00) Chapter 9 TEST

3. Distributed System / Client Server

A model (where users operate independent, fully functional desktop computers but also access services and resources on networked servers),

I2. Data Mart: "area in a data warehouse where they store high value data"

A location where data of a greater value or sensitivity (due to disclosure) than the bulk of data in the warehouse is stored, for example, metadata is stored in a more secure container known as the data mart.

D. Android:

A mobile device OS based on Linux, acquired by Google in 2005. In 2008, the first devices hosting this OS were made available to the public. The source code is made open source through the Apache license, but most devices also include proprietary software.

A5. > 2). EEPROM (Electronically Erasable Programmable Read-Only Memory): "uses electric voltages delivered to the pins of the chip to force erasure"

A more flexible, friendly alternative to UVEPROM is electronically erasable PROM (EEPROM), EEPROM uses electric voltages delivered to the pins of the chip to force erasure. 1). Erased with electronic voltages 2). Uses electric voltages delivered to the pins of the chip to force erasure. 3). BIOS and device firmware are often stored on EEPROM chips to facilitate future firmware updates.

N2. Cross-site request forgery (XSRF): "exploit trust sites have in a user's browser, & force submission of authenticated requests to 3rd-party sites"

Cross-site request forgery (XSRF or CSRF) attacks exploit the trust that sites have in a user's browser by attempting to force the submission of authenticated requests to third-party sites. 1). Cross-site request forgery (XSRF) is an attack that is similar in nature to XSS. 2). However, with XSRF, the attack is focused on the visiting user's web browser more than the website being visited. 3). The main purpose of XSRF is to trick the user or the user's browser into performing actions they had not intended or would not have authorized. 4). This could include logging out of a session, uploading a site cookie, changing account information, downloading account details, making a purchase, and so on. 5). One form of XSRF infects a victim's system with malware that stays dormant until a specific website is visited. 6). Then the malware forges requests as the user in order to fool the web server and perform malicious actions against the web server and/ or the client.

F5. The Salami Attack in Pop Culture:

If you want an entertaining method of learning about the salami attack or the salami technique, view the movies Office Space, Sneakers, and Superman III. You can also read the article from Wired about an attack of this nature from 2008: https:// www.wired.com/ 2008/ 05/ man-allegedly-b/.

B1. Primary Storage: "primary memory is RAM"

Is the RAM that a computer uses to keep necessary information readily available to the CPU while the computer is running.

E6. Operand: "computer instruction specifies data to be manipulated or operated on"

Is the part of a computer instruction which specifies what data is to be manipulated or operated on, while at the same time representing the data itself.

B3). Supervisory Control and Data Acquisition (SCADA): 🎛🎛🏭. 🌏 🎛🎛🏭. 🌏 🎛🎛🏭. "distribution of power across an entire power grid"

POWER GRID! 1). The supervisory control and data acquisition (SCADA) systems were developed to control large-scale physical processes involving nodes separated by significant distances. 2). The main conceptual differences between DCS and SCADA are size and distances. So, while the control of a power plant is perfectly suited for a traditional DCS, the distribution of the generated power across a power grid would require a SCADA system. 3). SCADA systems typically involve three kinds of devices: endpoints, backends, and user stations. 4). A remote terminal unit (RTU) is an endpoint that connects directly to sensors and/ or actuators. Though there are still plenty of RTUs in use, many of these have now been replaced with PLCs. 5). The data acquisition servers (DAS) are backends that receive all data from the endpoints through a telemetry system, and perform whatever correlation or analysis may be necessary. 6). Finally, the users in charge of controlling the system interact with it through the use of a human-machine interface (HMI), the user station, that displays the data from the endpoints and allows the users to issue commands to the actuators (e.g., to close a valve or open a switch).

A4. > 1). UVEPROMs (Ultraviolet EPROMs): "Erased with UV light'

Ultraviolet EPROMs (UVEPROMs) can be erased with a light. These chips have a small window that, when illuminated with a special ultraviolet light, causes the contents of the chip to be erased. After this process is complete, end users can burn new information into the UVEPROM as if it had never been programmed before. 1). Erased with UV light. 2). These chips have a small window, when illuminated with a special UV light, contents of the chip to be erased. 3). End users can burn new information into the UVEPROM as if it had never been programmed before.

C3. Capacitors:

Used in Dynamic RAM, Tiny electrical devices that hold a charge.

C5. Flip-Flops: "on/off switch"

Used in Static Ram, is simply an on/ off switch that must be moved from one position to another to change a 0 to 1 or vice versa.

C2. Trusted Recovery: "ensures that all security controls remain intact in the event of a crash"

When an unprepared system crashes and subsequently recovers, two opportunities to compromise its security controls may arise. Many systems unload security controls as part of their shutdown procedures. Trusted recovery ensures that all security controls remain intact in the event of a crash. During a trusted recovery, the system ensures that there are no opportunities for access to occur when security controls are disabled. Even the recovery phase runs with all controls intact. 1). Ensures that all security controls remain intact in the event of a crash. 2). Trusted recovery ensures that there are no opportunities for access to occur when security controls are disabled. 3). Even the recovery phase runs with all controls intact.

H4. The time of use (TOU):

When the decision is made to access the object, the procedure accesses it at this time.

D2. Type I Hypervisor (Native, bare metal): "hypervisor installs directly on hardware where host OS would normally be"nice

Type I Hypervisor (Native, bare metal): "hypervisor installs directly on hardware where host OS would normally be"nice

D2. Injection Attack Naming Conventions:

Typically, an injection attack is named after the type of backend system it takes advantage of or the type of payload delivered (injected) onto the target. EXAMPLES INCLUDE: 1). Structured Query Language (SQL) injection, 2). Lightweight Directory Access Protocol (LDAP), 3). XML injection, command injection, 4). Hypertext Markup Language (HTML) injection, code injection, and file injection.

J6. A Community Cloud: "two or more organizations pool their resources to create a cloud environment that they then share"

1). A Community Cloud is a cloud environment maintained, used, and paid for by a group of users or organizations for their shared benefit, such as collaboration and data exchange. 2). This may allow for some cost savings compared to accessing private or public clouds independently.

2). EXAM ESSENTIALS: Understand smart devices:

1). A smart device is a range of mobile devices that offer the user a plethora of customization options, typically through installing apps, and may take advantage of on-device or in-the-cloud artificial intelligence (AI) processing.

J5. A Faraday Cage:

1). A special enclosure that acts as an EM capacitor. 2). When a Faraday cage is in use, no EM signals can enter or leave the enclosed area.

E. 2.). User Mode Often Executed In A Controlled Environment Called A Virtual Machine (VM)

Often processes within user mode are executed within a controlled environment called a virtual machine (VM). 1). A virtual machine is a simulated environment created by the OS to provide a safe and efficient place for programs to execute. 2). Each VM is isolated from all other VMs, and each VM has its own assigned memory address space that can be used by the hosted application. 3). It is the responsibility of the elements in privileged mode (aka kernel mode) to create and support the VMs and prevent the processes in one VM from interfering with the processes in other VMs.

D). YOU. MUST CONTROL WHO ACCESSES MEMORY:

One of the most important security issues surrounding memory is controlling who may access data stored in memory while a computer is in use. This is primarily the responsibility of the operating system and is the main memory security issue underlying the various processing modes described in previous sections in this chapter. The principle of process isolation can be used to ensure that processes don't have access to read or write to memory spaces not allocated to them.

B4). The READY State: "process has all memory & resources to begin executing immediately"

"The Ready state is used when a process is prepared to execute, but the CPU is not available" 1). In this state, a process is ready to resume or begin processing as soon as it is scheduled for execution. 2). If the CPU is available when the process reaches this state, it will transition directly into the running state; 3). Otherwise, it sits in the ready state until its turn comes up. 4). This means the process has all the memory and other resources it needs to begin executing immediately.

B6). The RUNNING State: (also called the problem State)

"The Running state is used when a process is executing on the CPU" 1). Process executes on the CPU & keeps going until it finishes, its time slice expires, or it is blocked for some reason. 2). If the time slice ends and the process isn't completed, it returns to the ready state (and queue); 3). if the process blocks while waiting for a resource to become available, it goes into the waiting state (and queue).

B8). The STOPPED State:

"The Stopped state is used when a process terminates" Stopped When a process finishes or must be terminated (because an error occurs, a required resource is not available, or a resource request can't be met), it goes into a stopped state. At this point, the operating system can recover all memory and other resources allocated to the process and reuse them for other processes as needed. 1). When a process finishes or must be terminated (because an error occurs, a required resource is not available, 2). Or a resource request can't be met), it goes into a this state. 3). At this point, the operating system can recover all memory and other resources allocated to the process and reuse them for other processes as needed.

B5). The WAITING State: "waiting for a resource"

"The Waiting state is used when a process is blocked waiting for an external event" 1). Also understood as "waiting for a resource" 2). The process is ready for continued execution but is waiting for a device or access request (an interrupt of some kind) to be serviced before it can continue processing 3). For example, a database application that asks to read records from a file must wait for that file to be located and opened and for the right set of records to be found).

N2. Asymmetric Multiprocessing (AMP): "In AMP, processors operate independently of each other"

"Working Independently from each other!" 1). The processors are often operating independently of each other. 2). Each processor has its own OS and/ or task instruction set. 3). Each processor can be configured to execute specific code tasks

O2. Symmetric Multiprocessing (SMP): "In SMP, the processors each share a common OS and memory"

"Working together as a group!" 1). Processors each share a common OS and memory. 2). The collection of processors also works collectively on a single task, code, or project. implemented onto the same chip.

F3. Data Flow Control:

"ensures efficient data transmission with minimal delays or latency" 1). Ensures not only efficient data transmission with minimal delays or latency, 2). Ensures reliable throughput using hashing and confidentiality protection with encryption. 3). Ensures that receiving systems are not overloaded with traffic, to the point of dropping connections or being subject to a malicious or even self-inflicted denial of service.

F5. Load Balancer:

"spread or distribute network traffic load across several network links or network devices" 1). Used to spread or distribute network traffic load across several network links or network devices. 2). Provide more control over data flow. 3). Designed to obtain more optimal infrastructure utilization, minimize response time, maximize throughput, reduce overloading, and eliminate bottlenecks.

B3). Process Scheduler: "selects the highest priority processes to go first"

1). A PROCESS SCHEDULER usually selects the HIGHEST-PRIORITY process for execution 2). So even if you reach the front of the line it doesn't always guarantee access to the CPU (because a process may be preempted at the last instant by another process with higher priority).

B2). Processing Queue: "processes line up for execution in an operating system"

1). A Processing Queue is when processes line up for execution in an operating system, where they will be scheduled to run as a processor becomes available. 2). Many operating systems only allow processes to consume processor time only in FIXED INCREMENTS or CHUNKS, 3). When a new process is created, it enters the processing queue for the first time 4). If a process consume its entire chunk of processing time (called a time slice) without completing its objective, it must return to the processing queue and wait for another time slice the next time its turn comes around.

D2. EXAM ESSENTIALS: Understand what buffer overflows and input checking are.

1). A buffer overflow occurs when the programmer fails to check the size of input data prior to writing the data into a specific memory location. 2). In fact, any failure to validate input data could result in a security violation.

A2. Client Side Attack: "an attack that is able to harm a client.

1). A client-side or client-focused attack is one where the client itself, or a process on the client, is the target. 2). A common example of a client-side attack is a malicious website that transfers malicious mobile code (such as an applet) to a vulnerable browser running on the client. 3). Client-side attacks can occur over any communications protocol, not just Hypertext Transfer Protocol (HTTP). 4). Another potential vulnerability that is client based is the risk of poisoning of local caches.

L3. EXAM ESSENTIALS: Define CASB.

1). A cloud access security broker (CASB) is a security policy enforcement solution 2). A CASB may be installed on-premises, or it may be cloud based.

B3. The Internet of Things (IoT): "group of devices communicating over the internet via a control console"

1). A collection of devices that can communicate over the internet with one another or with a control console in order to affect and monitor the real world. 2). IoT devices might be labeled as smart devices or smart-home equipment. 3). Many of the ideas of industrial environmental control found in office buildings are finding their way into more consumer-available solutions for small offices or personal homes. 4). IoT is not limited to static location equipment but can also be used in association with land, air, or water vehicles or on mobile devices. 5). IoT devices are usually static systems since they may only run the firmware provided by the manufacturer.

N2. The Cloud Shared Responsibility Model: "the security responsibility line of demarcation between the client & cloud service provider"

1). A concept that when an organization uses a cloud solution, there is a division of security and stability responsibility between the provider and the customer.

A2. EXAM ESSENTIALS: Be able to explain what covert channels are.

1). A covert channel is any method that is used to pass information but that is not normally used for information.

A5 2). Covert Storage Channel: "conveys data by writing data to a common storage area where another process can read it"

1). A covert storage channel conveys information by writing data to a common storage area where another process can read it. 2). When assessing the security of software, be diligent for any process that writes to any area of memory that another process can read.

A4 1). Covert Timing Channel: "conveys data by altering system component performance/timing in a predictable manner"

1). A covert timing channel conveys information by altering the performance of a system component or modifying a resource's timing in a predictable manner. 2). Using a covert timing channel is generally a method to secretly transfer data and is very difficult to detect.

I4. A Hosted Solution:

1). A deployment concept where the organization must license software and then operates and maintains the software provided by the vendor. 2). Pays for all of it whether it is used or not.

O2. Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA)

1). A mechanism to differentiate between humans and software robots.

J5. A Hybrid Cloud: "mixture of private and public cloud components"

1). A mixture of private and public cloud components. 2). For example, an organization could host a private cloud for exclusive internal use but distribute some resources onto a public cloud for the public, business partners, customers, the external sales force, and so on.

D9. 9). User Acceptance: "policy needs to be clear and specific about all the elements of using a personal device at work"

1). A mobile device policy needs to be clear and specific about all the elements of using a personal device at work. 2). For many users, the restrictions, security settings, and MDM tracking implemented under company policy will be much more onerous than they expect. 3). Thus, organizations should make the effort to fully explain the details of a mobile device policy prior to allowing a personal device into the production environment. 4). Only after an employee has expressed consent and acceptance, typically through a signature, should their device be on-boarded.

D8. 8). Adherence to Corporate Policies: "personal mobile device used for business requires adherence to corporate policies"

1). A mobile device policy should clearly indicate that using a personal mobile device for business activities doesn't exclude a worker from adhering to corporate policies. 2). A worker should treat mobile device equipment as company property and thus stay in compliance with all restrictions, even when off premises and off hours.

J2. A Private Cloud is a service: "a cloud service within a corporate network and isolated from the internet"

1). A private cloud is a cloud service within a corporate network and isolated from the internet. 2). The private cloud is for internal use only.

B3. Aggregation Attack:

1). A security issue that arises when a collection of facts has a higher classification than the classification of any of those facts standing alone. 2). For this reason, security administrators should strictly control access to aggregate functions and adequately assess the potential information they may reveal to unauthorized individuals.

T. 11). Device Access Control:

1). A strong password would be a great idea on a phone or other mobile device if locking the phone provided true security. 2). But many mobile devices aren't secure, so even with a strong password, the device is still accessible over Bluetooth, wireless, or a USB cable. 3). If a specific mobile device blocked access to the device when the system lock was enabled, this would be a worthwhile feature to set to trigger automatically after a period of inactivity or manual initialization. 4). This benefit is usually obtained when you enable both a device password and storage encryption. You should consider any means that reduces unauthorized access to a mobile device. 5). Many MDM solutions can force screen-lock configuration and prevent a user from disabling the feature.

C4). System's Security Modes Of Operations:

1). A system's security mode of operation describes how a system handles stored information at various classification levels. 2). Several security modes of operation, based on the classification level of information being processed on a system and the clearance level of authorized users, have been defined. 3). These designations are typically used for U.S. military and government systems, and include: >. 4.1.). Dedicated Mode: >. 4.2.). System High Mode: >. 4.3.). Compartmented Mode: >>>. 4.3.1.). Compartmented Mode Workstations (CMWs): >. 4.4.). Multilevel Mode: >. 4.5.). Limited Access Mode:

B4. TEMPEST: "allows Van Eck radiation to be read from a distance"

1). A technology that allows the electronic emanations that every monitor produces (known as Van Eck radiation) to be read from a distance (this process is known as Van Eck phreaking) and even from another location. 2). Countermeasures to prevent Van Eck radiation include (lots and lots of copper!) are expensive to implement and cumbersome to use.

D3. EXAM ESSENTIALS: Know about the type I hypervisor.

1). A type I hypervisor is a native or bare-metal hypervisor. In this configuration, there is no host OS; instead, the hypervisor installs directly onto the hardware where the host OS would normally reside.

E3. EXAM ESSENTIALS: Know about the type II hypervisor.

1). A type II hypervisor is a hosted hypervisor. 2). In this configuration, a standard regular OS is present on the hardware, and the hypervisor is then installed as another software application.

J3. A Virtual Private Cloud is a service: "cloud service offering provides isolated subsection of public/external cloud for exclusive internal use by an organization"

1). A virtual private cloud is a service offered by a public cloud provider that provides an isolated subsection of a public or external cloud for exclusive use by an organization internally. 2). In other words, an organization outsources its private cloud to an external provider.

C1). Number 2) Abstraction: "users of an object, don't need to know object details, just the proper syntax for using the object"

1). Abstraction is one of the fundamental principles behind the field known as object-oriented programming. 2). It is the "black-box" doctrine that says that users of an object (or operating system component) don't necessarily need to know the details of how the object works; they need to know just the proper syntax for using the object and the type of data that will be returned as a result (that is, how to send input and receive output). 3). Another way in which abstraction applies to security is in the introduction of object groups, sometimes called classes, where access controls and operation rights are assigned to groups of objects rather than on a per-object basis. 4). This approach allows security administrators to define and name groups easily (the names are often related to job roles or responsibilities) and helps make the administration of rights and privileges easier (when you add an object to a class, you confer rights and privileges rather than having to manage rights and privileges for each object separately).

4). Data Access: "enforce system access controls"

1). Access to data stored on secondary storage devices is one of the most critical issues facing computer security professionals. 2). For hard disks, data can often be protected through a combination of operating system access controls. 3). Removable media pose a greater challenge, so securing them often requires encryption technologies.

H7). Applying Accountability to computer architecture: "ensures that an audit trail exists to trace operations back to their source"

1). Accountability is an essential component in any security design. 2). Accountability ensures that an audit trail exists to trace operations back to their source. 3). Many high-security systems contain physical devices (such as paper-and-pen visitor logs and nonmodifiable audit trails) that enforce individual accountability for privileged functionality. ACCOUNTABILITY DEPENDS ON ABILITY TO MONITOR USERS & PROTECT LOG DATA: 4). In general, however, such capabilities rely on a system's ability to monitor activity on and interactions with a system's resources and configuration data and to protect resulting logs from unwanted access or alteration so that they provide an accurate and reliable record of activity and interaction that documents every user's (including administrators or other trusted individuals with high levels of privilege) history on that system.

V. 13). Disabling Unused Features:

1). Although enabling security features is essential for them to have any beneficial effect, it's just as important to remove apps and disable features that aren't essential to business tasks or common personal use. 2). The wider the range of enabled features and installed apps, the greater the chance that an exploitation or software flaw will cause harm to the device and/ or the data it contains.

G4. Phlashing: "bios malicious firmware"

1). An attack in which a malicious variation of official BIOS or firmware is installed that introduces remote control or other malicious features into a device.

