – Formally verified, designed and tested.
