Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
77 Cards in this Set
- Front
- Back
- 3rd side (hint)
|
Confidentiality (formal) |
X = set of entities I = information I has the property of confidentiality with respect to X if no member of X can obtain information about I. |
|
|
|
Integrity (formal) |
X= set of entities I = info or resource I has integrity property with respect to X if all members of X trust I. |
|
|
|
Availability (formal) |
X = set of entities. I = resource I has availability property with respect to X if all members of X can access I. |
|
|
|
What is the commonality (relation) between privacy and security? |
Confidentiality |
|
|
|
Privacy |
Connected to user preference, customizable, user defined. What is privacy to one individual may not be to another (FB). Personal issue only. If your personal privacy preferences are fulfilled than confidentiality is maintained at the level you choose. |
|
|
|
Integrity |
-Accuracy of information -Trust for source -policy protects data/source from modification |
|
|
|
What platform is Availability important to? |
Cloud computing |
|
|
|
Non-Repudiation |
Non-denial. Trust. Sender cannot deny that they sent something if it includes their digital signature or private key (identity) |
|
|
|
Security Policy |
Defines X and I States set of rules--what/who is allowed/not allowed in a system -to create, identify threats and define requirements to ensure a secure system |
|
|
|
Security Mechanisms |
Method, tool, or procedure that implement/enforces security policy Ex. Firewall, blacklist, biometrics, passwords |
|
|
|
Threat / Threat Vector |
Probable risk of attack, probable path of attack (system vulnerability) |
|
|
|
Attack / Attack Vector |
Active exploitation of system vulnerability or weakness |
|
|
|
System States-what are they used for in security? |
Used to formulate security policy Identify secure/insecure states to design policy |
|
|
|
3 solutions for Security policy Mechanisms |
|
|
|
|
Security Mechanism Development |
Uses software development model: 1 Threat analysis 2 Specifications (security policy) 3 Design (development) 4 Implementation (execute design) 5 Operation (use of mechanism-important part of security-must be used to be effective) |
Software development model |
|
|
What is a major security consideration? |
Human issues- - customs, cultures, etc (privacy) - Employee behavior - Social engineering - organization |
|
|
|
Cost-benefit analysis |
Is it more expensive to: -prevent an attack -recover from an attack Determines how you approach security policy |
|
|
|
Risk Analysis |
Risk=chance -Identify assets -Determine chance assets could be compromised/attacked -"should we protect? How strongly?" |
|
|
|
Chinese Wall Model |
A model of a security policy that refers equally to confidentiality and integrity. -Used in situations that involve conflict of interest-- stock exchange, investment houses -users can only have access to one dataset in a COI (conflict of interest) class -uses notion of "past access" to reduce coi |
|
|
|
Confidentiality |
- the concealment of information or resources from unauthorized entities - Security provides confidentiality preferences for privacy. -Information that has had no unauthorized access (secure) is confidential. -core of privacy |
|
|
|
PII |
Personally Identifiable Information -data that provides identity to an entity. -must be removed to provide privacy if data is to be shared |
|
|
|
Attacks on Integrity |
-IP spoofing (source integrity) - |
|
|
|
Access Control Models |
DAC - discretionary access control MAC - mandatory access control RBAC - role-based access control |
|
|
|
Discretionary Access Control |
Discretion of user which resources should be accessed and by whom (ex . FB) |
|
|
|
Mandatory Access Control |
Not user dictated (even admin has no control) ex. Operating System Access Control |
|
|
|
Role-based Access Control |
Identify all subjects and objects and group by roles to build a control matrix. Each role has rights, individuals have roles (no individual rights) Ex. FB "friends", "friends of friends" |
|
|
|
Multi Level Security Model |
Uses security levels to enforce access to information. Top Secret Secret Confidential Unclassified Ex. Bell-Lapadula |
|
|
|
Crux of Integrity |
Trust |
|
|
|
Crux of confidentiality |
Access (disclosure) |
|
|
|
Bell-Lapadula |
Multi level security mechanism developed by DoD and used by gov't agencies. |
|
|
|
Security Levels |
Top Secret Secret Confidential Unclassified |
|
|
|
Security Clearance |
Security levels relative to subjects ex. An employee has secret clearance |
|
|
|
Security Label |
Security level relative to objects ex. The document is top secret |
|
|
|
Why is Integrity Policy hard to enforce? |
Deals with trust, trust is not easy to assess or understand. No way to prove 100% of the time that integrity has been maintained |
|
|
|
Quasi Identifier |
Not a direct identifier (PII), but info that can be linked together to identify someone. |
|
|
|
Authentication |
The mechanism of binding an identity to an entity/subject A matching process--your claim to be someone is matched against a saved profile to gain access. |
|
|
|
Encryption |
Plaintext + key = ciphertext -can be an authenticator-ownership of a key can prove identity |
|
|
|
What are the 3 Authentication Mechanisms? |
-what an entity knows (pswd-most widely used) -what an entity has (key/token) -what an entity is (biometric-fingerprint) |
Knows |