H2. XML injection: "attack that injects XML tags and data into a database"

1). An attack that injects XML tags and data into a database. 2). A programming attack that is used to either falsify information being sent to a visitor or cause their system to give up information without authorization.

I2. Directory Traversal/ Command Injection Attack:

1). An attacker attempts to force the web application to navigate up the file hierarchy and retrieve a file that should not normally be provided to a web user, such as the password file. 2). A series of "double dots ../../../../../../../../../etc/passwd" is indicative of a directory traversal attack 3). It is the "double dots" character string used to reference the directory one level up in a hierarchy. 4). This attack can be stopped with metacharacter escaping or filtering. 5). Many modern web servers can be vulnerable to variations of this attack as new forms of alternate encoding of the change-to-parent command are crafted.

A2. Embedded System: "computer implemented as part of a larger system"

1). An embedded system is a computer implemented as part of a larger system. 2). The embedded system is typically designed around a limited set of specific functions in relation to the larger product of which it's a component. 3). It may consist of the same components found in a typical computer system, or it may be a microcontroller (an integrated chip with on-board memory and peripheral ports). 4). Examples of embedded systems include network-attached printers, smart TVs, HVAC controls, smart appliances, smart thermostats, vehicle entertainment/ driver assist/ self-driving systems, and medical devices.

A4. EXAM ESSENTIALS: Understand embedded systems and static environments.

1). An embedded system is typically designed around a limited set of specific functions in relation to the larger product of which it's a component. 2). Static environments are applications, OSs, hardware sets, or networks that are configured for a specific need, capability, or function, and then set to remain unaltered.

5. Computer architecture:

1). An engineering discipline concerned with the design and construction of computing systems at a logical level.

B0. An industrial control system (ICS):

1). An industrial control system is a form of computer-management device that controls industrial processes and machines. ICSs are used across a wide range of industries, including manufacturing, fabrication, electricity generation and distribution, water distribution, sewage processing, and oil refining. 2). There are several forms of ICS, including: >. Distributed control systems (DCSs), >. Programmable logic controllers (PLCs), and >. Supervisory control and data acquisition (SCADA).

C2. Injection Attack: "submitting malicious code to a target system to modify operations, poison & corrupt its data set"

1). An injection attack is any exploitation that allows an attacker to submit code to a target system in order to modify its operations and/ or poison and corrupt its data set. 2). There are a wide range of potential injection attacks. 3). Typically, an injection attack is named after the type of backend system it takes advantage of or the type of payload delivered (injected) onto the target. EXAMPLES INCLUDE: >. Structured Query Language (SQL) injection, >. Lightweight Directory Access Protocol (LDAP), >. XML injection, command injection, >. Hypertext Markup Language (HTML) injection, code injection, and file injection.

E3. Privileged Programs: "a program whose security level is elevated during execution"

1). Another common system vulnerability is the practice of executing a program whose security level is elevated during execution. 2). Such programs must be carefully written and tested so they do not allow any exit and/ or entry points that would leave a subject with a higher security rating. 3). Ensure that all programs that operate at a high security level are accessible only to appropriate users and that they are hardened against misuse. 4). A good example of this is root-owned world-writable executable scripts in the Unix/ Linux OS environment. This major security flaw is overlooked all too often. Anyone can modify the script, and it will execute under root context allowing users to be created, resulting in backdoor access.

A3. Static Systems: "set of conditions, events, and surroundings that don't change"

1). Another similar concept to that of embedded systems are static systems (aka static environments). 2). A static environment is a set of conditions, events, and surroundings that don't change. In theory, once understood, a static environment doesn't offer new or surprising elements. 3). A static IT environment is any system that is intended to remain unchanged by users and administrators. 4). The goal is to prevent, or at least reduce, the possibility of a user implementing change that could result in reduced security or functional operation. 5). In technology, static environments are: >. applications, >. Operating Systems, >. hardware sets, or >. networks that are configured for a specific need, capability, or function, and then set to remain unaltered. 6). However, although the term static is used, there are no truly static systems. There is always the chance that a hardware failure, a hardware configuration change, a software bug, a software-setting change, or an exploit may alter the environment, resulting in undesired operating parameters or actual security intrusions.

B1. Network-Enabled Devices:

1). Any type of portable or nonportable device that has native network capabilities. 2). This generally assumes the network in question is a wireless type of network, primarily that provided by a mobile telecommunications company. 3). However, it can also refer to devices that connect to Wi-Fi

A6). Application Whitelisting:

1). Application whitelisting is a security option that prohibits unauthorized software from being able to execute. 2). Whitelisting is also known as deny by default or implicit deny. 3). In application security, whitelisting prevents any and all software, including malware, from executing unless it's on the preapproved exception list: the whitelist.

P. 7). Storage Segmentation (Device Security): "artificially compartmentalize various types or values of data on a storage medium"

1). Artificially compartmentalize various types or values of data on a storage medium. 2). On a mobile device, the device manufacturer and/ or the service provider may use storage segmentation to isolate the device's OS and preinstalled apps from user-installed apps and user data. 3). Some MDM (mobile device-management systems) further impose storage segmentation in order to separate company data and apps from user data and apps.

5). Data Availability: "make sure backup storage is up to the task"

1). As availability is also part of the security triad, it is essential to choose media that will retain data for the length of the time required. 2). For instance, a backup tape might degrade before the retention period of the data terminates. 3). Also, the technology used for secondary storage might become obsolete, making it difficult to restore/ read the data.

B. Execution Types: "features enable systems to process data faster and manage multiple functions simultaneously"

1). As computer processing power increased, users demanded more advanced features to enable these systems to process information at greater rates and to manage multiple functions simultaneously. 2). Computer engineers devised several methods to meet these demands:

2. Assess and Mitigate Security Vulnerabilities:

1). In this chapter, we'll cover those underlying security concerns by conducting a brief survey of a field known as computer architecture: the physical design of computers from various components.

2. Distributed Systems and Endpoint Security:

1). As computing has evolved from a host/ terminal model (where users could be physically distributed but all functions, activity, data, and resources reside on a single centralized system) to a client-server model (where users operate independent, fully functional desktop computers but also access services and resources on networked servers), security controls and concepts have had to evolve to follow suit. 2). This means that clients have computing and storage capabilities and, typically, that multiple servers do likewise. 3). The concept of a client-server model network is also known as a distributed system or a distributed architecture. Thus, security must be addressed everywhere instead of at a single centralized host. 4). From a security standpoint, this means that because processing and storage are distributed on multiple clients and servers, all those computers must be properly secured and protected. 5). It also means that the network links between clients and servers (and in some cases, these links may not be purely local) must also be secured and protected. 6). When evaluating security architecture, be sure to include an assessment of the needs and risks related to distributed architectures.

A3). Ring 0). "contains OS, kernel/memory"

1). As the innermost ring, 0 has the highest level of privilege and can basically access any resource, file, or memory location. 2). The part of an operating system that always remains resident in memory (so that it can run on demand at any time) is called the kernel. 3). Ring 0 and can preempt code running at any other ring.

Q. 8). Asset Tracking: "used to maintain oversight over an inventory"

1). Asset tracking is the management process used to maintain oversight over an inventory, such as deployed mobile devices. 2). An asset-tracking system can be passive or active. 3). Passive systems rely on the asset itself to check in with the management service on a regular basis, or the device is detected as being present in the office each time the employee arrives at work. 4). An active system uses a polling or pushing technology to send out queries to devices in order to elicit a response.

A3). Authentication:

1). Authentication on or to a mobile device is often fairly simple, especially for mobile phones and tablets. However, a swipe or pattern access shouldn't be considered true authentication. 2). Whenever possible, use a password, provide a personal identification number (PIN), offer your eyeball or face for recognition, scan your fingerprint, or use a proximity device such as an NFC or RFID ring or tile. 3). These means of device authentication are much more difficult for a thief to bypass if properly implemented. As mentioned previously, it's also prudent to combine device authentication with device encryption to block access to stored information via a connection cable.

D1.). Limited Access Mode:

1). Authorized users aren't required to have a security clearance, but the highest level of information on the system is Sensitive but Unclassified (SBU).

G2. Basic Input/Output System (BIOS): "contains instructions needed to start a computer when it's first powered on"

1). BIOS, or Basic Input-Output System, contains instructions needed to start a computer when it's first powered on, initialize devices, and load the operating system from secondary storage (such as a hard drive). 2). The BIOS is contained in a firmware device that is accessed immediately by the computer at boot time. In most computers, the BIOS is stored on an EEPROM chip to facilitate version updates. 3). The process of updating the BIOS is known as "flashing the BIOS." There have been a few examples of malicious code embedding itself into BIOS/ firmware. 4). There is also an attack known as PHLASHING, in which a malicious variation of official BIOS or firmware is installed that introduces remote control or other malicious features into a device. DETAILS: 1). Firmware containing the OS-independent instructions a computer needs to start & load the OS from disk. 2). Is accessed immediately by the computer at boot time. 3). In most computers, is stored on an EEPROM chip to facilitate version updates. ☠️ There have been a few examples of malicious code embedding itself into BIOS/ firmware. ☠️

B2. BYOD Policies:

1). Bring your own device (BYOD) is a policy that allows employees to bring their own personal mobile devices into work and use those devices to connect to (or through) the company network to business resources and/ or the internet. 2). Although BYOD may improve employee morale and job satisfaction, it increases security risk to the organization.

B1. EXAM ESSENTIALS: Understand BYOD.

1). Bring your own device (BYOD) is a policy that allows employees to bring their own personal mobile devices to work and then use those devices to connect to (or through) the company network to business resources and/ or the internet. 2). Although BYOD may improve employee morale and job satisfaction, it increases security risks to the organization. BYOD RELATED ISSUES INCLUDE: 1). Data Ownership, 2). Support Ownership, 3). Patch Management, 4). Antivirus Management, 5). Forensics, 6). Privacy, 7). On-Boarding/ Off-Boarding, 8). Adherence to Corporate Policies, 9). User Acceptance, 10). Architecture/ Infrastructure Considerations, 11). Legal concerns, 12). Acceptable Use Policies, and 13). On-Board Cameras/ Video.

D3. Buffer Overflows: "attacker try's to supply malicious instructions/code as part of program input"

1). Buffer overflows occur when programmers fail to VALIDATE INPUT DATA sufficiently, particularly when they do not impose a limit on the amount of data their software will accept as input. 2). Because such data is usually stored in an input buffer, when the normal maximum size of the buffer is exceeded, the extra data is called overflow. 3). Thus, the type of attack that results when someone attempts to supply malicious instructions or code as part of program input is called a buffer overflow. 4). Unfortunately, in many systems such overflow data is often executed directly by the system under attack at a high level of privilege or at whatever level of privilege attaches to the process accepting such input.

B1). Number 1). Layering: "structure similar to the ring model used for operating modes"

1). By layering processes, you implement a structure similar to the ring model used for operating modes (and discussed earlier in this chapter) and apply it to each operating system process. 2). It puts the most sensitive functions of a process at the core, surrounded by a series of increasingly larger concentric circles with correspondingly lower sensitivity levels (using a slightly different approach, this is also sometimes explained in terms of upper and lower layers, where security and privilege decrease when climbing up from lower to upper layers). 3). In discussions of OS architectures, the protected ring concept is common, and it is not exclusive. 4). There are other ways of representing the same basic ideas with levels rather than rings. In such a system, the highest level is the most privileged, while the lowest level is the least privileged.

B2. Attacks Based on Design or Coding Flaws and Security Issues:

1). Certain attacks may result from poor design techniques, questionable implementation practices and procedures, or poor or inadequate testing. 2). Some attacks may result from deliberate design decisions when special points of entry built into code to circumvent access controls, login, or other security checks often added to code while under development are not removed when that code is put into production. 3). In the sections that follow, we cover common sources of attack or vulnerabilities of security architectures that can be attributed to failures in design, implementation, prerelease code cleanup, or out-and-out coding mistakes.

A1. CLIENT-BASED SYSTEMS: "client-based vulnerabilities place users, their data, & their system at risk"

1). Client-based vulnerabilities place the user, their data, and their system at risk of compromise and destruction. 2). A client-side attack is any attack that is able to harm a client. 3). Generally, when attacks are discussed, it's assumed that the primary target is a server or a server-side component. 4). A client-side or client-focused attack is one where the client itself, or a process on the client, is the target. 5). A common example of a client-side attack is a malicious website that transfers malicious mobile code (such as an applet) to a vulnerable browser running on the client. 6). Client-side attacks can occur over any communications protocol, not just Hypertext Transfer Protocol (HTTP). 7). Another potential vulnerability that is client based is the risk of poisoning of local caches.

A3. EXAM ESSENTIALS: Understand the risks associated with cloud computing and virtualization.

1). Cloud computing and virtualization, especially when combined, have serious risks associated with them. 2). Once sensitive, confidential, or proprietary data leaves the confines of the organization, it also leaves the protections imposed by the organizational security policy and resultant infrastructure. 3). Cloud services and their personnel might not adhere to the same security standards as your organization.

B2. Cloud Computing:

1). Cloud computing is a natural extension and evolution of virtualization, the internet, distributed architecture, and the need for ubiquitous access to data and resources. 2). However, it does have some issues, including privacy concerns, regulation compliance difficulties, use of open-versus closed-source solutions, adoption of open standards, and whether or not cloud-based data is actually secured (or even securable).

A2. EXAM ESSENTIALS: Understand cloud computing.

1). Cloud computing is the popular term referring to a concept of computing where processing and storage are performed elsewhere over a network connection rather than locally. 2). Cloud computing is often thought of as Internet-based computing.

F2. Cloud Storage: "using storage capacity provided by a cloud vendor"

1). Cloud storage is the idea of using storage capacity provided by a cloud vendor as a means to host data files for an organization. 2). Cloud storage can be used as form of backup or support for online data services. 3). Cloud storage may be cost effective, but it is not always high speed or low latency. 4). Most do not yet consider cloud storage as a replacement for physical backup media solutions but rather as a supplement for organizational data protection. 5). Additionally, using cloud storage may involve additional risk because your organization's data is residing on equipment in another facility and under third-party control.

E2. 11). Legal Concerns: "evaluate the legal concerns of mobile devices"

1). Company attorneys should evaluate the legal concerns of mobile devices. 2). Using personal devices in the execution of business tasks probably means an increased burden of liability and risk of data leakage.

B3. Cache RAM: "takes data from slower devices and temporarily storing it in faster devices when repeated use is likely"

1). Computer systems use this type of memory to improve performance by taking data from slower devices and temporarily storing it in faster devices when repeated use is likely.

L2. Cross-site scripting (XSS): "attacker compromises web server & inject malicious code into content sent to other visitors"

1). Cross-site scripting (XSS) is a form of malicious code-injection attack in which an attacker is able to compromise a web server and inject their own malicious code into the content sent to other visitors. 2). Hackers have discovered numerous and ingenious methods for injecting malicious code into websites via Common Gateway Interface (CGI) scripts, web server software vulnerabilities, SQL injection attacks, frame exploitation, DNS redirects, cookie hijacks, and many other forms of attack. 4). A successful XSS attack can result in identity theft, credential theft, data theft, financial losses, or the planting of remote-control software on visiting clients.

B2. Cyber-Physical Systems: "means to control something in the physical world"

1). Cyber-physical systems refer to devices that offer a computational means to control something in the physical world. 2). In the past these might have been referred to as embedded systems, but the category of cyber-physical seems to focus more on the physical world results rather than the computational aspects. 3). Cyber-physical devices and systems are essentially key elements in robotics and sensor networks. 4). Examples of cyber-physical systems include prosthetics to provide human augmentation or assistance, collision avoidance in vehicles, air traffic control coordination, precision in robot surgery, remote operation in hazardous conditions, and energy conservation in vehicles, equipment, mobile devices, and buildings.

D0. BYOD POLICIES SHOULD ADDRESS THE FOLLOWING:

1). Data Ownership, 2). Support Ownership, 3). Patch Management, 4). Antivirus Management, 5). Forensics, 6). Privacy, 7). On-Boarding/ Off-Boarding, 8). Adherence to Corporate Policies, 9). User Acceptance, 10). Architecture/ Infrastructure Considerations, 11). Legal concerns, 12). Acceptable Use Policies, and 13). On-Board Cameras/ Video.

A2. Input/Output Devices:

1). Input and output devices are often seen as basic, primitive peripherals and usually don't receive much attention until they stop working properly. 2). However, even these basic devices can present security risks to a system. 3). Security professionals should be aware of these risks and ensure that appropriate controls are in place to mitigate them. The next four sections examine some of the risks posed by specific input and output devices.

E0. EXAM ESSENTIALS: Explain the two layered operating modes used by most modern processors.

1). User applications operate in a limited instruction set environment known as user mode. 2). The operating system performs controlled operations in privileged mode, also known as system mode, kernel mode, and supervisory mode.

F3. Incremental Attack #1). Data Diddling: "small, random, or incremental changes to data during storage, processing, input, output, or transaction"

1). Data diddling occurs when an attacker gains access to a system and makes small, random, or incremental changes to data during storage, processing, input, output, or transaction rather than obviously altering file contents or damaging or deleting entire files. 2). Such changes can be difficult to detect unless files and data are protected by encryption or unless some kind of INTEGRITY CHECK (such as a checksum or message digest) is routinely performed and applied each time a file is read or written. 3). ENCRYPTED file systems, file-level encryption techniques, or some form of file monitoring (which includes integrity checks like those performed by applications such as Tripwire and other file integrity monitoring [FIM] tools) usually offer adequate guarantees that no data diddling is under way. 4). Data diddling is often CONSIDERED AN ATTACK PERFORMED more often by INSIDERS rather than outsiders (in other words, external intruders). 5). It should be obvious that since data diddling is an attack that alters data, it is considered an ACTIVE ATTACK.

1). Data Resonance: "un-erased remnant data"

1). Data may remain on secondary storage devices even after it has been erased. 2). This condition is known as data remanence. 3). Most technically savvy computer users know that utilities are available that can retrieve files from a disk even after they have been deleted. 4). It's also technically possible to retrieve data from a disk that has been reformatted. 5). If you truly want to remove data from a secondary storage device, you must use a specialized utility designed to destroy all traces of data on the device or damage or destroy it beyond possible repair (commonly called sanitizing).

2. Storage

1). Data storage devices make up the THIRD CLASS of COMPUTER SYSTEM COMPONENTS we'll discuss. 2). These devices are used to store information that may be used by a computer any time after it's written. 3). We'll first examine a few common terms that relate to storage devices and then cover some of the security issues related to data storage.

A2. Database Security:

1). Database security is an important part of any organization that uses large sets of data as an essential asset. 2). Without database security efforts, business tasks can be interrupted and confidential information disclosed. 3). For the CISSP exam, it is important that you are aware of several topics in relation to database security. 4). These include aggregation, inference, data mining, data warehousing, and data analytics.

7. Defense in Depth: "multiple types of access controls in literal or theoretical concentric circles"

1). Defense in depth (aka MULTILAYERED defense and DIVERSITY of defense) 2). A common security strategy used to provide a protective multilayer barrier against various forms of attack. 3). It uses multiple types of access controls in literal or theoretical concentric circles.

C. EXAM ESSENTIALS: Understand mobile device security.

1). Device security involves the range of potential security options or features that may be available for a mobile device. 2). Not all portable electronic devices (PEDs) have good security features. 3). PED security features include full device encryption, remote wiping, lockout, screen locks, GPS, application control, storage segmentation, asset tracking, inventory control, mobile device management, device access control, removable storage, and the disabling of unused features.

