Week 1 Flashcards
What are the most widely used mechanisms for authentication?
Something you know:
Password or pin
Something that you have:
Smart card or one-time password generator
Something that you are:
Facial scan/ photograph
Context location:
Your current location
What are good systems for a password?
Good passwords are: long and random
Good systems:
- Allow for passwords of arbitrary length
- Store passwords hashed and salted
What is Biometric?
Uses of characteristics of your body:
- Fingerprint
- Retina scan
To authenticate the identity
What are Hardware Tokens?
Chip cards
One-time password generators
Your unicard
What is an Access Control Model?
Focus on authorization:
*Specification of who is allowed to do what (permissions)
*How to update/ change permissions
A simple access control model AC is a relation:
AC = Subject x Object x Request
Why can Access Control Models be complex?
Might depend on the system state
Subjects and permissions change over time
Access righs might require the fulfillment of obligations
Implementation bugs
Access control needs to be enforced
What is an example for a simple permission check with Access Control Models?
(Achim, ExamECM2426,set) ∈ AC
What are the various forms of Access Control?
Physical protection:
eg. gates, turnstiles
Network Traffic:
eg. Firewalls
Hardware
eg. Memory management
Operating System
eg. File system
Application Level
eg. Google login, databases
What is a Security Policy?
Defines what is allowed (and/ or forbidden)
Similiar to a set of laws
Defined in terms of rules and/ or requirements
What is a Security Model?
A formal representation of a class of systems
Highlights security features on a chosen level of abstraction
Provides a vocabulary to develop specific policies
What is the Access Control Matrix Model?
The access control matrix model is a way to manage who can do what in a system. Imagine it like a grid or a table
Based on ideas of privileges of subjects on objects
Subjects: Users, processes, agents, groups
Objects: Data, memory banks, other processes, files…
Privileges: Right to read, write, modify
What is a protection state in an Access Control Matrix Model?
A Protection state relative to a set of privileges P, is a triple (S,O,M) with:
A set of current subjects S
A set of current objects O
A access control matrix M
What is an example of a Protection State?
File 1 File2 File3
Alice read,write
Bob read read
Charlie append write execute
Alice, Bob, Charlie are subjects
File1, File2, File3 are objects
Matrix entries are set of privileges (rights)
What are the 3 Fundamental Comcepts of Security?
Confidentiality - Protecting information from disclosure to unauthorized parties
Integrity - Protecting information from being modified by unauthorized parties
Availability - Ensuring information is available (accessible) to authorized parties
What is Identification?
Associating an identity with a subject
