CISSP-STUDY NOTED
User
- Any person who accesses data via a computing system to accomplish work tasks. - Employees or end users.
Secure European System for Applications in a Multivendor Environment (SESAME)
- A ticket-based authentication system developed to address weaknesses in Kerberos. - No longer considered a viable product.
Mutation (Dumb) Fuzzing
- Takes previous input values from actual operations of the software and manipulates (or mutates) it to create fuzzed input. Example: Zurich tool Bit Flipping - the process of slightly manipulating the input
Class D Subnet
- Used for multicasting - First Binary Digits: 1110 - Decimal Range of First Octet: 224-239
3 Types of Accreditation that may be Granted
1. For a system accreditation, a major application or general support system is evaluated. 2. For a site accreditation, the applications and systems at a specific, self-contained location are evaluated. 3. For a type accreditation, an application or system that is distributed to a number of different locations is evaluated.
Differential Backup
A backup method that stores all files that have been modified since the time of the most recent full backup. Only files that have the archive bit tuned on, enabled, or set to 1 are duplicated. However, this backup process does not change the archive bit.
Incremental Backup
A backup method that stores only those files that have been modified since the time of the most recent full or incremental backup. Only files that have the archive bit turned on, enabled, or set to 1 are duplicated. Once complete, the archive bit on all duplicated files is reset, turned off, or set to 0.
Broadband
A communication medium that supports multiple communication signals simultaneously.
Cross-Site Scripting (XSS)
A form of web application attack when a site contains some type of reflected input. Often exploited using script injection.
Plain text
A message that has not been encrypted.
* (Star) Security Property
A property of the Bell LaPadula Model that states that a subject at a specific classification level cannot write data to a lower classification level ("no write down").
Tuple
A row in a table
Virtual Memory
A special type of secondary memory that is managed by the operating system in such a manner that it appears to be real memory.
Buffer Overflow
A vulnerability that can cause a system to crash or allow the user to execute shell commands and gain access to the system. These vulnerabilities are especially prevalent in code developed rapidly for the Web using CGI or other languages that allow unskilled programmers to quickly create interactive web pages.
Virtual Storage
Allows a system to simulate secondary storage resources through the use of primary storage
Gateway
Also known as a protocol translator, it is a networking device that connects networks that are using different network protocols. Typically operate at OSI layer 7.
* (Star) Integrity Property
An axiom of the Biba Model that states that a subject at a specific classification level cannot write data to a higher classification level ("no write up").
Inrush
An initial surge of power usually associated with connecting to a power source, whether primary or alternate/secondary.
Goguen-Meseguer Model
An integrity model which is based on predetermined goals the set or domain. Subjects are allowed only to perform predetermined actions against predetermined objects.
Financial Attacks
Attacks that are carried out to unlawfully obtain money or services.
Primary Goals of Controls
Ensure the confidentiality and integrity of data by disallowing unauthorized access by authorized or unauthorized subjects.
Semantic Integrity
Ensures that user actions don't violate any structural rules. It also checks that all stored data types are within valid domain ranges, ensures that only logical values exist, and confirms that the system complies with any and all uniqueness constraints.
Maintenance Hooks
Entry point into a system that only the developer of the system knows; also called back door.
Administrative Physical Security Controls
Include facility construction and selection, site management, personnel controls, awareness training. And emergency response and procedures.
Preset Locks
Key-based locks.
Data Warehousing
Large databases used to store large amounts of information from a variety of databases for use in specialized analysis techniques.
Spike
Momentary high voltage.
Clean
No fluctuating pure power.
Examples of Administrative Access Controls
Policies, procedures, hiring practices, background checks, classifying and labeling data, security awareness and training efforts, reports and reviews, personnel controls and testing.