E3. SQL Injection Attacks Take Advantage Of Dynamic Web Pages/Applications: "If SQL Injection can compromise dynamic web page it can access the database"

1). Dynamic Web applications take advantage of a database to create content on demand when the user makes a request. 2). The web application can retrieve for example current account information from the bank's database and uses it to instantly create a web page containing the user's current account information. 3). If the SQL Injection can compromise the dynamic web page they can access the database.

D7). Monitoring:

1). Even embedded and static systems should be monitored for performance, violations, compliance, and operational status. 2). Some of these types of devices can perform on-device monitoring, auditing, and logging, while others may require external systems to collect activity data. 3). Any and all devices, equipment, and computers within an organization should be monitored to ensure high performance, minimal downtime, and detecting and stopping violations and abuse.

E. Android Security Concerns:

1). Exposure to malicious apps, 2). Running scripts from malicious websites, and 3). Allowing insecure data transmissions. 4). Devices can often be rooted to grant the user full root-level access to the device's low-level configuration settings. 5). Rooting increases a device's security risk, because all running code inherits root privileges.

D5). Firmware Version Control: "firmware updates should be implemented on a manual basis, after testing & review"

1). Firmware Version Control Similar to manual software updates, strict control over firmware in a static environment is important. 2). Firmware updates should be implemented on a manual basis, only after testing and review. 3). Oversight of firmware version control should focus on maintaining a stable operating platform while minimizing exposure to downtime or compromise.

F2. EXAM ESSENTIALS: Know the purpose of firmware.

1). Firmware is software stored on a ROM chip. 2). At the computer level, it contains the basic instructions needed to start a computer. 3). Firmware is also used to provide operating instructions in peripheral devices such as printers.

D3. Java vs. ActiveX

1). First, ActiveX use only Microsoft technology and can execute only on systems running Microsoft browsers. 2). Second, ActiveX controls are not subject to the sandbox restrictions placed on Java applets.

A6. Flash Memory: "nonvolatile storage media electronically erased & rewritten in blocks & pages"

1). Flash memory is a derivative concept from EEPROM. It is a nonvolatile form of storage media that can be electronically erased and rewritten. 2). The primary difference between EEPROM and flash memory is that EEPROM must be fully erased to be rewritten whereas flash memory can be erased and written in blocks or pages. 3). The most common type of flash memory is NAND flash. It is widely used in memory cards, thumb drives, mobile devices, and SSD (solid-state drives). DETAILS: 1). A nonvolatile form of storage media that can be electronically erased and rewritten. 2). Whereas EEPROM must be FULLY ERASED to be REWRITTEN whereas 3). This type of memory can be erased and written in blocks or pages.

D4. Buffer Overflow Countermeasure Input and Parameter Checking:

1). For nearly all types of operating systems, including Windows, Unix, Linux, and others, buffer overflows expose some of the most glaring and profound opportunities for compromise and attack of any kind of known security vulnerability. 2). The party responsible for a buffer overflow vulnerability is always the programmer whose code allowed nonsanitized or unsanitized input. 3). Due diligence from programmers can eradicate buffer overflows completely, but only if programmers check all input and parameters before storing them in any data structure (and limit how much data can be proffered as input). 4). Proper data validation is the only way to do away with buffer overflows. 5). Otherwise, discovery of buffer overflows leads to a familiar pattern of critical security updates that must be applied to affected systems to close the point of attack.

B2. Monitors: "cathode ray tube monitors are more prone to radiate Van Eck radiation"

1). Generally, cathode ray tube (CRT) monitors are more prone to radiate Van Eck radiation significantly, whereas liquid crystal display (LCD) monitors leak Van Eck much less (some claim not enough to reveal critical data).

O2. Grid Computing: "groups a significant number of processing nodes to work toward a specific processing goal"

1). Grid computing allows geographically disparate systems to dynamically join and leave a network focused on a single task. By taking part in this infrastructure, systems with free CPU cycles can take part in a distributed effort for a single cause. 2). It's a form of parallel distributed processing that loosely groups a significant number of processing nodes to work toward a specific processing goal. 3). Members of the grid can enter and leave the grid at random intervals.

2. Protection Mechanisms/Process States/Operating & Security Modes

1). If a computer isn't running, it's an inert lump of plastic, silicon, and metal doing nothing. 2). When a computer is running, it operates a runtime environment that represents the combination of the operating system and whatever applications may be active. 3). When running, the computer also has the capability to access files and other data as the user's security permissions allow. WITHIN THAT RUNTIME ENVIRONMENT: 1). Within that runtime environment, it's necessary to integrate security information and controls to protect the integrity of the operating system itself, to manage which users are allowed to access specific data items, to authorize or deny operations requested against such data, and so forth. 2). The ways in which running computers implement and handle security at runtime may be broadly described as a collection of protection mechanisms. 3). What follows are descriptions of various protection mechanisms such as: I. Protection Rings, II. Operational States, III. Security Modes, IV. Operating Modes.

E1. 10). Architecture/ Infrastructure Considerations: "make sure you are prepared for the infrastructure requirements of BYOD"

1). If every worker brings in a personal device, the number of devices on the network MAY DOUBLE!. 2). Make sure when implementing mobile device policies, you evaluate your network security design, architecture, & infrastructure. 3). This requires planning to handle IP assignments, communications isolation, data-priority management, and increased intrusion detection system (IDS)/ intrusion prevention system (IPS) monitoring load, as well as increased bandwidth consumption, both internally and across any internet link.

E3. Immediate Addressing: "a way of referring to data supplied to CPU as part of an instruction. (Add 2 to the value in register 1)"

1). Immediate addressing is not a memory addressing scheme per se but rather a way of referring to data that is supplied to the CPU as part of an instruction. 2). For example, the CPU might process the command "Add 2 to the value in register 1." This command uses two addressing schemes. >. The FIRST is immediate addressing—the CPU is being told to add the value 2 and does not need to retrieve that value from a memory location—it's supplied as part of the command. >. The SECOND is register addressing; it's instructed to retrieve the value from register 1. DETAILS: 1). Is not a memory addressing scheme 2). Rather it is a way of referring to data that is supplied to the CPU as part of an instruction. 3). For example, in the command "Add 2 to the value in register 1" the "Add 2" is an immediate address command. 4). While The "to the value in register 1" is register addressing.

I. Multiprocessing: "the use of MULTIPLE processors to increase computing power" ⚡️⚡️⚡️⚡️⚡️⚡️

1). In a multiprocessing environment, a multiprocessor computing system (that is, one with more than one CPU) harnesses the power of more than one processor to complete the execution of a multithreaded application. 2). For example, a database server might run on a system that contains four, six, or more processors. 3). If the database application receives a number of separate queries simultaneously, it might send each query to a separate processor for execution. 2 TYPES OF MULTIPROCESSING: Two types of multiprocessing are most common in modern systems with multiple CPUs. >. Symmetric Multiprocessing (SMP): >. Massively Parallel Processing (MPP):

G4. Common Flaws to Security Architectures:

1). In addition to buffer overflows, programmers can leave back doors and privileged programs on a system after it is deployed. 2). Even well-written systems can be susceptible to time-of-check-to-time-of-use (TOCTTOU) attacks. 3). Any state change could be a potential window of opportunity for an attacker to compromise a system.

G3. EXAM ESSENTIALS: Describe common flaws to security architectures.

1). In addition to buffer overflows, programmers leave back doors and privileged programs on a system after it is deployed. 2). Even well-written systems can be susceptible to time-of-check-to-time-of-use (TOCTTOU) attacks. 3). Any state change could be a potential window of opportunity for an attacker to compromise a system.

A0. Application Security:

1). In addition to managing the security of mobile devices, you also need to focus on the applications and functions used on those devices. 2). Most of the software security concerns on desktop or notebook systems apply to mobile devices just as much as common-sense security practices do.

E4. Direct Addressing: "the CPU is provided with an actual address of the memory location to access"

1). In direct addressing, the CPU is provided with an actual address of the memory location to access. 2). The address must be located on the same memory page as the instruction being executed. 3). Direct addressing is more flexible than immediate addressing since the contents of the memory location can be changed more readily than reprogramming the immediate addressing's hard-coded data.

A3. EXAM ESSENTIALS: Understand security risks that input and output devices can pose.

1). Input/ output devices can be subject to eavesdropping and tapping, used to smuggle data out of an organization, or used to create unauthorized, insecure points of entry into an organization's systems and networks. 2). Be prepared to recognize and mitigate such vulnerabilities.

J4. A Public Cloud: "single platform that is shared among many different customers"

1). Is a cloud service that is accessible to the general public, typically over an internet connection. 2). In the public cloud computing model, the vendor builds a single platform that is shared among many different customers. 3). Also known as the shared tenancy model.

A3. OWASP (Open Web Application Security Project):

1). Is a nonprofit security project focusing on improving security for online or web-based applications. 2). OWASP is not just an organization—it is also a large community that works together to freely share information, methodology, tools, and techniques related to better coding practices and more secure deployment architectures.

I2. Technology & Process Integration:

1). It is important to evaluate and understand the vulnerabilities in system architectures, especially in regard to technology and process integration. 2). As multiple technologies and complex processes are intertwined in the act of crafting new and unique business functions, new issues and security problems often surface. 3). As systems are integrated, attention should be paid to potential single points of failure as well as to emergent weaknesses in service-oriented architecture (SOA). 4). An SOA constructs new applications or functions out of existing but separate and distinct software services. The resulting application is often new; thus, its security issues are unknown, untested, and unprotected. 5). All new deployments, especially new applications or functions, need to be thoroughly vetted before they are allowed to go live into a production network or the public internet.

J6. Jamming or Noise Generators:

1). Jamming or noise generators use the idea that it is difficult or impossible to retrieve a signal when there is too much interference. 2). Thus, by broadcasting your own interference, you can prevent unwanted EM interception.

C3. Java Applet Security: "java applets rely on the sandbox for security"

1). Java uses the "sandbox" concept to place privilege restrictions on Java code. 2). The sandbox isolates Java code objects from the rest of the operating system and enforces strict rules about the resources those objects can access.

G1. Security Policy When Designing & implementing systems: "security policy informs & guides design, development, implementation, testing, & maintenance of a system"

1). Just as security policy guides the day-to-day security operations, processes, and procedures in organizations, it has an important role to play when designing and implementing systems. 2). This is equally true whether a system is entirely hardware based, entirely software based, or a combination of both. 3). In this case, the role of a security policy is to INFORM and GUIDE the DESIGN, DEVELOPMENT, IMPLEMENTATION, TESTING, and MAINTENANCE of a particular system. 4). For system developers, a security policy is best encountered in the form of a document that defines a set of rules, practices, and procedures that describe how the system should manage, protect, and distribute sensitive information. 5). Security policies that prevent information flow from higher security levels to lower security levels are called multilevel security policies. 6). As a system is developed, the security policy should be designed, built, implemented, and tested as it relates to all applicable system components or elements, including any or all of the following: physical hardware components, firmware, software, and how the organization interacts with and uses the system. 7). >>> "The overall point is that SECURITY NEEDS BE CONSIDERED FOR the ENTIRE LIFE OF THE PROJECT."<<< 8). ☠️☠️☠️☠️☠️When security is applied only at the end, IT typically FAILS.☠️☠️☠️☠️☠️

A1). Key Management: "good key selection is based on the quality and availability of random numbers"

1). Key management is always a concern when cryptography is involved. 2). Most of the failures of a cryptosystem are based on the key management rather than on the algorithms. 3). Good key selection is based on the quality and availability of random numbers. 4). Most mobile devices must rely locally on poor random-number-producing mechanisms or access more robust random number generators (RNGs) over a wireless link. 5). Once KEYS ARE CREATED, they need to be STORED in such a way as to MINIMIZE EXPOSURE to loss or compromise. 6). The best option for key storage is usually removable hardware or the use of a TRUSTED PLATFORM MODULE (TPM), but these are rarely available on mobile phones and tablets.

D2. Keyboards/Mice: "tempest, key loggers, intercepted bluetooth"

1). Keyboards, mice, and similar input devices are not immune to security vulnerabilities either. All of these devices are vulnerable to TEMPEST monitoring. Also, keyboards are vulnerable to less sophisticated bugging. 2). A simple device can be placed inside a keyboard or along its connection cable to intercept all the keystrokes that take place and transmit them to a remote receiver using a radio signal. 3). This has the same effect as TEMPEST monitoring but can be done with much less expensive gear. Additionally, if your keyboard and mouse are wireless, including Bluetooth, their radio signals can be intercepted. DETAILS: 1). Vulnerable to TEMPEST/Van Eck Phreaking 2). Key loggers 3). Bluetooth radio signals can be intercepted

G2. LDAP injection: "focus of the attack is on the back end of an LDAP directory service"

1). LDAP injection is a variation of an input injection attack; 2). However, the focus of the attack is on the back end of an LDAP directory service rather than a database server. 3). If a web server front end uses a script to craft LDAP statements based on input from a user, then LDAP injection is potentially a threat. 4). Just as with SQL injection, sanitization of input and defensive coding are essential to eliminate this threat.

4. EXAM ESSENTIALS: Describe the different types of memory used by a computer.

1). ROM is nonvolatile and can't be written to by the end user. 2). The end user can write data to PROM chips only once. 3). EPROM/ UVEPROM chips may be erased through the use of ultraviolet light and then can have new data written to them. 4). EEPROM chips may be erased with electrical current and then have new data written to them. 5). RAM chips are volatile and lose their contents when the computer is powered off.

A6.). Ring 3). "contains user level programs"

1). User level app's and programs 2). Those applications and programs occupy the outermost ring, ring 3.

K. 3). Lockout: "fails to provide credentials after x attempts system locks, must be configured"

1). Lockout on a mobile device is similar to account lockout on a company workstation. When a user fails to provide their credentials after repeated attempts, the account or device is disabled (locked out) for a period of time or until an administrator clears the lockout flag. 2). Mobile devices may offer a lockout feature, but it's in use only if a screen lock has been configured. 3). Otherwise, a simple screen swipe to access the device doesn't provide sufficient security, because an authentication process doesn't occur. 4). Some devices trigger ever longer delays between access attempts as a greater number of authentication failures occur. Some devices allow for a set number of attempts (such as three) before triggering a lockout that lasts minutes. 5). Other devices trigger a persistent lockout and require the use of a different account or master password/ code to regain access to the device.

E2. Maintenance Hooks: "entry points into a system that are known only by the developer of the system"

1). Maintenance hooks are entry points into a system that are known only by the developer of the system. Such entry points are also called back doors. 2). The problem is that this type of access bypasses all security controls and provides free access to anyone who knows that the back doors exist. 3). It is imperative that you explicitly prohibit such entry points and monitor your audit logs to uncover any activity that may indicate unauthorized administrator access.

B3. Vulnerable Applets.

1). Many browsers and other client applications often employ applets for viewing documents and video files. 2). Often, the applets themselves may have exploitable weaknesses.

B. Processing Types:

1). Many high-security systems control the processing of information assigned to various security levels, such as the classification levels of unclassified, sensitive, confidential, secret, and top secret that the U.S. government assigns to information related to national defense. 2). Computers must be designed so that they do not—ideally, so that they cannot—inadvertently disclose information to unauthorized recipients. 3). Computer architects and security policy administrators have addressed this problem at the processor level in two different ways. 4). One is through a POLICY MECHANISM, whereas the other is through a HARDWARE SOLUTION. 5). The following list explores each of those options:

N. 5). Global Positioning System (GPS):

1). Many mobile devices include a Global Positioning System (GPS) chip to support and benefit from localized services, such as navigation, so it's possible to track those devices. 2). The GPS chip itself is usually just a receiver of signals from orbiting GPS satellites. 3). However, applications on the mobile device can record the GPS location of the device and then report it to an online service. 4). You can use GPS tracking to monitor your own movements, track the movements of others (such as minors or delivery personnel), or track down a stolen device. 5). But for GPS tracking to work, the mobile device must have internet or wireless phone service over which to communicate its location information.

D2. Data Warehouse:

1). Many organizations use large databases, known as data warehouses, to store large amounts of information from a variety of databases for use with specialized analysis techniques. 2). These data warehouses often contain detailed historical information not normally stored in production databases because of storage limitations or data security concerns.

F3. Watch For Metacharacters: " [ ] \ ; & ^ $ . | ? * + { } ( ): "characters with special programmatic meaning have special powers"

1). Metacharacters are characters that have been assigned special programmatic meaning. 2). Thus, they have special powers that standard, normal characters do not have.

S. 10). Mobile device management (MDM):

1). Mobile device management (MDM) is a software solution to the challenging task of managing the myriad mobile devices that employees use to access company resources. 2). The goals of MDM are to improve security, provide monitoring, enable remote management, and support troubleshooting. 3). Many MDM solutions support a wide range of devices and can operate across many service providers. 4). You can use MDM to push or remove apps, manage data, and enforce configuration settings both over the air (across a carrier network) and over Wi-Fi connections. MDM can be used to manage company-owned devices as well as personally owned devices (such as in a bring your own device [BYOD] environment).

A4). Geotagging:

1). Mobile devices with GPS support enable the embedding of geographical location in the form of latitude and longitude as well as date/ time information on photos taken with these devices. 2). This allows a would-be attacker (or angry ex) to view photos from social networking or similar sites and determine exactly when and where a photo was taken. 3). This geotagging can be used for nefarious purposes, such as determining when a person normally performs routine activities.

A5). Encryption:

1). Most mobile devices provide some form of storage encryption. 2). When this is available, it should be enabled. 3). Some mobile devices offer native support for communications encryption, but most can run add-on software (apps) that can add encryption to data sessions, voice calls, and/ or video conferences.

C. EXAM ESSENTIALS: Be able to explain the differences between multitasking, multithreading, multiprocessing, and multiprogramming.

1). Multitasking is the simultaneous execution of more than one application on a computer and is managed by the operating system. 2). Multithreading permits multiple concurrent tasks to be performed within a single process. 3). Multiprocessing is the use of more than one processor to increase computing power. 4). Multiprogramming is similar to multitasking but takes place on mainframe systems and requires specific programming.

B1. RAM (Random Access Memory): "RAM chips are volatile and lose their contents when the computer is powered off"

1). Random access memory (RAM) is readable and writable memory that contains information a computer uses during processing. 2). RAM retains its contents only when power is continuously supplied to it. Unlike with ROM, when a computer is powered off, all data stored in RAM disappears. 3). For this reason, RAM is useful only for temporary storage. 4). Critical data should never be stored solely in RAM; a backup copy should always be kept on another storage device to prevent its disappearance in the event of a sudden loss of electrical power. DETAILS: 1). Readable and writable memory that contains information a computer uses during processing. 2). Only retains its contents when power is on. When a computer is powered off, all data stored in RAM disappears. 3). Is useful only for temporary storage. The following are types of RAM:

R. Multithreading: "permits multiple tasks to execute concurrently within a single process"

1). Multithreading permits multiple tasks to execute concurrently within a single process. 2). These tasks are known as threads and may be alternated between without switching processes. 3). Multithreading permits MULTIPLE CONCURRENT TASKS to be PERFORMED WITHIN a SINGLE PROCESS. 4). A thread is a self-contained sequence of instructions that can execute in parallel with other threads that are part of the same parent process. 5). Multithreading is often used in applications where frequent context switching between multiple active processes consumes excessive overhead and reduces efficiency. 6). In multithreading, switching between threads incurs far less overhead and is therefore more efficient. 7). Many Intel CPUs since the 2002 release of Xeon included the proprietary multithreading technology known as hyperthreading, which is the ability to virtualize two processors per physical core in order to allow for the concurrent scheduling of tasks. 8). In modern Windows implementations, for example, the overhead involved in switching from one thread to another within a single process is on the order of 40 to 50 instructions, with no substantial memory transfers needed. 9). By contrast, switching from one process to another involves 1,000 instructions or more and requires substantial memory transfers as well. DETAILS: 1). Permits multiple concurrent tasks to be performed within a single process. 2). Permits multiple tasks to operate within a single process. 3). Used in applications where frequent context switching between multiple active processes consumes excessive overhead and reduces efficiency. A good example occurs when multiple documents are opened at the same time in a word processing program. In that situation, you do not actually run multiple instances of the word processor— Instead, each document is treated as a single thread within a single word processor process, and the software chooses which thread it works on at any given moment.

