Cissp: Security Arch & Design - Brown

Front 1

Complexity is the enemy of security,

Back 1

(reminder)

Front 2

Allows multiple virtual operating system guests to run on one host.

Back 2

Hypervisor

Front 3

Volatile hardware memory that loses integrity after loss of power.

Back 3

Random Access Memory (RAM)

Front 4

Mediates all access between subjects and objects.

Back 4

Reference Monitor

Front 5

Nonvolatile memory that maintains integrity after loss of power.

Back 5

Read Only Memory (ROM)

Front 6

Created by DoD. This Book looks at operating systems and not networking issues. First significant attempt to define differing levels of security and access control implementation within an IT system. This publication was the inspiration for the Rainbow Series, a series of NCSC publications detailing
specific security standards for various communications systems

Back 6

Trusted Computer System Evaluation Criteria (TCSEC) Also known as the Orange Book.

Front 7

Brings TCSEC concepts to network systems. Designed to address network components and products. This was done as a follow-up to the Orange Book focusing on stand-alone operating systems and not networking issues.

Back 7

Trusted Network Interpretation (TNI) (a.k.a The Red Book); due to the color of its cover.

Front 8

The security-relevant portions of a computer system. Orange book. The mechanisms can be hardware, software, and firmware.

Back 8

Trusted Computing Base (TCB)

Front 9

An interface between computer hardware and the operating system, allowing multiple guest operating
systems to run on one host computer.

Back 9

Virtualization

Front 10

Separates hardware and software functionality into modular tiers.

Back 10

Layering

Front 11

Hides unnecessary details from the user.

Back 11

Abstraction

Front 12

List of objects a subject is allowed to access.

Back 12

Security domain

Front 13

Form of CPU hardware layering that separates and protects domains (such as kernel mode and user
mode) from each other.

Back 13

Ring model

Front 14

Uses open hardware and standards, using standard components from a variety of vendors.

Back 14

Open system

Front 15

Uses proprietary hardware or
software

Back 15

Closed system

Front 16

called the Memory Controller Hub (MCH), connects the CPU to RAM and video memory. Directly connected to the CPU and is faster than the (other)bridge

Back 16

The northbridge

Front 17

Called the I/O Controller Hub (ICH), connects input/output (I/O) devices, such as disk, keyboard, mouse, CD drive, USB ports, etc.

Back 17

The southbridge

Front 18

Performs mathematical calculations—it computes. It is fed instructions by the control unit

Back 18

Arithmetic logic unit (ALU)

Front 19

Sends instructions to the ALU. Traffic cop.

Back 19

Control unit

Front 20

Fetch and Execute:

These four steps take one clock cycle to complete.

Back 20

1. Fetch Instruction 1
2. Decode Instruction 1
3. Execute Instruction 1
4. Write (save) result 1

Front 21

Combines multiple steps into one combined process, allowing simultaneous fetch, decode, execute, and write steps for different instructions.

Back 21

Pipelining

Front 22

Two types of multiprocessing:

Back 22

Symmetric multiprocessing (SMP) and
Asymmetric multiprocessing (AMP)

Front 23

Have one operating system to manage all CPUs.

Back 23

Symmetric multiprocessing (SMP)

Front 24

Have one operating system image per CPU, essentially acting as independent systems.

Back 24

Asymmetric multiprocessing (AMP)

Front 25

Designed to recover a system by rebooting after critical processes hang or crash.

Back 25

Watchdog timer

Front 26

Logical control that attempts to prevent one process from interfering with another.

Back 26

Process isolation

Front 27

Exam Warning

Back 27

Virtual memory allows swapping, but virtual memory has other capabilities. In other words, virtual memory
does not equal swapping.

Front 28

Exam Note

Back 28

Swapping and paging are often used interchangeably, but there is a slight difference. Paging copies a block of memory to or from disk, while swapping copies an entire process to or from disk. This book uses the term "swapping."

Front 29

Exam Note

Back 29

Firmware is chip based, unlike magnetic disks. The term "flash drive" may lead some to think that flash memory drives are disk drives. They are physically quite different and have different remanence properties. A simple magnetic field will not erase flash memory. Secure destruction methods used for magnetic drives, such as degaussing (discussed in Chapter 8, Domain 7: Operations Security), may not work with flash drives.

Front 30

Heart of the operating system, which usually runs in ring 0. It provides the interface between hardware
and the rest of the operating system, including applications.