Address Resolution Protocol Spoofing
Provides false MAC addresses for requested IP-addresses systems to redirect traffic to alternate destinations. These attacks are often an element in man-in-the-middle attacks. Countermeasures include: - defining static ARP mappings for critical systems; - monitoring ARP caches for MAC-to-IP address mappings; or - using an IDS to detect anomalies in system traffic and changes in ARP traffic.
Trusted Paths
Secure channel used by the TCB to communicate with the rest of the systems. It protects system users (subjects) from compromise as a result of a TCB interchange.
Examples of Directive Access Controls
Security Policy requirements or criteria, posted notifications, escape route exit signs, monitoring, supervision, and procedures.
Parallel Test
Testing that involves relocating personnel to the alternate recovery site and implementing site activation procedures. Operations at the main facility are NOT interrupted.
Frame
The combination of Data Link layer header, payload and footer.
Normalization
The database process that removes redundant data and ensures that all attributes are dependent on the primary key.
Data Definition Language
The database programming language that allows for the creation and modification of the database's structure (known as the schema).
Data Manipulation Language (DML)
The database programming language that allows users to interact with the data contained within the schema.
Extended Service Set Identifier (ESSID)
The name of a wireless network when a wireless base station or WAP is used (i.e., infrastructure mode).
Degree
The number of columns in the relation
Masquerading
Using someone else's security ID to gain entry into a facility or system.
Masquerading
Using someone else's security ID to gain entry into a facility.
Code Review
"Peer Review" - during this review developers, other than the one who wrote the code, review it for defects.
Government/Military Classification Levels (including effects/damage)
*Top Secret: Drastic Effects / Grave Damage *Secret: Significant Effects / Critical Damage *Confidential: Noticeable Effects / Serious Damage Sensitive but Not Classified Unclassified: No Noticeable Damage * = "Classified"
RFC 1918 Address Blocks
- 10.0.0.0 - 10.255.255.255 (10.0.0.0/8) (a full Class A range) - 172.16.0.0 - 172.31.255.255 (172.16.0.0/12) (16 Class B ranges) - 192.168.0.0 - 192.168.255.255 (192.168.0.0/16) (256 Class C ranges)
Destructive Temperatures
- 100 degrees Fahrenheit can damage storage tapes. - 175 degrees Fahrenheit can damage computer hardware (CPU and RAM). - 350 degrees Fahrenheit can damage paper products.
Fiber Chanel over Ethernet (FCoE)
- A converged protocol used to encapsulate Fibre Channel communications over Ethernet networks. - It typically requires 10 Gbps Ethernet in order to support the Fibre Channel protocol. - With this technology, Fibre Channel operates as a Network layer or OSI layer 3 protocol, replacing IP as the payload of a standard Ethernet network.
Open Database Connectivity (ODBC)
- A database feature that allows applications to communication with different types of databases without having to be directly programmed for interaction with each type. - Acts as a proxy between applications and backend database drivers, giving application programmers greater freedom in creating solutions without having to worry about the backend database system.
Fraggle Attack
- A form of denial-of-service attack similar to smurf, but it uses UDP packets (over ports 7 and 19) instead of ICMP. - This attack will broadcast a UDP packet using the specified IP address of the victim. All systems on the network will then send traffic to the victim.
Public Key Infrastructure (PKI)
- A hierarchy of trust relationships that makes it possible to facilitate communications between parties previously unknown to each other. - These trusts permit combining asymmetric cryptography with symmetric cryptography along with hashing and digital certificates, giving us hybrid cryptography.
Multiprotocol Label Switching (MPLS)
- A high-throughput, high-performance network technology that directs data across a network based on short path labels rather than longer network addresses. - This technique saves significant time over traditional IP-based routing processes, which can be quite complex. - It's designed to handle a wide range of protocols through encapsulation.
Decision Support Systems (DSS)
- A knowledge-based application that analyzes business data and presents it in such a way as to make business decisions easier for users. - More of an informational application that an operational one. - Often employed by knowledge workers (help desk or customer support personnel) and by sales services (such as phone operators).