M. Near field communication (NFC): "auto synch & association between devices by touching them together"

1). Near field communication (NFC) is a standard to establish radio communications between devices in close proximity. 2). It lets you perform a type of automatic synchronization and association between devices by touching them together or bringing them within inches of each other. 3). NFC is commonly found on smartphones and many mobile device accessories. 4). It's often used to perform device-to-device data exchanges, set up direct communications, or access more complex services such as WiFi Protected Access 2 (WPA2) encrypted wireless networks by linking with the wireless access point via NFC. Because NFC is a radio-based technology, it isn't without its vulnerabilities. 5). NFC attacks can include man-in-the-middle, eavesdropping, data manipulation, and replay.

J7. Control Zones:

1). One way to ensure that is to use control zones, which are Faraday cages used to block purposely broadcast interference. 2). For example, if you wanted to use wireless networking within a few rooms of your office but not allow it anywhere else, you could enclose those rooms in a single Faraday cage and then plant several noise generators outside the control zone.

A). PURGE ANY MEMORY DEVICES:

1). PURGE ANY MEMORY DEVICES that may retain sensitive data should be purged before they are allowed to leave your organization for any reason.

P2. Peer-to-peer (P2P) Technologies: "networking and distributed application solutions that share tasks and workloads among peers"

1). Peer to Peer Peer-to-peer (P2P) technologies are networking and distributed application solutions that share tasks and workloads among peers. 2). This is similar to grid computing; the primary differences are that there is no central management system and the services provided are usually real time rather than as a collection of computational power. 3). Common examples of P2P include many VoIP services, such as Skype, BitTorrent (for data/ file distribution), and Spotify (for streaming audio/ music distribution).

D1). Number 3). Data Hiding: "prevents data from being read from a different security levels"

1). Prevents information from being read from a different security level. 2). The key concept behind data hiding is a desire to make sure those who have no need to know the details involved in accessing and processing data at one level have no way to learn or observe those details covertly or illicitly. 3). From a security perspective, data hiding relies on placing objects in security containers that are different from those that subjects occupy to hide object details from those with no need to know about them.

3. EXAM ESSENTIALS: Describe the different characteristics of storage devices used by computers.

1). Primary storage is the same as memory. 2). Secondary storage consists of magnetic, flash, and optical media that must be first read into primary memory before the CPU can use the data. 3). Random access storage devices can be read at any point, whereas sequential access devices require scanning through all the data physically stored before the desired location.

B3. Cloud Computing Concerns:

1). Privacy Concerns 2). Regulation Compliance difficulties 3). Use of Open-Versus Closed-Source Solutions 4). Adoption of Open Standards - and whether or not cloud-based data is actually secured (or even securable).

B1). Process States: "privilege state-high privilege/problem state, user, low privilege"

1). Process States Also known as operating states, process states are various forms of execution in which a process may run. 2). Where the operating system is concerned, it can be in one of two modes at any given moment: >. MODE #1). Operating in a privileged, all-access mode known as supervisor state or >. MODE #2). Operating in what's called the problem state associated with user mode, where privileges are low and all access requests must be checked against credentials for authorization before they are granted or denied. The latter is called the problem state not because problems are guaranteed to occur but because the unprivileged nature of user access means that problems can occur and the system must take appropriate measures to protect security, integrity, and confidentiality.

H5. Identity as a Service (IDaaS):

1). Provides capabilities such as account provisioning, management, authentication, authorization, reporting, and monitoring.

C2). Choose Your Own Device (CYOD): "a list of approved devices that users choose from"

1). Provides users with a list of approved devices from which to select the device to implement.

C2. Inference: "subject deduces the full story from the pieces he learned of through aggregation"

1). Pull together pieces of less sensitive information and use them to DERIVE information of greater sensitivity. 2). Makes use of the human mind's deductive capacity rather than the raw mathematical ability of modern database platforms. The other security issue is inference, which is the intended result of aggregation. The inference problem happens when a subject deduces the full story from the pieces he learned of through aggregation. This is seen when data at a lower security level indirectly portrays data at a higher level. TIP Inference is the ability to derive information not explicitly available.

B3. Van Eck Radiation: "side-band electromagnetic emissions from electronics"

1). Side-band electromagnetic emissions from electronics devices that correlate to hidden signals or data.

E2. Random Access Storage: "Storage devices that can be read at any point"

1). Random access storage devices allow an operating system to read (and sometimes write) immediately from any point within the device by using some type of addressing system. 2). Almost all primary storage devices are random access devices. 3). You can use a memory address to access information stored at any point within a RAM chip without reading the data that is physically stored before it. 4). Most secondary storage devices are also random access. 5). For example, hard drives use a movable head system that allows you to move directly to any point on the disk without spinning past all the data stored on previous tracks; 6). likewise, CD and DVD devices use an optical scanner that can position itself anywhere on the platter surface.

A1. Read-Only Memory: "memory a PC can read but cannot wrote to, used for start up bootstrap data"

1). Read-Only Memory (ROM) works like the name implies—it's memory the PC can read but can't change (no writing allowed). 2). Contents of a standard ROM chip are burned in at the factory, and the end user simply cannot alter it. 3). ROM chips often contain "BOOTSTRAP" information computers use to START UP prior to loading an OS from disk. 4). This includes the familiar power-on self-test (POST) series of diagnostics that run each time you boot a PC. ROM's PRIMARY ADVANTAGE: >>. ROM's primary advantage is that it CAN'T BE MODIFIED!. There is no chance that user or administrator error will accidentally wipe out or modify the contents of such a chip. This attribute makes ROM extremely desirable for orchestrating a computer's innermost workings. DETAILS: 1). Memory the PC can read but can't change (no writing allowed). 2). Contents of a standard chip are burned in at the factory, 3). The end user simply cannot alter it. 4). This attribute makes ROM extremely desirable for orchestrating a computer's innermost workings. 5). Ideal for bootstrap operations There is a type of ROM that may be altered by administrators to some extent. It is known as programmable read-only memory (PROM), and its several subtypes are described next:

M2. Persistent XSS Attack:

1). Remains on the System until an administrator discovers and deletes it, giving it the ability to affect many users.

A5.). Ring 2). "contains drivers/protocols"

1). Ring 2 is also somewhat privileged in that it's where I/ O drivers and system utilities reside; 2). These are able to access peripheral devices, special files, and so forth that applications and other programs cannot themselves access directly.

E2. SQL Injection Attacks: "SQL injection directly attacks a database through a web application"

1). SQL injection attacks are even riskier than XSS attacks (see the following section) from an organization's perspective because the targets of a SQL injection attack are organizational assets, whereas the targets of an XSS attack are customers or visitors to a website. 2). SQL injection attacks use unexpected input to alter or compromise a web application. 3). However, instead of using this input to attempt to fool a user, 4). SQL injection attacks use it to GAIN UNAUTHORIZED ACCESS to an UNDERLYING DATABASE and RELATED ASSETS.

B2. Aggregation: "collect numerous low-level security items and combine them to create something of a higher security value"

1). SQL provides a number of functions that combine records from one or more tables to produce potentially useful information. 2). This process is called aggregation. 3). Aggregation is not without its security vulnerabilities. 4). Aggregation attacks are used to collect numerous low-level security items or low-value items and combine them to create something of a higher security level or value. Aggregation is a security issue that arises when a collection of facts has a higher classification than the classification of any of those facts standing alone.

2). Wear Leveling: "ssd sanitization vulnerability issue where blocks of data not marked live hold a copy of the data"

1). SSDs present a unique problem in relation to sanitization. 2). SSD wear leveling means that there are often blocks of data that are not marked as "live" but that hold a copy of the data when it was copied off to lower wear leveled blocks. 3). This means that a traditional zero wipe is ineffective as a data security measure for SSDs.

3). Theft & Economic Loss:

1). Secondary storage devices are also prone to theft. 2). Economic loss is not the major factor (after all, how much does a backup tape or a hard drive cost?), but the loss of confidential information poses great risks. 3). If someone copies your trade secrets onto a removable media disc and walks out the door with it, it's worth a lot more than the cost of the disc itself. 4). For this reason, it is important to use full disk encryption to reduce the risk of an unauthorized entity gaining access to your data. 5). It is good security practice to encrypt SSDs prior to storing any data on them due to their wear leveling technology. This will minimize the chance of any plaintext data residing in dormant blocks. 6). Fortunately, many HDD and SSD devices offer on-device native encryption.

M3. EXAM ESSENTIALS: Understand SECaaS.

1). Security as a service (SECaaS) is a cloud provider concept in which security is provided to an organization through or by an online entity.

C2. Methods of Securing Embedded and Static Systems:

1). Security concerns regarding embedded and static systems include the fact that most are designed with a focus on minimizing costs and extraneous features. 2). This often leads to a lack of security and difficulty with upgrades or patches.

H5). Applying Separation of Privilege to Computer Architecture: "think of separation of duties as the application of the principle of least privilege to administrators."

1). Separation of privilege increases the granularity of secure operations by requiring the use of granular access permissions; 2). I.e. different permissions for each type of privileged operation. 3). This allows designers to assign some processes rights to perform certain supervisory functions without granting them unrestricted access to the system.

F2. Sequential Storage: "must scan through all the data physically stored before the desired location"

1). Sequential storage devices, on the other hand, do not provide this flexibility. 2). They require that you read (or speed past) all the data physically stored prior to the desired location. 3). A common example of a sequential storage device is a magnetic tape drive. 4). To provide access to data stored in the middle of a tape, the tape drive must physically scan through the entire tape (even if it's not necessarily processing the data that it passes in fast-forward mode) until it reaches the desired point.

J2. Electromagnetic (EM) Radiation:

1). Simply because of the kinds of electronic components from which they're built, many computer hardware devices emit electromagnetic (EM) radiation during normal operation. 2). The process of communicating with other machines or peripheral equipment creates emanations that can be intercepted. 3). It's even possible to re-create keyboard input or monitor output by intercepting and processing electromagnetic radiation from the keyboard and computer monitor. 4). You can also detect and read network packets passively (that is, without actually tapping into the cable) as they pass along a network segment. These emanation leaks can cause serious security issues but are generally easy to address.

H2. Unified Extensible Firmware Interface (UEFI): "replaced bios in 2011"

1). Since 2011, most system manufacturers have replaced the traditional BIOS system on their motherboards with Unified Extensible Firmware Interface (UEFI). 2). UEFI is a more advanced interface between hardware and the operating system, which maintains support for legacy BIOS services.

C. EXAM ESSENTIALS: Single-State vs. Multi-State Processors:

1). Single-state processors are capable of operating at only one security level at a time, 2). Multi-state processors can simultaneously operate at multiple security levels.

1). INTERNET OF THINGS/INDUSTRIAL CONTROL SYSTEMS:

1). Smart devices are a range of mobile devices that offer the user a plethora of customization options, 2). Typically this is done through installing apps, 3). Or it may take advantage of on-device or in-the-cloud artificial intelligence (AI) processing. 4). The products that can be labeled "smart devices" are constantly expanding and already include smartphones, tablets, music players, home assistants, extreme sport cameras, and fitness trackers.

F2. Database Management System (DBMS): "SW reads the data dictionary to determine access rights for users"

1). Software that reads the data dictionary to determine access rights for users attempting to access data.

3. EXAM ESSENTIALS: Know the security issues surrounding memory components.

1). Some security issues surround memory components: 2). Data may remain on the chip after power is removed and the control of access to memory in a multiuser system.

A5. EXAM ESSENTIALS: Understand embedded systems and static environment security concerns.

1). Static environments, embedded systems, and other limited or single-purpose computing environments need security management. 2). These techniques may include network segmentation, security layers, application firewalls, manual updates, firmware version control, wrappers, and control redundancy and diversity.

Storage Media Security:

1). THEFT: Removable media can be used to steal data, 2). UNAUTHORIZED ACCESS: Access controls and encryption must be applied to protect data, and 3). DATA REMANENCE: D can remain on the media even after file deletion or media formatting.

H6. State Attacks: "an attempt to take action between 2 known states when the state of a resource or the entire system changes"

1). TOCTTOU attacks, race condition exploits, and communication disconnects are known as STATE ATTACKS because they attack TIMING, DATA FLOW CONTROL, and TRANSITION BETWEEN ONE SYSTEM STATE TO ANOTHER. 2). Communication disconnects also provide small windows that an attacker might seek to exploit. 3). Anytime a status check of a resource precedes action on the resource, a window of opportunity exists for a potential attack in the brief interval between check and action.

B5. Shoulder Surfing: "looking over your shoulder"

1). The BIGGEST RISK with any monitor is still shoulder surfing or telephoto lenses on cameras. 2). The concept that someone can see what is on your screen with their eyes or a video camera is known as shoulder surfing.

A1. The Internet of Things (IoT):

1). The Internet Of Things is a new subcategory or even a new class of smart devices that are Internet-connected in order to provide automation, remote control, or AI processing to traditional or new appliances or devices in a home or office setting. 2). IoT devices are sometimes revolutionary adaptations of functions or operations you may have been performing locally and manually for decades, which you would not want to ever be without again.

A2. EXAM ESSENTIALS: Comprehend The Internet of Things (IoT):

1). The Internet of Things (IoT) is a new subcategory or maybe even a new class of devices connected to the internet in order to provide automation, remote control, or AI processing to traditional or new appliances or devices in a home or office setting.

C5. Guest OSs:

1). The OSs running within a hypervisor-supported virtual machine.

W. EXAM ESSENTIALS: Understand mobile device application security:

1). The applications and functions used on a mobile device need to be secured. 2). Related concepts include: >. key management, >. credential management, >. authentication, >. geotagging, >. encryption, >. application whitelisting, and >. transitive trust/ authentication.

G2. Programming Flaws:

1). The biggest flaw in programming, the buffer overflow, occurs if the programmer fails to check or sanitize the format and/ or the size of input data, but there are others. 2). Any program that does not handle any exception gracefully is in danger of exiting in an unstable state. 3). It is possible to cleverly crash a program after it has increased its security level to carry out a normal task. If an attacker is successful in crashing the program at the right time, they can attain the higher security level and cause damage to the confidentiality, integrity, and availability of your system.

O3. Grid Security Issues: "content of each work packet 📦 is potentially exposed to the world 🌍"

1). The biggest security concern with grid computing is that the content of each work packet is potentially exposed to the world. 2). Many grid computing projects are open to the world, so there is no restriction on who can run the local processing application and participate in the grid's project. 3). This also means that grid members could keep copies of each work packet and examine the contents. 4). Thus, grid projects will not likely be able to maintain secrecy and are not appropriate for private, confidential, or proprietary data.

C4. Host OS: "The computer running the hypervisor"

1). The computer running the hypervisor is known as the host OS.

A2. Primary and Secondary Storage: "primary memory is RAM/secondary is optical, ssd, flash, tapes, etc"

1). The concepts of primary and secondary storage can be somewhat confusing, especially when compared to primary and secondary memory. 2). There's an easy way to keep it straight—they're the same thing! 3). PRIMARY MEMORY, also known as primary storage, is the RAM that a computer uses to keep necessary information readily available to the CPU while the computer is running. 4). SECONDARY MEMORY (or secondary storage) includes all the familiar long-term storage devices that you use every day. Secondary storage consists of magnetic and optical media such as HDD, SSDs, flash drives, magnetic tapes, CDs, DVDs, flash memory cards, and the like.

H5. Time of check to time of use (TOCTTOU) attacks: "when the difference between TOC & TOU is large enough an attacker can replace the original object"

1). The difference between the TOC and the TOU is sometimes large enough for an attacker to replace the original object with another object that suits their own needs. 2). Time of check to time of use (TOCTTOU) attacks are often called race conditions because the attacker is racing with the legitimate process to replace the object before it is used. 3). TOCTTOU attacks, race condition exploits, and communication disconnects are known as state attacks because they attack timing, data flow control, and transition between one system state to another.

J3. Electromagnetic Radiation Interception Countermeasures:

1). The easiest way to eliminate electromagnetic radiation interception is to >. CABLE SHIELDING: reduce emanation through cable shielding or >. PHYSICAL SECURITY CONTROL: conduit and block unauthorized personnel and devices from getting too close to equipment or cabling. 2). By reducing the signal strength and increasing the physical buffer around sensitive equipment, you can dramatically reduce the risk of signal interception.

C3. EXAM ESSENTIALS: Understand Hypervisors:

1). The hypervisor, also known as the virtual machine monitor (VMM), is the component of virtualization that creates, manages, and operates the virtual machines.

C2. The Hypervisor: "creates, manages, and operates the virtual machines"

1). The hypervisor, also known as the virtual machine monitor (VMM), is the component of virtualization that creates, manages, and operates the virtual machines. 2). The computer running the hypervisor is known as the host OS, and the OSs running within a hypervisor-supported virtual machine are known as guest OSs. Also known as the VIRTUAL MACHINE MONITOR (VMM), is the component of virtualization that: 1). Creates 2). Manages, and 3). Operates the Virtual Machines.

A9). System Call: "when the high ring folks need mediated access for a service at a lower level they use a SYSTEM CALL"

1). The mechanism whereby mediated access occurs—that is, the driver or handler request mentioned previously— 2). Known as a SYSTEM CALL it usually involves invocation of a specific system or programming interface designed to pass the request to an inner ring for service.

F. iOS:

1). The mobile device OS from Apple that is available on the iPhone, iPad, and Apple TV. 2). iOS isn't licensed for use on any non-Apple hardware. 3). Apple is in full control of the features and capabilities of iOS. 4). iOS is not an example of a static environment 5). Users can install any of over two million apps from the Apple App Store. 6). Users can jailbreak the OS allowing users to install 3rd party apps & gain greater control over low-level settings. 7). Jailbreaking reduces its security and exposes the device to potential compromise. 8). Users can adjust device settings to increase the device's security and install many apps that can add security features.

E4. 13). On-board Camera/ Video: "policy needs to address mobile devices with on-board cameras 📷 "

1). The mobile device policy needs to address mobile devices with on-board cameras.

D5. 5). Forensics: "policy should address forensics and investigations" "we may have to take your device"

1). The mobile device policy should address forensics and investigations as related to mobile devices. 2). Users need to be aware that in the event of a security violation or a criminal activity, their devices might be involved. 3). This would mandate gathering evidence from those devices. 4). Some processes of evidence gathering can be destructive, and some legal investigations require the confiscation of devices.