|
|
Authorization |
The process of granting access. Interchangeable with access control ex. Guard at door is doing access control, person cleared by guard is authorized. |
|
|
|
Availability |
The ability to use the info or resource desired. |
|
|
|
Attacks on Availability |
Denial of service |
|
|
|
4 classes of threats |
Disclosure--passive threat (ex. snooping) Deception--active (data modification/alteration, masquerading) Disruption-- Usurpation--unauthorized control of part of a system |
|
|
|
Bell-Lapadula rule |
No read up, No write down Formally: |
|
|
|
BIBA Integrity Model |
Consists of a set of subjects, set of objects and set of integrity levels. Data at a higher level is more accurate/reliable than data at lower levels. Determines "trustworthiness". |
|
|
|
Subject (access control) |
Representation of an entity within a system Active entity. Can do stuff with/to objects Processes (admin, user,etc people are processes)
|
|
|
|
Object (access control) |
Passive entity Receives instructions Files, docs, DBs |
|
|
|
What implements access control? |
Operating system |
|
|
|
Rights (access control) |
Allows you to perform certain actions Read, write, execute, own, append Subject has rights on objects Object has NO rights on subject |
|
|
|
Access control matrix |
S = {s1, s2, s3,....sn} set of subjects O = {o1,o2, o3,....on} set of objects R={r1,r2,r3,....rn} set of rights Set up in a matrix (grid) |
|
|
|
Protection State |
Index of an access control matrix. If state changes, this is a state transition. |
|
|
|
An example of the Confidentiality Property |
Class cheating policy |
|
|
|
How is an Authentication System Defined? |
Using the ACFLS quintuple |
|
|
|
Elements of Authentication system (ACFLS quintuple) |
A- type password at interface C- pswd hash or clear text F- function decides how to save info in system (hash, salt, clear text) L- set of functions that establish or prove identity S- registration, change/ del pswd, create new subject |
|
|
|
Password Verification (L and C from ACFLS) |
L (functions) checks for match against C (password hash or clear text) L: if A == C (clear) If F(A) == C (hash) Verifies identity |
|
|
|
3 goals of Security |
1 prevention 2 detection 3 recovery |
|
|
|
Operational issues of security |
Cost-benefit analysis Risk analysis |
|
|
|
Assurance |
Measure of how well the system meets security requirements Done by following software development model |
|
|
|
States: 2 things to determine when formulating policy? |
What states are secure in the system? What states are reachable in the system? If Reachable > secure = insecure system |
|
|
|
Vulnerability |
A weakness in: software, system, whatever you are protecting. |
|
|
|
2 types of Password Attacks |
Online- entering guesses in real time Offline- brute force using hash tables |
|
|
|
K- anonymity |
K anonymity will make one person indistinguishable from k-1 other people. Hides the individual within a collection Remove any info that makes an individual uniquely identifiable. |
|
|
|
Digital certificate |
used for machine authentication. (Since they don't have passwords!) Used by browser to verify identity claim of a server. |
|
|
|
Certificate Authority |
Issues digital certificates. Verisign |
|
|
|
What does a digital certificate include? |
Certificate authority signature Expiration date Public key |
|
|
|
How do we authenticate identity of a system? |
With digital certificates, authenticated by the client-agent (browser) |
|
|
|
What is Identity? |
A collection of claims (different attributes of you) Strongly connected to representation |
|
|
|
What is Anonymity? |
Hiding claims to ensure privacy. Hiding identity. |
|
|
|
What is a Capabilities list? |
Conceptually like a row of an access control matrix. Each subject has set of pairs, each pair contains object and a set of rights for that object. |
|
|
|
Access control list (acl) |
Each column is stored with the object it represents. Each object has a set of pairs, each pair contains a suject and a set of rights. |
|
|
|
Pillars of Security |
Confidentiality Integrity Availability Non-repudiation |
|
|
|
What Is the distinction between a military (govt) security policy and a commercial security policy? |
Military policy designed primarily to provide confidentiality Commercial policy designed primarily to provide integrity. |
|
|
|
What are some rights? |
Read, write, execute, Append, own |
|
|
|
What are cookies? |
Key value pairs saved on your machine to make communication over the internet faster. Ex. Amazon shopping cart Security hole |
|
|
|
Describe the crypto system as a quintuple |
M = set of plain text C = set of cipher text K = set of keys E = set of encryption functions E = M + K -> C D = set of decryption functions D = C + K -> M |
|
|
|
Name security components that can be achieved using asymmetric cryptography |
*Confidentiality--private key decryption means only authorized subject can access info *Integrity--key encrypted data cannot be modified even if intercepted *Non Repudiation--Private key can be used for identity. Owner of key used for encryption cannot deny message. |
|
|
|
What is security? |
The guarding of information; access control. Has many factors, requires fine balance |
|
|
|
Difference between privacy and security |
Preference. Privacy is based on preference of the user and what privacy means to them. Security has no focus on preference but only on guarding information based in requirements. |
|