Hash of Variable Length (HAVAL)
- A modification of MD5 - Uses 1,024-bit blocks and produces hash values of 128, 160, 192, 224, and 256 bits.
TCP/IP
- A multilayer protocol - It derives several benefits from its multilayer design, specifically in relation to encapsulation. - For example: when communicating between a web server and a web browser over a typical network connection, HTTP is encapsulated in TCP, which in turn is encapsulated in IP, which is in turn encapsulated in Ethernet. - [ Ethernet [ IP [ TCP [ HTTP ] ] ] ]. (See page 449 of text for other examples)
Program Evaluation Review Technique (PERT)
- A project scheduling tool used to judge the size of a software product in development and calculate the standard deviation (SD) for risk assessment. - It relates the estimated lowest possible size, the most likely size, and the highest possible size of each component. - It's used to direct improvements to project management and software coding in order to produce more efficient software. - As capabilities improve, the actual produced size of software should be smaller.
Concurrency
- A security mechanism that endeavors to make certain that the information stored in a database is always correct or at least has its integrity and availability protected. - It uses a "lock" feature to allow an authorized user to make changes and then "unlocks" data elements only after all changes are complete.
Remote Authentication Dial-In User Service (RADIUS)
- A service used to centralize the authentication of remote dial-up connections. - Typically used when an organization has more than one network access server (or remote access server). - Used by many ISPs for authentication - Organizations can implement with call-back security for an extra layer of protection. - Uses the User Datagram Protocol (UDP) and encrypts only the exchange of the password. It doesn't encrypt the entire session.
Open Systems Interconnection (OSI) Model
- A standard model developed to establis a common communication structure or standard for all computer systems. - Each layer of the model communicates via a logical channel with its peer layer on another computer.
Expert System
- A system that seeks to embody the accumulated knowledge of humankind on a particular subject and apply it in a consistent fashion to future decisions. - Several studies have sown that these systems often make better decisions that some of their human counterparts when faced with routine decisions.
Access Control Matrix
- A table that includes subjects, objects, and assigned privileges. - Each file listed within the matrix has a separate ACL that lists the authorized users and their assigned permissions.
Kerberos
- A ticket-based authentication mechanism that employs a trusted third party to provide identification and authentication. - Offers a single sign-on solution for users and provides protection for logon credentials. - Provides confidentiality and integrity for authentication traffic. - Helps prevent against eavesdropping and replay attacks.
Smurf Attack
- A type of DoS attack. This attack occurs when an amplifying server or network is used to flood a victim with useless data. - A spoofed broadcast ping request using the IP addresss of the victims as the source IP address. - Floods the victim with the Internet Control Message Protocol (ICMP) echo packets.
Benefits of Multilayer Protocols
- A wide range of protocols can be used at higher layers. - Encryption can be incorporated at various layers. - Flexibility and resiliency in complex network structures is supported
Benefits of Virtualization
- Ability to launch individual instances of servers or services as needed - Real-time scalability - Ability to run the exact OS version needed for the needed application - Recovery from damaged, crashed, or corrupted virtual systems is often quick - Easier and faster to make backups of entire virtual systems - Malicious code compromise or infection of virtual systems rarely affects the host OS
Code Repositiories
- Act as a central storage point for developers to place their source code. - Some also provide version control, bug tracking, web hosting, release management, and communications functions that support software development.