D6. 6). Privacy:

1). The mobile device policy should address privacy and monitoring. 2). When a personal device is used for business tasks, the user often loses some or all of the privacy they enjoyed prior to using their mobile device at work. 3). Workers may need to agree to be tracked and monitored on their mobile device, even when not on company property and outside work hours. 4). A personal device in use under BYOD should be considered by the individual to be quasi-company property.

D4. 4). Antivirus Management: "policy on whether antivirus, anti-malware, antispyware scanners are to be installed on mobile devices"

1). The mobile device policy should dictate whether antivirus, anti-malware, and antispyware scanners are to be installed on mobile devices. 2). The policy should indicate which products/ apps are recommended for use, as well as the settings for those solutions.

E3. 12). Acceptable Use Policy: "policy should either reference the company acceptable use policy"

1). The mobile device policy should either reference the company acceptable use policy or include a mobile device-specific version focusing on unique issues.

F2. Data Flow:

1). The movement of data between processes, between devices, across a network, or over communication channels.

C1). Company-Owned, Personally Enabled (COPE): "organization to purchase devices and provide them to employees"

1). The organization to purchase devices and provide them to employees. 2). Each user is then able to customize the device and use it for both work activities and personal activities. 3). COPE allows the organization to select exactly which devices are to be allowed on the organizational network—specifically only those devices that can be configured into compliance with the security policy.

B7). The Supervisory State:

1). Used when the process must perform an action that requires privileges that are greater than the problem state's set of privileges, such as: >. modifying system configuration, >. installing device drivers, or >. modifying security settings. 2). Basically, any function not occurring in the user mode (ring 3) or problem state takes place in the supervisory mode.

H3). Applying The principle of Least Privilege to computer architecture:

1). The principle of least privilege ensures that only a MINIMUM NUMBER of PROCESSES are AUTHORIZED to run in SUPERVISORY MODE. 2). The greater the number of processes that execute in privileged mode, the higher the number of potential vulnerabilities that a malicious individual could exploit to gain supervisory access to the system. 3). Designers should always ensure that they run in USER MODE WHENEVER POSSIBLE. RECUCE NUMBER OF PROCESSES THAT RUN IN PRIVILEGE MODE: 4). The greater the number of processes that execute in privileged mode, the higher the number of potential vulnerabilities that a malicious individual could exploit to gain supervisory access to the system. USE APIs to ASK for SUPERVISORY MODE SERVICE: 5). In general, it's better to use APIs to ask for supervisory mode services or to pass control to trusted, well-protected supervisory mode processes as they're needed from within user mode applications than it is to elevate such programs or processes to supervisory mode altogether.

F4. Escaping a Metacharactor: "add a normal character to a metacharactor, so add an "/" to "?" so "/?" now it is neutral"

1). The process of marking the metacharacter as merely a normal or common character, such as a letter or number, thus removing its special programmatic powers. 2). This is often done by adding a backslash in front of the character (\&),

A4.). Ring 1). "contains other OS components"

1). The remaining parts of the operating system—those that come and go as various tasks are requested, operations performed, processes switched, and so forth—occupy ring 1.

EXAM ESSENTIALS: Understand how a security policy drives system design, implementation, testing, and deployment.

1). The role of a security policy is to inform and guide the design, development, implementation, testing, and maintenance of some particular system.

J2. Data Analytics: "raw data examination focused on extracting useful information out of bulk information"

1). The science of raw data examination with the focus of extracting useful information out of the bulk information set. 2). The results of data analytics could focus on: >. important outliers or exceptions to normal or standard items >. a summary of all data items, or >. some focused extraction and organization of interesting information

A2). Credential Management: "a means to securely store a plethora of credential sets"

1). The storage of credentials in a central location is referred to as credential management. 2). Given the wide range of internet sites and services, each with its own particular logon requirements, it can be a burden to use unique names and passwords. 3). Credential management solutions offer a means to securely store a plethora of credential sets. 4). Often these tools employ a master credential set (multifactor being preferred) to unlock the dataset when needed. Some credential-management options can even provide auto-login options for apps and websites.

3. Hardware: "tangible part of a computer that you can actually reach out and touch"

1). The term hardware encompasses any tangible part of a computer that you can actually reach out and touch, from the keyboard and monitor to its CPU( s), storage media, and memory chips. 2). Take careful note that although the physical portion of a storage device (such as a hard disk or flash memory) may be considered hardware, the contents of those devices—the collections of 0s and 1s that make up the software and data stored within them—may not. 3). After all, you can't reach inside the computer and pull out a handful of bits and bytes!

A2. Assess and Mitigate Vulnerabilities in Web-Based Systems:

1). There is a wide variety of application and system vulnerabilities and threats in web-based systems, and the range is constantly expanding. 2). Vulnerabilities include concerns related to Extensible Markup Language (XML) and Security Association Markup Language (SAML) plus many other concerns discussed by the open community-focused web project known as the Open Web Application Security Project (OWASP).

A9). Mediated-Access Model. "rings at higher levels have to ask (a system call) a handler or driver at a lower level ring for services"

1). This happens when processes that run in higher-numbered rings must generally ask a handler or a driver in a lower-numbered ring for services they need.

4. Processer (CPU): "the computer's nerve center—it is the chip or chips in a multiprocessor system governing all major operations"

1). This is the computer's nerve center—it is the chip (or chips in a multiprocessor system) that governs all major operations and either directly performs or coordinates the complex symphony of calculations that allows a computer to perform its intended tasks. 2). It is the responsibility of the operating system and compilers to translate high-level programming languages used to design software into simple assembly language instructions that a CPU understands.

A7. NAND: "most common type of flash memory"

1). This is the most common type of flash memory. 2). It is widely used in memory cards, thumb drives, mobile devices, and SSD (solid-state drives).

C2). Need To Know:

1). This refers to an access authorization scheme in which a subject's right to access an object takes into consideration not just a privilege level but also the relevance of the data involved in the role the subject plays (or the job they perform). 2). Need To Know indicates that the subject requires access to the object to perform their job properly or to fill some specific role. Those with no need to know may not access the object, no matter what level of privilege they hold.

G. Multicore: "single cpu with multiple independent execution cores that operate simultaneously"

1). Today, most CPUs are fall into this category. 2). This means that what was previously a single CPU or microprocessor chip is now a chip containing two, four, eight, or potentially dozens of independent execution cores that can operate simultaneously.

13. On-Premise Solutions:

1). Traditional deployment concept in which an organization owns the hardware, licenses the software, and operates and maintains the systems on its own usually within their own building.

A7). Transitive Trust /Authentication

1). Transitive trust is the concept that if A trusts B and B trusts C, then A inherits trust of C through the transitive property—which works like it would in a mathematical equation: if a = b, and b = c, then a = c.

G3. Flashing the BIOS: "updating the bios"

1). Updating the BIOS is known as "flashing the BIOS." There have been a few examples of malicious code embedding itself into BIOS/ firmware.

C4). Virtual Desktop Infrastructure (VDI): "virtual machines on central servers that are remotely accessed by users"

1). Virtual desktop infrastructure (VDI) is a means to reduce the security risk and performance requirements of end devices by hosting virtual machines on central servers that are remotely accessed by users. 2). VDI has been adopted into mobile devices and has already been widely used in relation to tablets and notebook computers. 3). It is a means to retain storage control on central servers, gain access to higher levels of system processing and other resources, and allow lower-end devices access to software and services behind their hardware's capacity.

N3. Cross-site request forgery (XSRF) Countermeasures:

1). Website administrators can implement prevention measures against XSRF by requiring confirmations or reauthentication whenever a sensitive or risky action is requested by a connected client. 2). This could include >. Requiring the user to reenter their password, >. Sending a code to the user via text message or email that must be provided back to the website, >. Triggering a phone call-based verification, or >. Solving a Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA) (a mechanism to differentiate between humans and software robots). >. Add a Nonce, Add a randomization string (called a nonce) to each URL request and session establishment and to check the client HTTP request header referrer for spoofing.

D2. 2). Support Ownership: "device policy should define what support will be provided by the company"

1). When an employee's mobile device experiences a failure, a fault, or damage, who is responsible for the device's repair, replacement, or technical support? 2). The mobile device policy should define what support will be provided by the company and what support is left to the individual and, if relevant, their service provider.

C3). Corporate-Owned Mobile Strategy: "company buys mobile devices/used exclusively for company purposes"

1). When the company purchases the mobile devices that can support security compliance with the security policy. 2). Used exclusively for company purposes, and users should not perform any personal tasks on the devices. 3). This often requires workers to carry a second device for personal use.

K. Symmetric Multiprocessing (SMP): "single computer 💻 with multiple processors controlled by a single operating system"

1). Where a single computer contains multiple processors that are treated equally and controlled by a single operating system. 2). In SMP, processors share not only a common operating system but also a common data bus and memory resources. 3). In this type of arrangement, systems may use a large number of processors. 4). Fortunately, this type of computing power is more than sufficient to drive most systems.

C5). Virtual Mobile Infrastructure (VMI): "when the OS of a mobile device is virtualized on a central server"

1). Where the operating system of a mobile device is virtualized on a central server. 2). Thus, most of the actions and activities of the traditional mobile device are no longer occurring on the mobile device itself. 3). This remote virtualization allows an organization greater control and security than when using a standard mobile device platform.

E2. Modems: "create uncontrolled access points into your network, "BAN THEM!"

1). With the advent of ubiquitous broadband and wireless connectivity, modems are becoming a scarce legacy computer component. If your organization is still using older equipment, there is a chance that a modem is part of the hardware configuration. 2). The presence of a modem on a user system is often one of the greatest woes of a security administrator. 3). Modems allow users to create uncontrolled access points into your network. In the worst case, if improperly configured, they can create extremely serious security vulnerabilities that allow an outsider to bypass all your perimeter protection mechanisms and directly access your network resources. DETAILS: 1). Users can create uncontrolled access points into your network 2). Old legacy equipment, not common today 3). Must be connected to an operational telephone land line 4). Creates an alternate egress channel that insiders can use to funnel data outside your organization. BAN THEM!

J2. XML Exploitation:

1). XML exploitation is a form of programming attack that is used to either falsify information being sent to a visitor or cause their system to give up information without authorization.

F1). INPUT VALIDATION:

1). lets you limit the types of data a user provides in a form, such as whitelisting and blacklisting filters. 2). The primary forms of input sanitization that should be adopted include: >. Limiting the length of input, >. Filtering on known malicious content patterns, and >. ESCAPING METACHARACTERS..

A2. PROM (Programmable Read-Only Memory): "contents are NOT "burned in" at the factory like standard ROM chips, user does the burn, ONCE!"

A basic programmable read-only memory (PROM) chip is similar to a ROM chip in functionality, but with one exception. During the manufacturing process, a PROM chip's contents aren't "burned in" at the factory as with standard ROM chips. The end user can write data to PROM chips only once! 1). ROM with a major difference? 2). "Has functionality that allows an end user to burn in the chip's contents later." 3). Once data is burned to a PROM chip, no further changes are possible. 4). After it's burned in, this chip essentially functions like a ROM chip. 5). Used for hardware apps where needing some custom functionality

M2. Security as a Service (SECaaS): "security as a service, kinda like SaaS, or IDaaS, only with Security"

A cloud provider concept in which security is provided to an organization through or by an online entity. 1). Security as a service (SECaaS) is a cloud provider concept in which security is provided to an organization through or by an online entity. 2). The purpose of SECaaS solutions are to reduce the cost and overhead of implementing and managing security locally. 3). SECaaS often implements software-only security components that do not need dedicated on-premises hardware. 4). SECaaS security components can include a wide range of security products, including: >. authentication, >. authorization, >. auditing/ accounting, >. anti-malware, >. intrusion detection, >. compliance and >. vulnerability scanning, >. penetration testing, and >. security event management.

A3. A Covert Channel:

A covert channel is a method that is used to pass information over a path that is not normally used for communication. Because the path is not normally used for communication, it may not be protected by the system's normal security controls. Using a covert channel provides a means to violate, bypass, or circumvent a security policy undetected. 1). A method used to pass information over a path that is not normally used for communication. 2). Because the path is not normally used for communication, it may not be protected by the system's normal security controls. 3). A means to violate, bypass, or circumvent a security policy undetected. There are two basic types of covert channels: 1). Covert Timing Channel, and 2). Covert Storage Channel.

E2. Data Dictionary: "storing critical information about data"

A data dictionary is commonly used for storing critical information about data, including usage, type, sources, relationships, and formats. 1). usage, 2). type, 3). sources, 4). relationships, and 5). formats.

F4. DOS & Data Flow Control:

A denial-of-service attack can be a severe detriment to data flow control. It is important to monitor for DoS attacks and implement mitigations. Please see Chapters 12 and 17 for a discussion of these attacks and potential defenses.

I5. A Cloud Solution:

A deployment concept where an organization contracts with a third-party cloud provider. The provider owns, operates, and maintains the hardware and software. The organization pays a monthly fee (often based on a per-user multiplier) to use the solution.

L2. Cloud Access Security Broker (CASB): "security policy enforcement tool to detect access to, and usage of, cloud-based services"

A new class of security tools known as cloud access security brokers (CASB) can detect access to, and usage of, cloud-based services. These tools give the organization more visibility into its sanctioned and unsanctioned use of cloud services. Many CASB systems, in cooperation with cloud services, can be used to control the use of cloud services. 1). A security policy enforcement solution that may be installed either on-premises or in the Cloud. 2). It's goal is to ENFORCE and ENSURE that PROPER SECURITY MEASURES are IMPLEMENTED BETWEEN a CLOUD SOLUTION and a CUSTOMER ORGANIZATION.

J. 2). A Remote Wipe: "remotely delete all data and configuration settings"

A remote wipe lets you delete all data and possibly even configuration settings from a device remotely. The wipe process can be triggered over mobile phone service or sometimes over any internet connection. However, a remote wipe isn't a guarantee of data security. Thieves may be smart enough to prevent connections that would trigger the wipe function while they dump out the data. Additionally, a remote wipe is mostly a deletion operation. The use of an undelete or data recovery utility can often recover data on a wiped device. 1). Users delete all data and possibly even configuration settings from a device remotely. 2). The wipe process can be triggered over mobile phone service or sometimes over any internet connection. However, a remote wipe isn't a guarantee of data security. ☠️ Thieves may be smart enough to prevent connections that would trigger the wipe function while they dump out the data. ☠️ Additionally, a remote wipe is mostly a deletion operation. ☠️ The use of an undelete or data recovery utility can often recover data on a wiped device.

L. 4). Screen Locks:

A screen lock is designed to prevent someone from casually picking up and being able to use your phone or mobile device. However, most screen locks can be unlocked by swiping a pattern or typing a number on a keypad display. Neither of these is truly a secure operation. Screen locks may have workarounds, such as accessing the phone application through the emergency calling feature. And a screen lock doesn't necessarily protect the device if a hacker connects to it over Bluetooth, wireless, or a USB cable. 1). A screen lock is designed to prevent someone from casually picking up and being able to use your phone or mobile device. 2). Screen locks may have workarounds, such as accessing the phone application through the emergency calling feature. 3). Screen locks are often triggered after a timeout period of nonuse.

P2. Massive Parallel Processing (MPP): "numerous SMP systems linked together to work on a single task across multiple processes & linked systems."

A variation of AMP is, where numerous SMP systems are linked together in order to work on a single primary task across multiple processes in multiple linked systems. An MPP traditionally involved multiple chassis, but modern MPPs are commonly

D6). A Wrapper: "a secure controlled channel used to enclose or contain something else"

A wrapper is something used to enclose or contain something else. Wrappers are well known in the security community in relation to Trojan horse malware. A wrapper of this sort is used to combine a benign host with a malicious payload. Wrappers are also used as encapsulation solutions. Some static environments may be configured to reject updates, changes, or software installations unless they're introduced through a controlled channel. That controlled channel can be a specific wrapper. The wrapper may include integrity and authentication features to ensure that only intended and authorized updates are applied to the system.

L2. Big Data: "data is so big traditional analysis, storage or processing don't work"

Big data refers to collections of data that have become so large that traditional means of analysis or processing are ineffective, inefficient, and insufficient. Big data involves numerous difficult challenges, including collection, storage, analysis, mining, transfer, distribution, and results presentation. 1). Collections of data so large that traditional means of analysis or processing are ineffective, inefficient, and insufficient. 2). Challenges include collection, storage, analysis, mining, transfer, distribution, and results presentation.

D2. Active X "ActiveX controls rely on digital certificates before installation"

ActiveX controls were Microsoft's answer to Sun's Java applets. They operate in a similar fashion, but they are implemented using a variety of languages, including Visual Basic, C, C + +, and Java. There are two key distinctions between Java applets and ActiveX controls. First, ActiveX controls use proprietary Microsoft technology and, therefore, can execute only on systems running Microsoft browsers. Second, ActiveX controls are not subject to the sandbox restrictions placed on Java applets. They have full access to the Windows operating environment and can perform a number of privileged actions. Therefore, you must take special precautions when deciding which ActiveX controls to download and execute. Some security administrators have taken the somewhat harsh position of prohibiting the download of any ActiveX content from all but a select handful of trusted sites. 1). An ActiveX control is like Java Applets, but is specific to Windows machines, and is downloaded in a format specific to the machine. 2). They operate in a similar fashion, but use a variety of languages, including Visual Basic, C, C + +, and Java. 3). ActiveX is built on COM and OLE, and therefore can allow other applications to execute within the browser through something called a component container . 4). THERE IS NO SANDBOX to CONTAIN ActiveX controls as there is with Java applets 5). INSTEAD Microsoft relies on DIGITAL CERTIFICATES to authenticate the ActiveX control before installation.

D3). An Application Firewall: "firewall enhancement adds application-layer 7 ability to inspect (HTTP, DNS, FTP,) & other application protocols"

An application firewall is a device, server add-on, virtual service, or system filter that defines a strict set of communication rules for a service and all users. It's intended to be an application-specific server-side firewall to prevent application-specific protocol and payload attacks. A network firewall is a hardware device, typically called an appliance, designed for general network filtering. A network firewall is designed to provide broad protection for an entire network. Both of these types of firewalls are important and may be relevant in many situations. Every network needs a network firewall. Many application servers need an application firewall. However, the use of an application firewall generally doesn't negate the need for a network firewall. You should use both firewalls in a series to complement each other, rather than seeing them as competitive solutions.

F1. SERVER-BASED SYSTEMS:

An important area of server-based concern, which may include clients as well, is the issue of data flow control.

B2. Applets: "self-contained miniature programs that execute independently of the server that sent them"

Applets are code objects are sent from a server to a client to perform some action. In fact, applets are actually self-contained miniature programs that execute independently of the server that sent them. The arena of the World Wide Web is undergoing constant flux. The use of applets is not as common today as it was in the early 2010s. However, applets are not absent from the Web, and most browsers still support them (or still have add-ons present that support them). DETAILS: 1). Code objects are sent from a server to a client to perform some action. 2). Are actually self-contained miniature programs that execute independently of the server that sent them. 3). Allow the processing burden to be placed on client and not server APPLETS INTRODUCE a NUMBER of SECURITY CONCERNS: 1). They allow a remote system to send code to the local system for execution. 2). Security administrators must take steps to ensure that code sent to systems on their network is safe and properly screened for malicious activity. 3). Also, unless the code is analyzed line by line, the end user can never be certain that the applet doesn't contain a Trojan horse component.