Back 30

The kernel; two basic designs: monolithic
and microkernel

Front 31

Compiled into one static executable and the entire kernel runs in supervisor mode. All functionality
required must be precompiled in.

Back 31

Monolithic kernel

Front 32

Modular kernels; Usually smaller and has less native functionality than a typical
monolithic kernel but can add functionality via loadable kernel modules. May also run kernel
modules in user mode (usually ring 3), instead of supervisor mode.

Back 32

Microkernels

Front 33

Stores account information and encrypted passwords,

Back 33

(/etc/passwd) and shadow file (/etc/shadow), respectively.

Front 34

Two basic virtualization types:

Back 34

transparent virtualization (sometimes called full virtualization) and
paravirtualization.

Front 35

Runs stock operating systems, such as Windows 7 or Ubuntu® Linux® 9.10,as virtual guests. No changes to the guest OS are required.

Back 35

Transparent virtualization

Front 36

Runs specially modified operating systems,
with modified kernel system calls. Can be more efficient but requires changing the guest operating
systems. This may not be possible for closed operating systems such as the Microsoft Windows family.

Back 36

Paravirtualization

Front 37

Controls access between virtual guests and host hardware.

Back 37

hypervisor;

Front 38

Part of an operating system that runs directly on host hardware (also called bare metal); (e.g. VMWare ESX )

Back 38

Type 1 hypervisor

Front 39

Runs as an application on a normal operating system, such as Windows 7; (e.g. VMWare Workstation)

Back 39

A Type 2 hypervisor

Front 40

Three commonly available levels of service provided by cloud providers: In all three cases, the cloud provider manages hardware

Back 40

- Infrastructure as a service (IaaS)
- Platform as a service (PaaS)
- Software as a service (SaaS)

Front 41

Provides an entire virtualized operating system, which the customer configures from the OS on up. (e.g.Linux server hosting)

Back 41

Infrastructure as a service (IaaS)

Front 42

Provides a preconfigured operating system, and the customer configures the applications. (e.g. Web service hosting)

Back 42

Platform as a service (PaaS)

Front 43

Completely configured, from the operating system to applications, and the customer simply uses the application. (e.g. Web Mail)

Back 43

Software as a service (SaaS)

Front 44

Any communication that violates security policy. (e.g. The communication channel used by malware installed on a system that locates personally identifiable information (PII) such as credit card information and sends it to a malicious
server)

Back 44

Covert channel

Front 45

Two specific types of covert channels:

Back 45

Storage channels and timing
channels

Front 46

Uses shared storage, such as a temporary directory, to allow two subjects to signal each other.

Back 46

A storage channel

Front 47

Relies on the system clock to infer sensitive information.

Back 47

A covert timing channel

Front 48

Attacks are also called race conditions. An attacker attempts to alter a condition after it has been checked by the operating system, but before it is used. A state attack, where the attacker capitalizes on a change in operating system state.

Back 48

Time of check, time of use (TOCTOU)

Front 49

Attempts to reduce application architecture down to a functional unit of a service.

Back 49

Service-Oriented Architecture (SOA)

Front 50

Exam Note

Back 50

Do not confuse Service-Oriented Architecture (SOA) with SOAP. They are related, but different concepts:
SOA may use SOAP for connectivity.

Front 51

Used to control database inference

Back 51

Polyinstantiation.

Front 52

Mandatory Access Control model: (no read up (NRU); no write down (NWD), Confidentiality (aka Disclosure)

Back 52

Bell–LaPadula

Front 53

Bell–LaPadula operates by observing two rules:

Back 53

1) Simple Security Property and
2) * Security Property (Star Security Property)

Front 54

States that there is no read up; that is, a subject at a specific classification level cannot read
an object at a higher classification level. (e.g. Subjects with a secret clearance cannot access top secret objects)

Back 54

The Simple Security Property

Front 55

States that there is no write down; that is, a subject at a higher classification level cannot write to a
lower classification level. (e.g. Subjects who are logged into a top secret system cannot send emails to a secret system)

Back 55

The * Security Property (Star Security Property)

Front 56

Within the Bell–LaPadula access control model, there are two properties which dictate how the system will issue security labels for objects.

Back 56

1) Strong Tranquility Property: security labels will not change while the system is operating.
2) Weak Tranquility Property: security labels will not change in a way that conflicts with defined security
properties.