Internet Group Management Protocol (IGMP)
- Allows systems to support multicasting - Used by IP hosts to register their dynamic multicast group membership - Also used by connected routers to discover these groups - Through the use of this multicasting, a server can initially transmit a single data signal for the entire group rather than a separate initial data signal for each intended recipient. - The IP header protocol field value is 2 (0x02)
Thinnet
- Also known as 10Base2 - Commonly used to connect systems to backbone trunks of thick net cabling - Can span distances of 185 meters and provide throughput up to 10Mbps
Thicknet
- Also known as 10Base5 - Can span 500 meters and provide throughput up to 10 Mbps
Crossover Error Rate (CER)
- Also known as the equal error rate (ERR) - The point where the FRR and FAR are equal - Used as a standard assessment value to compare the accuracy of different biometric devices Devices with lower ________s are more accurate than devices with higher _______s
Communications Assistance for Law Enforcement Act (CALEA) of 1994
- Amended the Electronic Communications Privacy Act of 1986. - Requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order, regardless of the technology in use.
Federated Identity Management
- An SSO solution for users accessing resources over the Internet. - Often use the Security Assertion Markup Language (SAML) and/or the Service Provisioning Markup Language (SPML) to meet the common language requirement.
Attribute-Based Access Controls (ABAC)
- An advanced implementation of a rule-BAC - This access control model uses policies that include attributes for rules. Many software defined networking applications use this model.
Terminal Access Controller Access - Control System (TACACS+)
- An alternative to RADIUS - Most commonly used (of XTACACS and TACACS) - Provides several improvements over earlier version and over RADIUS - It separates authentication, authorization, and accounting into separate processes, which can be hosted on three separate servers. - Encrypts ALL of the authentication information, not just the password as RADIUS does. - Uses Transmission Control Protocol (TCP) port 49, providing a higher level of reliability for the packet transmission.
Kerberos - Ticket
- An encrypted message that provides proof that a subject is authorized to access an object. - They have specific lifetimes and usage parameters. Once it expires, a client must request a renewal or a new one to continue communications with any server.
Diameter
- An enhanced version of RADIUS (but not backwards compatible). - Supports a wide range of protocols, including traditional IP, Mobile IP, and Voice over IP (VoIP). - Becoming popular in situations where roaming support is desirable, such as with wireless devices and smart phones. - Uses TCP port 3868 or Stream Control Transmission Protocol (SCTP) port 3868, providing better reliability that UDP used by RADIUS. - Supports IPSec and TLS for encryption.
Capability Tables
- Another way to identify privileges assigned to subjects. - They are different from ACLs in that this authorization mechanism is focused on subjects (such as users, groups or roles). - ACLs are object focused and identify access granted to subjects for any specific object.
Data Processors
- Any system used to process data. - EU Data Protection Law - a natural or legal person which processes personal data solely on behalf of the data controller
4 Basic Requirements of ISAKMP
- Authenticate communicating peers - Create and manage security associations - Provide key generation mechanisms - Protect against threats (for example, reply and denial of service attacks)
Vulnerability Scan
- Automatically probe systems, applications, and networks, looking for weaknesses that may be exploited by an attacker. - Three main categories: - Network discovery scan - Network vulnerability scan - Web application vulnerability scan
Most Common Problems with Coax Cable
- Bending the coax cable past its maximum arc radius and thus breaking the center conductor - Deploying the coax cable in a length greater than its maximum recommended length - Not properly terminating the ends of the coax cable with a 50 ohm resistor
5 LAN Media Access Technologies that are Used to Avoid or Prevent Transmission Collissions
- Carrier-Sense Multiple Access (CSMA) - Carrier-Sense Multiple Access with Collision Avoidance (CSMA/CA) - Carrier-Sense Multiple Access with Collision Detection (CSMA/CD) - Token Passing - Polling
Two Techniques Used to Verify the Authenticity of Certificates
- Certificate Revocation Lists (CRLs) - Online Certificate Status Protocol (OCSP)
2 Phases of the Formal Evaluation Process
- Certification - Accreditation They re used to assess the effectiveness of application security as well as operating system and hardware security.
2 Types of Electromagnetic Interference (EMI)
- Common mode noise - Travers mode noise
4 Fundamental Goals of Cryptoraphy
- Confidentiality - Integrity - Authentication - Nonrepudiation
Ring Topology
- Connects each system as points on a circle. - The connection medium acts as a unidirectional transmission loop. - Only one system can transmit data at a time. - Traffic management is performed by a token.