O. 6). Application Control: "device-management solution that limits which applications can be installed onto a device"

Application control is a device-management solution that limits which applications can be installed onto a device. It can also be used to force specific applications to be installed or to enforce the settings of certain applications, in order to support a security baseline or maintain other forms of compliance. Using application control can often reduce exposure to malicious applications by limiting the user's ability to install apps that come from unknown sources or that offer non-work-related features. 1). A device-management solution that limits which applications can be installed onto a device. 2). It can also be used to force specific applications to be installed or to enforce the settings of certain applications, in order to support a security baseline or maintain other forms of compliance. 3). Using application control can often reduce exposure to malicious applications by limiting the user's ability to install apps that come from unknown sources or that offer non-work-related features.

H1. Policy Security Mechanisms: 1, 2, 3.

As with any security program, policy mechanisms should also be put into place. These mechanisms are extensions of basic computer security doctrine, but the applications described in this section are specific to the field of computer architecture and design.

D8). Control Redundancy and Diversity: "a non monolithic diverse layered defense posture,

As with any security solution, relying on a single security mechanism is unwise. Defense in depth uses multiple types of access controls in literal or theoretical concentric circles or layers. This form of layered security helps an organization avoid a monolithic security stance. A monolithic mentality is the belief that a single security mechanism is all that is required to provide sufficient security. By having security control redundancy and diversity, a static environment can avoid the pitfalls of a single security feature failing; the environment has several opportunities to deflect, deny, detect, and deter any threat. Unfortunately, no security mechanism is perfect. Each individual security mechanism has a flaw or a workaround just waiting to be discovered and abused by a hacker.

E2. Register Addressing: "small memory locations directly in the CPU"

As you learned in the previous section, registers are small memory locations directly in the CPU. When the CPU needs information from one of its registers to complete an operation, it uses a register address (for example, "register 1") to access its contents. 1). Are small memory locations directly in the CPU. 2). When the CPU needs information from one of its registers to complete an operation, it uses a register address (for example, "register 1") to access its contents.

K2. Use Snapshot For Data Recovery In Virtual Environments:

Backups of virtual machines. They offer a quick means to recover from errors or poor updates.

E7. Base + Offset Addressing: "a value stored in 1 of the CPU's registers as the base location from which to begin counting"

Base + offset addressing uses a value stored in one of the CPU's registers as the base location from which to begin counting. The CPU then adds the offset supplied with the instruction to that base address and retrieves the operand from that computed memory location. 1). Uses a value stored in one of the CPU's registers as the base location from which to begin counting. 2). The CPU then adds the offset supplied with the instruction to that base address and retrieves the operand from that computed memory location.

E. 3). Privileged Mode: "designed to give the OS access to the full range of instructions supported by the CPU"

CPUs also support privileged mode, which is designed to give the operating system access to the full range of instructions supported by the CPU. This mode goes by a number of names, and the exact terminology varies according to the CPU manufacturer. Some of the more common monikers are included in the following list: >. Privileged mode >. Supervisory mode >. System mode >. Kernel mode PRIVILEGED MODE IS DESIGNED TO: 1). GIve the OS access to the full range of instructions supported by the CPU. 2). A.K.A: "Privileged mode/Supervisory mode/System mode/Kernel mode" 3). Only processes that are components of the OS are allowed to execute in this mode, for both security / system integrity. No matter which term you use, the basic concept remains the same—this mode grants a wide range of permissions to the process executing on the CPU. For this reason, well-designed operating systems do not let any user applications execute in privileged mode. Only those processes that are components of the operating system itself are allowed to execute in this mode, for both security and system integrity purposes.

C6. Power Resonance Vulnerabilities: "Flip-Flops could retain some of their charge"

Capacitors and Flip-Flops could retain some of their charge for a limited period of time after power is turned off.

A3. EPROM (Erasable Programmable Read-Only Memory): "category of ROM that can be erased and re-written"

Combine the relatively high cost of PROM chips and software developers' inevitable desires to tinker with their code once it's written and you have the rationale that led to the development of erasable PROM (EPROM). EPROM is a Category Of ROM that can be erased and re-written There are two main subcategories of EPROM, namely 1). UVEPROM and 2). EEPROM (see next item).

5. Communications Equipment:

Communications equipment can also provide unwanted points of entry into a distributed environment. 1). For example, MODEMS ATTACHED to a DESKTOP MACHINE that's also attached to an organization's network can make that network vulnerable to dial-in attacks. 2). There is also a risk that WIRELESS ADAPTERS on CLIENT SYSTEMS can be used to CREATE OPEN NETWORKS. 3). Likewise, USERS who DOWNLOAD DATA from the INTERNET INCREASE the RISK of INFECTING their own and other SYSTEMS with MALICIOUS code, TROJAN HORSES, and so forth. 4). DESKTOPS, LAPTOPS, TABLETS, MOBILE PHONES, and WORKSTATIONS—and associated disks or other storage devices—MAY NOT BE SECURE from PHYSICAL INTRUSION or THEFT. 5). Finally, when DATA resides only on CLIENT MACHINES, it MAY NOT BE SECURED with a proper backup (it's often the case that although servers are backed up routinely, the same is not true for client computers).

C7.). Compartmented Mode: "removes the need-to-know requirement and the access permission requirement"

Compartmented mode systems weaken these requirements one step further: 1). User must have a VALID SECURITY CLEARANCE that PERMITS ACCESS TO ALL DATA processed by the system. 2). User must have ACCESS APPROVAL for ANY INFORMATION they will have ACCESS to on the SYSTEM. 3). User must have a VALID NEED TO KNOW for ALL INFORMATION they will have ACCESS to on the SYSTEM. Major difference between compartmented mode systems & system high is that users of a compartmented mode: 👉 DO NOT NECESSARILY HAVE ACCESS APPROVAL for all the DATA on the SYSTEM.

H2. Timing Attacks:

Computer systems perform tasks with rigid precision. Computers excel at repeatable tasks. ☠️. Attackers can develop attacks based on the predictability of task execution. ☠️. The common sequence of events for an algorithm is to check that a resource is available and then access it if you are permitted.

G2. Data Mining: "mine data warehouses and look for potential correlated information"

Data mining techniques allow analysts to comb through data warehouses and look for potential correlated information. For example, an analyst might discover that the demand for lightbulbs always increases in the winter months and then use this information when planning pricing and promotion strategies. Data mining techniques result in the development of data models that can be used to predict future activity. 1). Allow analysts to comb through data warehouses and look for potential correlated information. 2). These techniques result in the development of data models that can be used to predict future activity.

K2. Data Warehouses & Mining Security Concerns: ".1). all that data is a temptation 2). analytics can be used as a security tool"

Data warehouses and data mining are significant to security professionals for two reasons. 1). First, as previously mentioned, data warehouses contain large amounts of potentially sensitive information vulnerable to aggregation and inference attacks, and security practitioners must ensure that adequate access controls and other security measures are in place to safeguard this data. 2). Second, data mining can actually be used as a security tool when it's used to develop baselines for statistical anomaly-based intrusion detection systems. Data mining is used to "hunt" through large volumes of security-related data for anomalous events that could indicate an ongoing attack, compromise, or breach.

C5.). Dedicated Mode: "all users MUST have right clearance, access permissions, & need to know for all data on system"

Dedicated Mode Dedicated mode systems are essentially equivalent to the single-state system described in the section "Processing Types" earlier in this chapter. Three requirements exist for users of dedicated systems: 1). User must have SECURITY CLEARANCE permitting access to all data on the system. 2). User must have ACCESS APPROVAL for all information processed by the system. 3). User must have a VALID NEED TO KNOW for all information processed by the system.

E2. Type II Hypervisor (or a Hosted Hypervisor): "hypervisor installed as another software application"

Deployed on OS/Desktop Hypervisor. 1). In this configuration, there is a standard regular OS present on the hardware, 2). The hypervisor is installed as another software application. Often used in relation to DESKTOP DEPLOYMENTS Where guest OSs offer safe sandbox areas to test new code, allow the execution of legacy applications, support apps from alternate OSs, and provide the user with access to the capabilities of a host OS.

H. Device Security:

Device Security Device security is the range of potential security options or features that may be available for a mobile device. Not all portable electronic devices (PEDs) have good security features. But even if devices have security features, they're of no value unless they're enabled and properly configured. Be sure to consider the security options of a new device before you make a purchase decision. 1). Full Device Encryption: 2). A Remote Wipe: 3). Lockout: 4). Screen Locks: 5). Global Positioning System (GPS): 6). Application Control: 7). Storage Segmentation (Device Security): 8). Asset Tracking: 9). Inventory Control: 10). Mobile device management (MDM): 11). Device Access Control: 12). Removable Storage: 13). Disabling Unused Features:

D2. Nonvolatile Storage: "designed to retain their data"

Devices designed to retain their data (such as magnetic media) are classified as nonvolatile.

C2. Volatile Storage: "designed to lose their data when power is off"

Devices such as static or dynamic RAM modules, which are designed to lose their data, are classified as volatile.

4. Distributed Architectures Vulnerabilities:

Distributed architectures are prone to vulnerabilities unthinkable in monolithic host/ terminal systems. 1). Desktop systems can contain sensitive INFORMATION that may be at some RISK of BEING EXPOSED and must therefore be protected. 2). Individual users may LACK GENERAL SECURITY savvy or AWARENESS, and therefore the underlying architecture has to compensate for those deficiencies. 3). Desktop PCs, workstations, and laptops can provide AVENUES OF ACCESS INTO CRITICAL INFORMATION systems elsewhere in a distributed environment because users require access to networked servers and services to do their jobs. 4). By permitting user machines to access a network and its distributed resources, organizations must also recognize that those USER MACHINES CAN BECOME THREATS IF THEY ARE MISUSED or COMPROMISED. Such software and system vulnerabilities and threats must be assessed and addressed properly.

C2. Dynamic RAM: "uses series of capacitors to store data"

Dynamic RAM is cheaper than static RAM because capacitors are cheaper than flip-flops. However, static RAM runs much faster than dynamic RAM. This creates a trade-off for system designers, who combine static and dynamic RAM modules to strike the right balance of cost versus performance. Dynamic RAM uses a series of CAPACITORS, tiny electrical devices that hold a charge (but lose the charge) to store data. These capacitors either: 1). "1" Hold a charge (representing a 1 bit in memory) or 2). "0" Do not hold a charge (representing a 0 bit). 3). Is cheaper than static RAM because capacitors are cheaper than flip-flops. 4). Designers include both RAM modules to strike the right balance of cost versus performance. ☠️ Because capacitors naturally lose their charges over time, the CPU must spend time refreshing the contents of dynamic RAM to ensure that 1 bits don't unintentionally change to 0 bits, thereby altering memory contents.

F1). Number 5). Hardware Segmentation: "prevents the access of data that belongs to a security level via physical hardware controls"

Enforces process isolation with physical controls. 1). Hardware segmentation is similar to process isolation in purpose—it prevents the access of information that belongs to a different process/ security level. 2). The main difference is that hardware segmentation enforces these requirements through the use of physical hardware controls rather than the logical process isolation controls imposed by an operating system. 4). Such implementations are rare, and they are generally restricted to national security implementations where the extra cost and complexity is offset by the sensitivity of the information involved and the risks inherent in unauthorized access or disclosure.

B9. How These Various States Relate To One Another.

Figure 9.2 shows a diagram of how these various states relate to one another. 1). New processes always transition into the ready state. 2). From there, ready processes always transition into the running state. 3). While running, a process can transition into the stopped state if it completes or is terminated, 4). Then return to the ready state for another time slice, 5). Or transition to the waiting state until its pending resource request is met. 6). When the operating system decides which process to run next, it checks the waiting queue and the ready queue and takes the highest-priority job that's ready to run 7). A special part of the kernel, called the program executive or the process scheduler, is always around (waiting in memory) so that when a process state transition must occur, it can step in and handle the mechanics involved. 8). The process scheduler In Figure 9.2, manages the processes awaiting execution in the ready and waiting states and decides what happens to running processes when they transition into another state (ready, waiting, or stopped).

F3. Firmware: "SW on a ROM chip, rarely/never changed, drives basic operation of computing device, 2 types, bios and general internal"

Firmware (also known as microcode in some circles) is a term used to describe software that is stored in a ROM chip. 1). This type of software is changed infrequently (actually, never, if it's stored on a true ROM chip as opposed to an EPROM/ EEPROM) and often drives the basic operation of a computing device. There are two types of firmware: 1). BIOS on a motherboard and 2). General internal and external device firmware. DETAILS: 1). Software that is stored in a ROM chip. 2). Type of software is changed infrequently (actually, never, if it's stored on a true ROM chip as opposed to an EPROM/ EEPROM) 3). Drives the basic operation of a computing device. 4). Two types of firmware: BIOS on a motherboard - and - General Internal & External Device Firmware.

C6.). System High Mode: "removes the ALL need-to-know requirement"

For systems running in System High mode, the user must have a valid security clearance for all information processed by the system, access approval for all information processed by the system, and a valid need to know for some, but NOT NECESSARILY ALL, INFORMATION PROCESSED BY THE SYSTEM. System High Mode System high mode systems have slightly different requirements that must be met by users: 1). User must have a VALID SECURITY CLEARANCE that permits ACCESS to ALL DATA processed by the system. 2). User must have ACCESS APPROVAL for ALL INFORMATION PROCESSED by the system. 3). User must have a VALID NEED to KNOW for "SOME" data processed by the system . (👉BUT "NOT NECESSARILY ALL INFORMATION PROCESSED BY THE SYSTEM."👈). Note that the 👉 major difference between the dedicated mode and the system high mode is that all users do not necessarily have a need to know for all information processed on a system high mode computing device.

L3. Cross-site scripting (XSS) Countermeasures:

For the administrator of a website, COUNTERMEASURES.\ against XSS include: 1). Maintaining a patched web server, 2). Using web application firewalls, 3). Operating a host-based intrusion detection system (HIDS), 4). Auditing for suspicious activity, and, most important, 5). Performing server-side input validation for length, 6). Malicious content, and metacharacter filtering. WEB USER COUNTERMEASURES: AS a WEB USER, you can DEFEND AGAINST XSS by: 1). keeping your system patched, 2). running antivirus software, and 3). avoiding nonmainstream websites. There are add-ons for some web browsers, such as NoScript for Firefox and uBlock Origin for Chrome, that allow only scripts of your choosing to be executed.

A1). Protection Rings:

From a security standpoint, protection rings organize code and components in an operating system (as well as applications, utilities, or other code that runs under the operating system's control) into concentric rings, as shown in Figure 9.1. The deeper inside the circle you go, the higher the privilege level associated with the code that occupies a specific ring. Though the original Multics implementation allowed up to seven rings (numbered 0 through 6), most modern operating systems use a four-ring model (numbered 0 through 3). 1). Organize code and components in an operating system into concentric rings. 2). The deeper inside the circle you go, the higher the privilege level needed. 3). Original Multics implementation allowed up to seven rings (numbered 0 through 6), 4). Today, most modern operating systems use a four-ring model (numbered 0 through 3).

E). MULTILEVEL SECURITY:

If you're operating in a multilevel security environment, it's especially important to ensure that adequate protections are in place to prevent the unwanted leakage of memory contents between security levels, through either direct memory access or covert channels (a full discussion of covert channels appears later in this chapter).

H3. Platform as a service (PaaS): "customer only provides application code for execution on a vendor-supplied computing platform"

In a Platform as a Service (PaaS) environment, the vendor takes on responsibility for the operating system, but the customer writes and configures any applications. >. Platform as a service (PaaS) is the concept of providing a computing platform and software solution stack as a virtual or cloud-based service. >. Essentially, this type of cloud solution provides all the aspects of a platform (that is, the operating system and complete solution package). The primary attraction of PaaS is the avoidance of having to purchase and maintain high-end hardware and software locally. DETAILS: 1). The vendor takes on responsibility for the operating system. 2). The customer provides their own software. 3). The customer writes and configures applications. 4). The customer provides all application code for execution on the vendor-supplied computing platform. Primary value: "AVOIDING HAVING TO PURCHASE and MAINTAIN HIGH-END HARDWARE & SW LOCALLY".

H2. Software as a service (SaaS): "vendor takes on responsibility for the development and implementation of the application"

In a Software as a Service (SaaS) environment, the vendor takes on responsibility for the development and implementation of the application while the customer merely configures security settings within the application. >. Software as a service Software as a service (SaaS) is a derivative of PaaS. SaaS provides on-demand online access to specific software applications or suites without the need for local installation. >. In many cases, there are few local hardware and OS limitations. SaaS can be implemented as a subscription service (for example, Microsoft Office 365), a pay-as-you-go service, or a free service (for example, Google Docs). DETAILS: 1). The vendor takes on responsibility for the development and implementation of the application 2). The customer merely configures security settings within the application. 3). Provides on-demand online access to software applications without the need for local installation. 4). In many cases, there are few local hardware and OS limitations. 5). Implemented as a subscription service a pay-as-you-go service, or a free service.

S. Threads and Single-Processor Systems: BULLSHIT SYBEX QUESTION.

In a single-processor system, the operating system (OS) sends one thread at a time to the processor for execution.

H4. Infrastructure as a service (IaaS):

In an Infrastructure as a Service (IaaS) cloud computing model, the customer retains responsibility for managing operating system and application security while the vendor manages security at the hypervisor level and below. >. Provides not just on-demand operating solutions but complete outsourcing options. This can include utility or metered computing services, administrative task automation, dynamic scaling, virtualization services, policy implementation and management services, and managed/ filtered internet connectivity. >. Ultimately, IaaS allows an enterprise to scale up new software or data-based services/ solutions through cloud systems quickly and without having to install massive hardware locally. DETAILS: 1). The customer retains responsibility for managing operating system and application security 2). The vendor manages security at the hypervisor level and below. 3). The customer provides their own software. 4). Provides not just on-demand operating solutions but complete outsourcing options. 5). Allows an enterprise to scale up new software or data-based services/ solutions through cloud systems

E. Multitasking: "handling two or more tasks simultaneously" "multiple tasks occupy multiple processes"

In computing, multitasking means handling two or more tasks simultaneously. In the past, most systems did not truly multitask because they relied on the operating system to simulate multitasking by carefully structuring the sequence of commands sent to the CPU for execution. When a processor was humming along at multiple gigahertz, it was hard to tell that it was switching between tasks rather than working on two tasks at once. A single-core multitasking system is able to juggle more than one task or process at any given time. DETAILS: 1). In computing, this means handling TWO or MORE tasks SIMULTANEOUSLY!. 2). Multitasking is where multiple tasks occupy multiple processes 3). Usually takes place on personal computer (PC) operating systems, such as Windows and Linux. 4). Usually coordinated by the operating system. 5). multiple tasks occupy multiple processes

A2). Four-Ring Model:

In the commonly used four-ring model, protection rings segregate the operating system into: 2.1). Ring 0). OS kernel/memory -highest level of privilege, can access any resource 2.2.). Ring 1). Other temporary OS components and operations 2.3.). Ring 2). I/O drivers, protocols, etc -can access peripheral devices, special files 2.4.). Ring 3). User level app's and programs

B2. Secondary Storage: "secondary is optical, ssd, flash, tapes, etc"

Includes all the familiar long-term storage devices that you use every day. Magnetic and optical media such as HDD, SSDs, flash drives, magnetic tapes, CDs, DVDs, flash memory cards, and the like.