Front 57

Allows security controls for complex environments. For every relationship between a subject
and an object, there are defined upper and lower access limits implemented by the system.

Back 57

Lattice-based access control

Front 58

Mandatory Access Control; Opposite of Bell-LaPadula; (no read down (NRD); no write up (NWU); Focus on Integrity (aka Alteration)

Back 58

Biba

Front 59

The Biba model has two primary rules:

Back 59

1) Simple Integrity Axiom
2) * Integrity Axiom (Star Integrity Axiom)

Front 60

"no read down"; that is, a subject at a specific classification level cannot read data at a lower
classification. This prevents subjects from accessing information at a lower integrity level. This protects integrity by preventing bad information from moving up from lower integrity levels.

Back 60

Simple Integrity Axiom

Front 61

"no write up"; that is, a subject at a specific classification level cannot write to data at a higher
classification. This prevents subjects from passing information up to a higher integrity level than they have clearance to change. This protects integrity by preventing bad information from moving up to higher integrity levels.

Back 61

* Integrity Axiom (Star Integrity Axiom)

Front 62

Real-world integrity model that protects integrity by requiring subjects (e.g.users) to access objects (e.g. database) via programs. Because the programs have specific limitations to what they can and cannot do to objects, effectively limits the capabilities of the subject. Uses two primary concepts to ensure that security policy is enforced; well-formed transactions and separation of duties.

Back 62

Clark–Wilson

Front 63

Clark–Wilson process comprised of the "access control triple":

Back 63

1) User
2) Transformation procedure (TP)
3) Constrained data item (CDI)

Front 64

A well-formed transaction

Back 64

Transformation Procedure (TP)

Front 65

Data that requires integrity.

Back 65

Constrained data item (CDI)

Front 66

Exam Warning !

Back 66

Clark–Wilson requires that users are authorized to access and modify data. It also requires that data is
modified in only authorized ways.

Front 67

Exam Warning !

Back 67

Clark–Wilson enforces the concept of a separation of duties and transformation procedures within the
system.

Front 68

Designed to avoid conflicts of interest by prohibiting one person, such as a consultant, from
accessing multiple conflict of interest categories (CoIs).

Back 68

Brewer–Nash / Chinese Wall model

Front 69

Ensures that data at different security domains remain separate from one another.

Back 69

Noninterference model

Front 70

Contains rules that govern the interactions between subjects (user) and objects (file), and permissions subjects can grant to other subjects. Very complex.

Back 70

Take–grant protection model

Front 71

A table defining what access permissions exist between specific subjects and objects.

Back 71

An access control matrix

Front 72

An access control matrix; each row is called:

Back 72

Capability list.

Front 73

Provides six frameworks for providing information security, asking who, what, when, where, how, why
and mapping those frameworks across rules, including planner, owner, designer, builder, programmer, and user.

Back 73

The Zachman Framework for Enterprise Architecture

Front 74

The Divisions of TCSEC (Trusted
Computer System Evaluation Criteria) (aka Orange book) includes four levels:

Back 74

- D: Minimal Protection. This division describes TCSEC-evaluated systems that do not meet the requirements of higher divisions (C through A).
- C: Discretionary Protection. "Discretionary" means Discretionary Access Control systems (DAC).
- B: Mandatory Protection. "Mandatory" means Mandatory Access Control systems (MAC).
- A: Verified Protection. This includes all requirements of B, plus additional controls

Front 75

Refers to TCSEC Orange Book levels, separating functionality (F: how well a system works) from
assurance (the ability to evaluate the security of a system). There are two types of assurance: effectiveness (Q) and correctness (E)

Back 75

European Information Technology Security Evaluation Criteria (ITSEC)

Front 76

Internationally agreed upon standard for describing and testing the security of IT products.

Use specific terms when defining specific portions of the testing process:
- Target of Evaluation (ToE): the system or product which is being evaluated
- Security Target (ST): the documentation describing the TOE, including security requirements and operational environment
- Protection Profile (PP): an independent set of security requirements and objectives for a specific category of products or systems, such as firewalls and intrusion detection systems
- Evaluation Assurance Level (EAL): the evaluation score of the tested product or system

Back 76

Common Criteria

Front 77

Means a system has been certified to meet the security requirements of the data owner. Considers the system, the security measures taken to protect the system, and the residual risk represented by the system.

Back 77

Certification

Front 78

Data owner's acceptance of the certification, and of the residual risk, required before the system is put
into production.

Back 78

Accreditation