Bus Topology
- Connects each system to a trunk or backbone cable. - All systems on the bus can transmit data simultaneously, which can result in collisions. - When data is transmitted, all systems on the network hear the data. - Benefit: If a single segment fails, communications on all other segments continue uninterrupted. However, the central trunk line remains a single point of failure.
Mesh Topology
- Connects systems to other systems using numerous paths. - Provide redundant connections to systems, allowing multiple segment failures without seriously affecting connectivity.
Items and Procedures Defined by Clark-Wilsom
- Constrained Data Item (CDI) - any data item whose integrity is protected by the user model. - Unconstrained Data Item (UDI) - any data item that is not controlled by the security model. - Integrity Verification Procedure (IVP) - a procedure that scans data items and confirms their integrity. - Transformation Procedures (TP) - the only procedures that are allowed to modify a CDI. The limited access to CDIs through TPs forms the backbone of this integrity model.
Movie DRM
- Content Scrambling System (CSS) - Enforces playback and region restrictions on DVDs. - Advanced Access Content System (AACS) - Protects the content stored on Blu-Ray and HD DVD media.
Benefits of VLANs
- Control and restrict broadcast traffic. - Isolate traffic between network segments. - Reduce a network's vulnerability to sniffers. - Protect against broadcast storms.
Drawbacks of Multilayer Protocols
- Covert channels are allowed. - Filters can be bypassed. - Logically imposed network segment boundaries can be overstepped.
4 Versions of 3DES
- DES-EEE3: Simply encrypts the plaintext 3 times using 3 different keys. Effective key length of 168 bits. - DES-EDE3: Uses 3 keys, but replaces the second encryption operation with a decryption operation. Effective key length of 168 bits. - DES-EEE2: Uses only 2 keys, K1 and K2, as follows: E(K1,E(K2,E(K1,P))). Effective key length of 112 bits. - DES-EDE2: Uses only 2 keys but uses a decryption operation in the middle: E(K1,D(K2,E(K1,P))). Effective key length of 112 bits.
4 Approved Security Modes for Systems that Process Classified Information
- Dedicated Mode - System High Mode - Compartmented Mode - Multilevel Mode
Cordless Phones
- Designed to use any of the unlicensed frequencies: 900 MHz, 2.4 GHz, or 5 GHz. - Someone could easily eavesdrop on a conversation since its signal is rarely encrypted. - With a frequency scanner, anyone can listen in on your conversation.
Message Digest 2 (MD2)
- Developed in 1989 to provide a secure hash function for 8-bit processors. - This algorithm pads the message so that its length is a multiple of 16 bytes. - It then computes a 16-byte checksum and appends it to the end of the message. - A 128-bit message is then generated by using the entire original message along with the appended checksum. - If the checksum is not appended to the message before digest computation, collisions may occur. - It was proven that this algorithm is not a one-at function, therefore it should no longer be used.
Message Digest 4 (MD4)
- Developed in 1990, an enhancement of the prior version to support 32-bit processors and increase the level of security. - It first pads the message to ensure that the message length is 64 bits smaller than a multiple of 512 bits. - The algorithm then processes 512-bit blocks of the message in three rounds of computation. - The final output is a 128-bit message digest. - No longer considered to be a secure hashing algorithm, and its use should be avoided.
Message Digest 5 (MD5)
- Developed in 1991 as the next version of the message digest algorithm. - It processes 512-bit blocks of the message, but it uses four distinct rounds of computation to produce a 128-bit digest. - It first pads the message to ensure that the message length is 64 bits smaller than a multiple of 512 bits. - This algorithm implements additional security features that reduce the speed of message digest production significantly. - This protocol is subject to collisions, preventing its use for ensuring message integrity. - In 2005, it was proven that it is possible to create two digital certificates from different public keys that have the same hash.