E5. Indirect Addressing: "the memory address contains another memory address"

Indirect addressing uses a scheme similar to direct addressing. However, the memory address supplied to the CPU as part of the instruction doesn't contain the actual value that the CPU is to use as an operand. Instead, the memory address contains another memory address (perhaps located on a different page). The CPU reads the indirect address to learn the address where the desired data resides and then retrieves the actual operand from that address. 1). The memory address contains another memory address 2). The CPU reads the indirect address to learn the address where the desired data resides and 3). Then retrieves the actual operand from that address.

O. Multiprogramming: "alternates execution of multiple programs on single processor" "one process stops, its state is saved & next process in line begins to process"

It involves the pseudosimultaneous execution of two tasks on a single processor coordinated by the operating system as a way to increase operational efficiency. For the most part, multiprogramming is a way to batch or serialize multiple processes so that when one process stops to wait on a peripheral, its state is saved and the next process in line begins to process. DETAILS: 1). Similar to multitasking. 2). Takes place on LARGE-SCALE systems, such as MAINFRAMES- 3). It involves the pseudosimultaneous EXECUTION of TWO TASKS ON A SINGLE PROCESSOR. 4). It is coordinated by the operating system as a way to increase operational efficiency. 5). For the most part, it is a way to BATCH or SERIALIZE multiple PROCESSES so that 6). when one process stops to wait on a peripheral, its state is saved and the next process in line begins to process. 7). Usually takes place on large-scale systems, such as mainframes, 8). Requires SPECIALLY WRITTEN SW that COORDINATES its own ACTIVITIES and execution through the OS.

C2. Java Applet: "java program to be embedded into HTML document, transferred over the Web & executed in a browser"

Java Applets Java is a platform-independent programming language developed by Sun Microsystems (now owned by Oracle). Java is largely superseded by modern applications, and it is no longer supported directly in most browsers. However, you should still have a basic understand of Java as it may still be in use internally or supported in the specific browser implemented by your organization. While modern web design has moved away from Java, this does not mean Java has been scrubbed off the internet. MOST PROGRAMMING LANGUAGES USE COMPILERS that produce applications custom-tailored to run under a specific operating system. This requires the use of multiple compilers to produce different versions of a single application for each platform it must support. Java overcomes this limitation by inserting the Java Virtual Machine (JVM) into the picture. Each system that runs Java code downloads the version of the JVM supported by its operating system. The JVM then takes the Java code and translates it into a format executable by that specific system. The great benefit of this arrangement is that code can be shared between operating systems without modification. Java applets are simply short Java programs transmitted over the internet to perform operations on a remote system. 1). Java is an object-oriented, platform-independent programming language. 2). It is employed as a full-fledged programming language and is used to write complete programs and small components, called applets, which commonly run in a user's web browser. 3). A Java program designed to be embedded into an HTML document, transferred over the Web, and executed in a browser.

M. Massively Parallel Processing (MPP): "💻💻💻💻💻 100's or even 1000's of processors, designed for computationally intensive operations 💻💻💻💻💻"

MPP systems house hundreds or even thousands of processors, designed for computationally intensive operations, such as those that support the research of scientists and mathematicians, require more processing power than a single operating system can deliver. 1). Each processor has its own operating system and memory/ bus resources. 2). Software coordinates the entire system's activities & schedules them for processing 3). This processor in turn breaks the task up into manageable parts and distributes them to other processors for execution.

D4). Manual Updates: "used in static environments/ ensures only tested & authorized changes are implemented"

Manual updates should be used in static environments to ensure that only tested and authorized changes are implemented. Using an automated update system would allow for untested updates to introduce unknown security reductions. 1). Should be used in static environments to ensure that only tested and authorized changes are implemented. 2). ☠️ Using an automated update system allows UNTESTED UPDATES to introduce unknown SECURITY REDUCTIONS.

J2. Device Firmware: "mini os contained on device firmware"

Many hardware devices, such as printers and modems, also need some limited processing power to complete their tasks while minimizing the burden placed on the operating system itself. In many cases, these "MINI" operating systems are entirely contained in firmware chips onboard the devices they serve. As with a computer's BIOS, device firmware is frequently stored on an EEPROM device so it can be updated as necessary.

F4. Host Elasticity:

Means additional hardware hosts can be booted when needed and then used to distribute the workload of the virtualized services over the newly available capacity.

2). Memory Security Issues:

Memory stores and processes your data—some of which may be extremely sensitive. It's essential that you understand the various types of memory and know how they store and retain data. 1). PURGE ANY MEMORY DEVICES that may retain sensitive data should be purged before they are allowed to leave your organization for any reason. 2). PURGE SECONDARY MEMORY: This is especially true for secondary memory and ROM/ PROM/ EPROM/ EEPROM devices designed to retain data even after the power is turned off. However, memory data retention issues are not limited to those types of memory designed to retain data. 3). REMEMBER, STATIC & DYNAMIC RAM CHIPS ARE A RISK: Remember that static and dynamic RAM chips store data through the use of capacitors and flip-flops (see the sidebar "Dynamic vs. Static RAM"). It is technically possible that those electrical components could retain some of their charge for a limited period of time after power is turned off. A technically sophisticated individual could theoretically take electrical measurements of those components and retrieve portions of the data stored on such devices. However, this requires a good deal of technical expertise and is not a likely threat unless you have adversaries with mind-bogglingly deep pockets. There is an attack that freezes memory chips to delay the decay of resident data when the system is turned off or the RAM is pulled out of the motherboard. There are even attacks that focus on memory image dumps or system crash dumps to extract encryption keys. 4). YOU. MUST CONTROL WHO ACCESSES MEMORY: One of the most important security issues surrounding memory is controlling who may access data stored in memory while a computer is in use. This is primarily the responsibility of the operating system and is the main memory security issue underlying the various processing modes described in previous sections in this chapter. The principle of process isolation can be used to ensure that processes don't have access to read or write to memory spaces not allocated to them. 5). MULTILEVEL SECURITY: If you're operating in a multilevel security environment, it's especially important to ensure that adequate protections are in place to prevent the unwanted leakage of memory contents between security levels, through either direct memory access or covert channels (a full discussion of covert channels appears later in this chapter).

D7a.). 7 Mobile Device Off-boarding: "policy should address personal mobile device off-boarding procedures"

Mobile device off-boarding includes: 1). A formal wipe of the business data along 2). The removal of any business-specific applications. In some cases, a full device wipe and factory reset may be prescribed.

E. 1). Operating Modes:

Modern processors and operating systems are designed to support multiuser environments in which individual computer users might not be granted access to all components of a system or all the information stored on it. For that reason, the processor itself supports two modes of operation: 1). USER MODE and 2). PRIVILEGED MODE.

P. Differences between Multiprogramming and Multitasking:

Multiprogramming is considered a relatively obsolete technology and is rarely found in use today except in legacy systems. There are two main differences between multiprogramming and multitasking: FIRST: 1). Multiprogramming usually takes place on LARGE-SCALE systems, such as MAINFRAMES- 2). Multitasking takes place on PERSONAL COMPUTER (PC) operating systems, such as Windows and Linux- SECOND: 1). Multitasking is normally coordinated by the OPERATING SYSTEM, 2). Multiprogramming requires SPECIALLY WRITTEN SOFTWARE that coordinates its own activities and execution through the operating system.

G. Multistate Systems: "can simultaneously operate at multiple security levels"

Multistate Multistate systems are capable of implementing a much higher level of security. These systems are certified to handle multiple security levels simultaneously by using specialized security mechanisms such as those described in the next section, "Protection Mechanisms." These mechanisms are designed to prevent information from crossing between security levels. One user might be using a multistate system to process secret information, while another user is processing top-secret information at the same time. Technical mechanisms prevent information from crossing between the two users and thereby crossing between security levels. DETAILS: 1). Capable of implementing a much HIGHER LEVEL of SECURITY. 2). These systems are CERTIFIED to handle MULTIPLE SECURITY LEVELS SIMULTANEOUSLY using "Protection Mechanisms." 3). Protection Mechanisms are designed to PREVENT INFORMATION from CROSSING BETWEEN SECURITY LEVELS. 4). User #1 might be using a multistate system to process secret information, while 5). User #2 is processing top-secret information at the same time. 6). Technical mechanisms prevent data crossing between two users and between security levels.

D1). Network Segmentation: "used to isolate static environments to prevent changes and/ or exploits from reaching them"

Network segmentation involves controlling traffic among networked devices. Complete or physical network segmentation occurs when a network is isolated from all outside communications, so transactions can only occur between devices within the segmented network. You can impose logical network segmentation with switches using virtual local area networks (VLANs), or through other traffic-control means, including MAC addresses, IP addresses, physical ports, TCP or UDP ports, protocols, or application filtering, routing, and access control management. Network segmentation can be used to isolate static environments in order to prevent changes and/ or exploits from reaching them.

2. Common Architecture Flaws and Security Issues

No security architecture is complete and totally secure. Every computer system has weaknesses and vulnerabilities. The goal of security models and architectures is to address as many known weaknesses as possible. Due to this fact, corrective actions must be taken to resolve security issues. The following sections present some of the more common security issues that affect computer systems in relation to vulnerabilities of security architectures. You should understand each of the issues and how they can degrade the overall security of your system. Some issues and flaws overlap one another and are used in creative ways to attack systems. Although the following discussion covers the most common flaws, the list is not exhaustive. Attackers are very clever.

B2). Distributed Control Systems (DCSs): 🎛🎛🏭. "control of a single nuclear power plant"

POWER STATION! 1). A distributed control system (DCS) is A NETWORK of CONTROL DEVICES WITHIN FAIRLY CLOSE PROXIMITY that are part of one or more industrial processes. 2). DCS units are typically found in industrial process plans where the need to gather data and implement control over a large-scale environment from a single location is essential, they are also very common in manufacturing plants, oil refineries, and power plants, and are characterized by decisions being made in a concerted manner, but by different nodes within the system. 3). While DCS technology is well suited for local processes such as those in a manufacturing plant, it was never intended to operate across great distances. 4). An important aspect of DCS is that the controlling elements are distributed across the monitored environment, such as a manufacturing floor or a production line, and the centralized monitoring location sends commands out of those localized controllers while gathering status and performance data. 5). A DCS might be analog or digital in nature, depending on the task being performed or the device being controlled. For example, a liquid flow value DCS would be an analog system whereas an electric voltage regulator DCS would likely be a digital system.

B1). Programmable Logic Controllers (PLCs): 🎛 "control of a single device like a centrifuge"

POWER TURBINE: 1). PLC units are effectively single-purpose or focused-purpose digital computers. 2). They are typically deployed for the management and automation of various industrial electromechanical operations, such as controlling systems on an assembly line or a large-scale digital light display (such as a giant display system in a stadium or on a Las Vegas Strip marquee).

M2. Parallel Data Systems or Parallel Computing: "dividing up a large task into smaller tasks , then distributing each to a different process for parallel computation"

Parallel data systems or parallel computing is a computation system designed to perform numerous calculations simultaneously. But parallel data systems often go far beyond basic multiprocessing capabilities. They often include the concept of dividing up a large task into smaller elements, and then distributing each subelement to a different processing subsystem for parallel computation. This implementation is based on the idea that some problems can be solved efficiently if broken into smaller tasks that can be worked on concurrently. Parallel data processing can be accomplished by using distinct CPUs or multicore CPUs, using virtual systems, or any combination of these. Large-scale parallel data systems must also be concerned with performance, power consumption, and reliability/ stability issues. 1). A computation system designed to perform numerous calculations simultaneously. 2). Philosophy that problems can be solved efficiently if broken into smaller tasks that can be worked on concurrently. 3). Divide up a large task into smaller elements, 4). Then distributing each subelement to a different processing subsystem for parallel computation.

B2. Planning a Web Security Assessment:

Planning a security evaluation or penetration test of an organization's web services. 1). Reconnaissance or information gathering. 2). Assessment of the site's configuration management. 3). Evaluate authentication and session management. 4). Evaluating the cryptography of the site and the methods used for data validation and sanitization. A web security assessment should also involve checking for DoS defenses, evaluating risk responses, and testing error handling.

F3. Elasticity: "the flexibility of virtualization & cloud solutions to expand & contract based on need"

Refers to the flexibility of virtualization and cloud solutions to expand or contract based on need. In relation to virtualization. 1). Elasticity refers to the flexibility of virtualization and cloud solutions to expand or contract based on need. 2). In relation to virtualization, host elasticity means additional hardware hosts can be booted when needed and then used to distribute the workload of the virtualized services over the newly available capacity. 3). As the workload becomes smaller, you can pull virtualized services off unneeded hardware so it can be shut down to conserve electricity and reduce heat.

C2. Printer Vulnerabilities: "theft, unintended disclosure, stored data, exposure"

Printers also may represent a security risk, albeit a simpler one. Depending on the physical security controls used at your organization, it may be much easier to walk out with sensitive information in printed form than to walk out with a flash drive or magnetic media. If printers are shared, users may forget to retrieve their sensitive printouts, leaving them vulnerable to prying eyes. Many modern printers also store data locally, often on a hard drive, and some retain copies of printouts indefinitely. Printers are usually exposed on the network for convenient access and are often not designed to be secure systems. 1). THEFT: Users can walk out with sensitive information in printed form 2). UNINTENDED DISCLOSURES: If printers are shared, users may forget to retrieve their sensitive printouts 3). STORED DATA: modern printers store data locally, on a hard drive, and some retain copies of printouts indefinitely 4). EXPOSED: Printers are usually exposed on the network for access / are often not designed to be secure systems. Countermeasures: 1). But there are numerous configuration settings that may be available depending on the printer model that can provide some reasonable level of secure network printing services. 2). These can include encrypted data transfer and authentication before printer interaction. 3). These are all issues that are best addressed by an organization's

B2. Real Memory (aka Main Memory or Primary Memory): "the largest RAM storage resource available to a computer"

Real memory (also known as main memory or primary memory) is typically the largest RAM storage resource available to a computer. It is normally composed of a number of dynamic RAM chips and, therefore, must be refreshed by the CPU on a periodic basis (see the sidebar "Dynamic vs. Static RAM" for more information on this subject). 1). Typically the largest RAM storage resource available to a computer. 2). Composed of a number of dynamic RAM chips and, so, must be refreshed by the CPU on a periodic basis

C). REMEMBER, STATIC & DYNAMIC RAM CHIPS ARE A RISK:

Remember that static and dynamic RAM chips store data through the use of capacitors and flip-flops (see the sidebar "Dynamic vs. Static RAM"). It is technically possible that those electrical components could retain some of their charge for a limited period of time after power is turned off. A technically sophisticated individual could theoretically take electrical measurements of those components and retrieve portions of the data stored on such devices. However, this requires a good deal of technical expertise and is not a likely threat unless you have adversaries with mind-bogglingly deep pockets. There is an attack that freezes memory chips to delay the decay of resident data when the system is turned off or the RAM is pulled out of the motherboard. There are even attacks that focus on memory image dumps or system crash dumps to extract encryption keys.

U. 12). Removable Storage:

Remember, phones, sd Cards, memory can be stolen.

E1). Number 4). Process Isolation: "requires that the OS provide separate memory spaces for each process's INSTRUCTIONS & DATA"

Requires that the OS to provide SEPARATE MEMORY SPACES for each process's instructions and data, And that the OS enforce those boundaries, preventing one process from reading or writing data that belongs to another process. There are two major advantages to using this technique: 1). It prevents UNAUTHORIZED DATA ACCESS. Process isolation is one of the FUNDAMENTAL REQUIREMENTS in a MULTILEVEL SECURITY MODE system. It protects the integrity of processes. 2). Without such controls, a POORLY DESIGNED PROCESS could go HAYWIRE and WRITE DATA to MEMORY SPACES ALLOCATED to OTHER PROCESSES, causing the ENTIRE system to BECOME UNSTABLE rather than affecting only the execution of the errant process. In a more malicious vein, processes could attempt (and perhaps even succeed at) reading or writing to memory spaces outside their scope, intruding on or attacking other processes.

A7.). Rings 0-1-2).

Run in Supervisory / Privileged Mode.

A8.). Ring 3).

Runs in User Mode.

A1. Essential Security Protection Mechanisms:

SOFTWARE SHOULD NOT BE TRUSTED: 1). The need for security mechanisms within an operating system comes down to one simple fact: software should not be trusted. Third-party software is inherently untrustworthy, no matter who or where it comes from. 2). This is not to say that all software is evil. Instead, this is a protection stance—because all third-party software is written by someone other than the OS creator, that software might cause problems. TREAT ALL NON OS SOFTWARE AS POTENTIALLY DAMAGING: 1).Thus, treating all non-OS software as potentially damaging allows the OS to prevent many disastrous occurrences through the use of software management protection mechanisms. 2). The OS must employ protection mechanisms to keep the computing environment stable and to keep processes isolated from each other. Without these efforts, the security of data could never be reliable or even possible. ADHERE TO A NUMBER OF COMMON PROTECTION MECHANISMS: 1). Computer system designers should adhere to a number of common protection mechanisms when designing secure systems. These principles are specific instances of the more general security rules that govern safe computing practices. 2). Designing security into a system during the earliest stages of development will help ensure that the overall security architecture has the best chance for success and reliability. TECHNICAL MECHANISMS & POLICY MECHANISMS: In the following sections, we'll divide the discussion into two areas: 1). technical mechanisms and 2). policy mechanisms.

F1. Secondary Memory:

Secondary memory is a term commonly used to refer to magnetic, optical, or flash-based media or other storage devices that contain data not immediately available to the CPU. For the CPU to access data in secondary memory, the data must first be read by the operating system and stored in real memory. However, secondary memory is much more inexpensive than primary memory and can be used to store massive amounts of information. In this context, hard disks, flash drives, and optical media such as compact discs (CDs), digital versatile discs (DVDs), and Blu-ray discs can all function as secondary memory.

P3. Peer-to-peer (P2P) Security Concerns: "pirate copyrighted materials/eavesdrop on distributed content/lack of central control"

Security concerns with P2P solutions include: 1). A perceived inducement to pirate copyrighted materials, 2). The ability to eavesdrop on distributed content, 3). A lack of central control/ oversight/ management/ filtering, and the potential for services to consume all available bandwidth.

D2). Security Layers: "devices at different classification/sensitivity levels are grouped & isolated"

Security layers exist where devices with different levels of classification or sensitivity are grouped together and isolated from other groups with different levels. This isolation can be absolute or one-directional. For example, a lower level may not be able to initiate communication with a higher level, but a higher level may initiate with a lower level. Isolation can also be logical or physical. Logical isolation requires the use of classification labels on data and packets, which must be respected and enforced by network management, OSs, and applications. Physical isolation requires implementing network segmentation or air gaps between networks of different security levels.

E. LOCAL CACHE: ☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️☠️

See 8b

E. Single State Processing: "only capable of operating at one security level at a time"

Single-state systems require the use of policy mechanisms to manage information at different levels. In this type of arrangement, security administrators approve a processor and system to HANDLE only ONE SECURITY LEVEL at a TIME. For example, a system might be labeled to handle only secret information. All users of that system must then be approved to handle information at the secret level. This shifts the burden of protecting the information being processed on a system away from the hardware and operating system and onto the administrators who control access to the system. DETAILS: 1). Systems require the use of policy mechanisms to manage information at different levels. 2). In this arrangement, security admins approve a processor & system to HANDLE only ONE SECURITY LEVELS at a time. - For example, a system might be labeled to handle only secret information. 3). All users of that system must then be approved to handle information at the secret level. 4). Burden of protecting data on a system shifts from HW & OS to admin's controlling access to the system.

B. Assess and Mitigate Vulnerabilities in Mobile Systems:

Smartphones and other mobile devices present an ever-increasing security risk as they become more and more capable of interacting with the internet as well as corporate networks. When personally owned devices are allowed to enter and leave a secured facility without limitation, oversight, or control, the potential for harm is significant. Malicious insiders can bring in malicious code from outside on various storage devices, including mobile phones, audio players, digital cameras, memory cards, optical discs, and Universal Serial Bus (USB) drives. These same storage devices can be used to leak or steal internal confidential and private data in order to disclose it to the outside world. (Where do you think most of the content on WikiLeaks comes from?) Malicious insiders can execute malicious code, visit dangerous websites, or intentionally perform harmful activities. Mobile devices often contain sensitive data such as contacts, text messages, email, and possibly notes and documents. Any mobile device with a camera feature can take photographs of sensitive information or locations. The loss or theft of a mobile device could mean the compromise of personal and/ or corporate secrets. Mobile devices are common targets of hackers and malicious code. It's important to keep nonessential information off portable devices, run a firewall and antivirus product (if available), and keep the system locked and/ or encrypted (if possible). Many mobile devices also support USB connections to perform synchronization of communications and contacts with desktop and/ or notebook computers as well as the transfer of files, documents, music, video, and so on. Additionally, mobile devices aren't immune to eavesdropping. With the right type of sophisticated equipment, most mobile phone conversations can be tapped into—not to mention the fact that anyone within 15 feet can hear you talking. Be careful what you discuss over a mobile phone, especially when you're in a public place. A wide range of security features are available on mobile devices. However, support for a feature isn't the same thing as having a feature properly configured and enabled. A security benefit is gained only when the security function is in force. Be sure to check that all desired security features are operating as expected on your device.

F2. Incremental Attacks: "attack occur in slow, gradual increments"

Some forms of attack occur in slow, gradual increments rather than through obvious or recognizable attempts to compromise system security or integrity. Two such forms of attack are 1). data diddling and 2). the salami attack.

I. 1). Full Device Encryption: "enable full device encryption"

Some mobile devices, including portable computers, tablets, and mobile phones, may offer device encryption. If most or all the storage media of a device can be encrypted, this is usually a worthwhile feature to enable.

C4. Static RAM: "uses a flip-flop (an on/off switch) must be moved from one position to another, much faster than dynamic RAM"

Static RAM uses more sophisticated technology—a logical device known as a flip-flop, which to all intents and purposes is simply an on/ off switch that must be moved from one position to another to change a 0 to 1 or vice versa. More important, static memory maintains its contents unaltered as long as power is supplied and imposes no CPU overhead for periodic refresh operations. DETAILS: 1). More sophisticated than Dynamic RAM 2). Uses a a flip-flop Device, a simply an on/off switch that must be moved from one position to another to change a 0 to 1 or vice versa. 3). Maintains its contents unaltered as long as power is supplied and imposes no CPU overhead for periodic refresh operations. 4). Designers include both RAM modules to strike the right balance of cost versus performance. Runs much faster than dynamic RAM.

C0. EXAM ESSENTIALS: Describe the four security modes approved by the federal government for processing classified information.

THREE REQUIREMENTS: 1). appropriate clearance 2). access permissions, & 3). need to know. 1). DEDICATED SYSTEMS require all users have appropriate clearance, access permissions, & need to know for all data stored on the system. 2). SYSTEM HIGH MODE removes the need-to-know requirement. 3). COMPARTMENTED MODE removes the need-to-know requirement and the access permission requirement. 4). MULTILEVEL MODE removes all three requirements.

D2). Table 9.1 Summarizes & Compares Security Modes:

Table 9.1 summarizes and compares these four security modes according to security clearances required, need to know, and the ability to PROCESS DATA from MULTIPLE CLEARANCE LEVELS (abbreviated PDMCL). When comparing all four security modes, it is generally understood that the multilevel mode is exposed to the highest level of risk. TABLE 9.1

B0. Technical Security Mechanisms, 1,2,3,4,5. "controls that system designers can build right into their system"

Technical mechanisms are the controls that system designers can build right into their systems. We'll look at five: 1. layering, 2. abstraction, 3. data hiding, 4. process isolation, and 5. hardware segmentation.

D1. Registers: "cpu onboard memory that provides direct access to arithmetic-logical unit (ALU) memory locations, it is part of the ALU itself"

The CPU also includes a limited amount of onboard memory, known as registers, that provide it with directly accessible memory locations that the brain of the CPU, the arithmetic-logical unit (ALU), uses when performing calculations or processing instructions. In fact, any data that the ALU is to manipulate must be loaded into a register unless it is directly supplied as part of the instruction. The main advantage of this type of memory is that it is part of the ALU itself and, therefore, operates in lockstep with the CPU at typical CPU speeds. DETAILS: 1). Small memory locations directly in the CPU 2). Provides CPU brain (Arithmetic Logical Unit ALU) with directly accessible memory locations used to perform calculations 3). this memory type operates in lockstep with the CPU at CPU speeds 4). CPU MEMORY!

2. Memory:

The SECOND MAJOR HARDWARE COMPONENT of a SYSTEM is MEMORY, the storage bank for information that the computer needs to keep readily available. There are many different kinds of memory, each suitable for different purposes, and we'll take a look at each in the sections that follow.

C1). Security Modes:

The US government has designated four approved security modes for systems that process classified information. These are described next. In Chapter 1, "Security Governance Through Principles and Policies," we reviewed the classification system used by the federal government and the concepts of security clearances and access approval. The only new term in this context is need to know, which refers to an access authorization scheme in which a subject's right to access an object takes into consideration not just a privilege level but also the relevance of the data involved in the role the subject plays (or the job they perform). The US government has designated four approved security modes for systems that process classified information. 1). Dedicated 2). System high 3). Compartmented 4). Multilevel

H2. Metadata: "byproduct of data mining, produces data about data"

The activity of data mining produces metadata. Metadata is data about data or information about data. Metadata is not exclusively the result of data mining operations; other functions or services can produce metadata as well. Think of metadata from a data mining operation as a concentration of data. It can also be a superset, a subset, or a representation of a larger dataset. Metadata can be the important, significant, relevant, abnormal, or aberrant elements from a dataset. 1). Metadata is data about data or information about data. 2). Data mining is one of many processes that produces metadata.

A0. EXAM ESSENTIALS: Understand mobile device application security:

The applications and functions used on a mobile device need to be secured. Related concepts include: 1). Key Management, 2). Credential Management, 3). Authentication, 4). Geotagging, 5). Encryption, 6). Application Whitelisting, & 7). Transitive Trust/Authentication.

8. A Monolithic or Fortress Mentality:

The belief that a single security mechanism is all that is required to provide sufficient security.

D2. Arithmetic-Logical Unit (ALU):

The brain of the CPU, the arithmetic-logical unit (ALU)

I2. X As A Service:

There are many other "X as a service" offerings available in the marketplace, each with its own potential vulnerabilities and advantages. Different cloud computing companies may define or label their services differently than others. Thus, it is important to carefully compare and contrast providers with what features and options are available from each.

4. EXAM ESSENTIALS: Know the security issues surrounding secondary storage devices.

There are three main security issues surrounding secondary storage devices: 1). Removable media can be used to steal data, 2). Access controls and encryption must be applied to protect data, 3). & Data can remain on the media even after file deletion or media formatting.

G2. 😇😐😫. Cloud ☁️ Service Offerings Customer Responsibility:

The cloud service offerings in order from the case where the customer bears the least responsibility to where the customer bears the most responsibility are: 1). Software as a Service (SaaS) LEAST RESPONSIBILITY 😇 2). Platform as a Service (PaaS) MEDIUM RESPONSIBILITY 😐 3). Infrastructure as a Service (IaaS) MOST RESPONSIBILITY 😫 1). 😇 In a Software as a Service (SaaS) environment, the vendor takes on responsibility for the development and implementation of the application while the customer merely configures security settings within the application. 2). 😐 In a Platform as a Service (PaaS) environment, the vendor takes on responsibility for the operating system, but the customer writes and configures any applications. 3). 😫 In an Infrastructure as a Service (IaaS) cloud computing model, the customer retains responsibility for managing operating system and application security while the vendor manages security at the hypervisor level and below.

F2). LIMIT ACCOUNT PRIVILEGES:

The database account used by the web server should have the smallest set of privileges possible.

C9.). Multilevel Mode: "???????????"

The government's definition of multilevel mode systems pretty much parallels the technical definition given in the previous section. However, for consistency, we'll express it in terms of clearance, access approval, and need to know: 1). SOME USERS DO NOT have a valid security clearance for all information processed by the system, thus, access is controlled by whether the subject's clearance level dominates the object's sensitivity label. 2). User MUST HAVE ACCESS APPROVAL for ALL INFORMATION they will have ACCESS TO on the system. 3). User MUST HAVE a VALID NEED to KNOW for all information they will have access to on the system.

D7. 7). Mobile Device On-boarding: "policy should address personal mobile device on-boarding procedures"

The mobile device policy should address personal mobile device on-boarding and off-boarding procedures. Mobile device On Boarding include: 1). Installing security, management 2). Installing productivity apps along 3). Implementing secure and productive configuration settings.

D3. 3). Patch Management: "policy should define the means and mechanisms of patch management"

The mobile device policy should define the means and mechanisms of patch management for a personally owned mobile device. Q). Is the user responsible for installing updates? Q). Should the user install all available updates? Q). Should the organization test updates prior to on-device installation? Q). Are updates to be handled over the air (via service provider) or over Wi-Fi? Q). Are there versions of the mobile OS that cannot be used? Q). What patch or update level is required?

F4. Incremental Attack #2). The Salami Attack: "very small amounts are deducted from balances regularly and routinely"

The systematic whittling at assets in accounts or other records with financial value, where very small amounts are deducted from balances regularly and routinely. Like stealing a very thin slice from a salami each time it's put on the slicing machine when it's being accessed by a paying customer. Countermeasures include: 1). Proper separation of duties, 2). Proper control over code can organizations, 3). Setting financial transaction monitors to track very small transfers of funds, 4). Regular employee notification of the practice should help to discourage attempts at such attacks.

R. 9). Inventory Control:

The term inventory control may describe hardware asset tracking (as discussed in the previous topic). However, it can also refer to the concept of using a mobile device as a means of tracking inventory in a warehouse or storage cabinet. Most mobile devices have a camera. Using a mobile device camera, apps that can take photos or scan bar codes can be used to track physical goods. Those mobile devices with RFID or NFC capabilities may be able to interact with objects or their containers that have been electronically tagged. DETAILS: 1). May describe hardware asset tracking (as discussed in the previous topic). 2). Can also refer to the concept of using a mobile device as a means of tracking inventory. 3). Using a mobile device camera, apps that can take photos or scan bar codes can be used to track physical goods. 4). Mobile devices with RFID or NFC capabilities may interact with objects, their containers that have been electronically tagged.

T. Thread?

The thread in "multithreading" is a self-contained sequence of instructions that can execute in parallel with other threads that are part of the same parent process. A thread is a self-contained sequence of instructions that can execute in parallel with other threads that are part of the same parent process.

H3. The time of check (TOC):

The time at which the subject checks on the status of the object.

C1. Static vs. Dynamic RAM:

There are two main types of RAM: dynamic RAM and static RAM. Most computers contain a combination of both types and use them for different purposes. To store data, dynamic RAM uses a series of capacitors, tiny electrical devices that hold a charge. These capacitors either hold a charge (representing a 1 bit in memory) or do not hold a charge (representing a 0 bit). However, because capacitors naturally lose their charges over time, the CPU must spend time refreshing the contents of dynamic RAM to ensure that 1 bits don't unintentionally change to 0 bits, thereby altering memory contents. Static RAM uses more sophisticated technology—a logical device known as a flip-flop, which to all intents and purposes is simply an on/ off switch that must be moved from one position to another to change a 0 to 1 or vice versa. More important, static memory maintains its contents unaltered as long as power is supplied and imposes no CPU overhead for periodic refresh operations. Dynamic RAM is cheaper than static RAM because capacitors are cheaper than flip-flops. However, static RAM runs much faster than dynamic RAM. This creates a trade-off for system designers, who combine static and dynamic RAM modules to strike the right balance of cost versus performance.

A3. Database Security:

These include aggregation, inference, data mining, data warehousing, and data analytics.

J4. EM & Tempest Countermeasures:

These include: 1). Faraday cages, 2). Jamming or noise generators, and 3). Control zones.

C8.). Compartmented Mode Workstations (CMWs):

This is a special implementation of Compartmented Mode, users with the necessary clearances can process multiple compartments of data at the same time. This system require that two forms of security labels be placed on objects: sensitivity levels and information labels. 1). Sensitivity levels describe levels at which objects must be protected. Common among all four of the modes. 2). Information labels prevent data overclassification and associate additional data with the objects, 3). This also assists in proper and accurate data labeling not related to access control.

B). PURGE SECONDARY MEMORY:

This is especially true for secondary memory and ROM/ PROM/ EPROM/ EEPROM devices designed to retain data even after the power is turned off. However, memory data retention issues are not limited to those types of memory designed to retain data.

C3). Before Security Modes are Deployed 3 Things Are Needed: 1). MAC 2). Physical. Ctrl. over access to computer console 3). Physical. Ctrl. over access to computer room

Three specific elements must exist before the security modes themselves can be deployed: 1). A hierarchical Mandatory Access Control (MAC) environment 2). Total PHYSICAL CONTROL OVER which SUBJECTS can ACCESS the computer console 3). Total PHYSICAL CONTROL OVER which SUBJECTS can ENTER into the same room as the computer console

E. 2). User Mode: 'CPU allows execution of a portion of full instruction set thus PROTECTING USERS FROM THEMSELVES!"

User Mode User mode is the basic mode used by the CPU when executing user applications. 1). The CPU allows the execution of only a portion of its full instruction set. 2). Designed to protect users from accidentally damaging the system through the execution of poorly designed code or the unintentional misuse of that code. 3). Also protects the system and its data from a malicious user who might try to execute instructions designed to circumvent the security measures put in place by the operating system or who might mistakenly perform actions that could result in unauthorized access or damage to the system or valuable information assets. 4). User Mode Often uses a Virtual Machine (VM) DETAILS: 1). Basic mode used by the CPU when executing user applications. 2). CPU allows the execution of only a portion of its full instruction set. 3). Protects users from damaging the system via execution of poorly designed or unintentional misuse of code. 4). VM or virtual subsystem machine are often executed in this mode

F2. Virtual Memory:

Virtual memory is a special type of secondary memory that the operating system manages to make look and act just like real memory. The most common type of virtual memory is the pagefile that most operating systems manage as part of their memory management functions. This specially formatted file contains data previously stored in memory but not recently used. 1). A special type of secondary memory that the operating system manages to make look and act just like real memory. 2). Most common type is the PAGEFILE most OS's manage as part of their memory management functions.

D1. 1). Data Ownership:

WHEN a personal device is used for business tasks, commingling of personal data and business data is likely to occur. 1). Some devices can support storage segmentation, 2). but not all devices can provide data-type isolation. ESTABLISHING data ownership can be complicated. 1). For example, if a device is lost or stolen, the company may wish to trigger a remote wipe, clearing the device of all valuable information. 2). However, the employee will often be resistant to this, especially if there is any hope that the device will be found or returned. 3). A wipe may remove all business and personal data, which may be a significant loss to the individual—especially if the device is recovered, because then the wipe would seem to have been an overreaction. CLEAR POLICIES:Clear policies about data ownership should be established. 1). Some MDM solutions can provide data isolation/ segmentation and support business data sanitization without affecting personal data. 2). The mobile device policy regarding data ownership should address backups for mobile devices. 3). Business data and personal data should be protected by a backup solution—either a single solution for all data on the device or separate solutions for each type or class of data. 4). This reduces the risk of data loss in the event of a remote-wipe event as well as device failure or damage.

E4. Dynamic Web Pages/Application Security Implications: "web server meant for public on DMZ, db server is not public, keep on internal network"

What does this mean to you as a security professional? 1). Web applications add complexity to the traditional security model. 2). The web server, as a PUBLICLY ACCESSIBLE server, belongs in a SEPARATE NETWORK ZONE from other servers, commonly referred to as a demilitarized zone (DMZ). 3). The DATABASE SERVER, on the other hand, isn't meant for public access, so it belongs on the internal network or at least a secured subnet separated from the DMZ. (A separate network zone from other servers where web servers and other publicly accessible servers should reside)

F3. Paging: "allows processes to exceed the total physical memory (RAM) available on the system"

When the operating system needs to access addresses stored in the pagefile, it checks to see whether the page is memory-resident (in which case it can access it immediately) or whether it has been swapped to disk, in which case it reads the data from disk back into real memory (this process is called paging). Paging is a form of memory management that is used in modern operating systems which allows processes to exceed the total physical memory (RAM) available on the system. This methodology allocates blocks of memory as pages; these pages will be moved out of RAM and onto secondary storage when physical memory is being exhausted. Pages can be loaded to physical memory as data is needed from those pages by evicting other pages that are not currently needed from physical memory. On Windows, the location where these pages are held is known as the pagefile. In Unix/Linux, this location may be referred to as the swap file or swap partition.

E1. Memory Addressing: "a means for a processor of referring to various locations in memory"

When using memory resources, the processor must have some means of referring to various locations in memory. The solution to this problem is known as addressing, and there are several different addressing schemes used in various circumstances. 1). The means of referring to various locations in memory. 2). There are five common addressing schemes. Register/Immediate/Direct/InDirect/Base & Offset.

M4. Divisions of Parallel Data Systems or Parallel Computing:

Within the arena of multiprocessing or parallel processing there are several divisions. The first division is between asymmetric multiprocessing (AMP) and symmetric multiprocessing (SMP). 1). ASYMMETRIC MULTIPROCESSING (AMP): >. In AMP, the processors are often operating independently of each other. >. Usually each processor has its own OS and/ or task instruction set. >. Under AMP, processors can be configured to execute only specific code or operate on specific tasks (or specific code or tasks is allowed to run only on specific processors; this might be called affinity in some circumstances). 2). SYMMETRIC MULTIPROCESSING (SMP): >. In SMP, the processors each share a common OS and memory. >. The collection of processors also works collectively on a single task, code, or project. 3). MASSIVE PARALLEL PROCESSING (MPP): >. A variation of AMP is massive parallel processing (MPP) >. Numerous SMP systems are linked together to work on a single task across multiple processes & linked systems. >. An MPP traditionally involved multiple chassis, but modern MPPs are commonly implemented onto the same chip.

6. Distributed System Security:

You should see that the foregoing litany of potential vulnerabilities in distributed architectures means that such environments require numerous safeguards to implement appropriate security and to ensure that such vulnerabilities are eliminated, mitigated, or remedied. Clients must be subjected to policies that impose safeguards on their contents and their users' activities. These include the following: 1). Email must be screened 2). Download/ upload policies 3). Robust access control 4). Restricted user-interface mechanisms 5). File encryption 6). Separate and isolate processes 7). Protection domains 8). Data Labeling and Security Classification 9). Files on desktop machines should be backed up 10). Regular security awareness 11). Storage media protection from environmental hazards 12). Desktop computers should be included in DRP & BCP 13). Build security Into Software