Star Topology
- Employs a centralized connection device. - Each system is connected by a dedicated segment. If any one segment fails, the other segments can continue to function. - The central hub/switch is a single point of failure. - Uses less cable than the other topologies and makes the identification of damaged cables easier.
Address Resolution Protocol (ARP) and Reverse Address Resolution Protocol (RARP)
- Essential to the interoperability of logical and physical addressing schemes - Both function using caching and broadcasting.
Dynamic Testing
- Evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else. - One example is the use of web application scanning tools to detect the presence of cross-site scripting, SQL injection, or other flaws in web applications.
Security Audit
- Evaluations performed with the purpose of demonstrating the effectiveness of controls to a third party. - Reports are intended for an organization's board of directors, government regulators, and other third parties.
El Gamal
- Extension of Diffie-Hellman - Freely available for use - Major disadvantage - doubles the length of any message it encrypts.
EPA-Approved Substitutes for Halon
- FM-200 (HFC-227ea) - CEA-410 or CEA-308 - NAF-S-III (HCFC Blend A) - FE-13 (HCFC-23) - Argon (IG55) or Argonite (IG01) - Inergen (IG541)
TEMPEST Technologies
- Faraday cage - Jamming or noise generators - Control zones
Examples of Perimeter Security (Access Control and Monitoring)
- Fences, gates, turnstiles, and man traps - Lighting - Security guards and dogs
Programming Language Generations
- First-generation languages (1GL) - include all machine languages. - Second generation languages (2GL) - include all assembly languages. - Third-generation languages (3GL) - include all compile languages. - Fourth-generation languages (4GL) - attempt to approximate natural languages and include SQL, which is used by databases. - Fifth-generation languages (5GL) - allow programmers to create code using visual interfaces.
Fire Detection Systems
- Fixed-temperature detection system - Rate-of-rise detection system - Flame-actuated system - Smoke-actuated system
Ping Flood Attack
- Floods a victim with ping requests. - Common way to handle is to block ICMP traffic.
Civil Law
- Focuses on compensating the victim - Individual, group, or organization is the victim - Burden of proof: Preponderance of evidence
Criminal Law
- Focuses on punishment and deterrence - Society is the victim - Burden of proof: Beyond a reasonable doubt
Nondiscretionary Access Controls (non-DAC)
- For this access control model, administrators centrally administer access controls and can make changes that affect the entire environment. In this model, access does not focus on user identity. Instead, a static set of rules governing the whole environment manages access. - Any model that is not DAC is this, including: - rule-based access controls - role-based access controls - lattice-based access controls
Secure Hash Algorithm (SHA) and its successors
- Government standard hash functions developed by the NIST and are specified in an official publication - the Secure Hash Standard (SHS), also known as Federal Information Processing Standards (FIPS) 180.
Custodian
- Help protect the integrity and security of data by ensuring it is properly stored and protected. - Typically personnel within an IT Dept or system security admisnistrators
6 Types of Motion Detectors
- Infrared Motion Detector - Heat-Based Motion Detector - Wave Pattern Motion Detector - Capacitance Motion Detector - Photoelectric Motion Detector - Passive Audio Motion Detector
Software Capability Maturity Model
- Introduced by the Software Engineering Institute (SEI) at Carnegie Mellon University. - Contends that all organizations engaged in software development move through a variety of maturity phases in sequential fashion. - This model intends to help software organizations improve the maturity and quality of their software processes by implementing an evolutionary path from ad hoc chaotic processes to mature, disciplined software processes. - Quality of software depends on the quality of its development process.
Biometric - Type 2 Error
- Invalid subject is authenticated - False positive authentication - Type 2 errors/valid authentication = false acceptance rate (FAR)
Drawbacks of the Biba Model
- It addresses only integrity, not confidentiality or avialbility. - It focuses on protecting objects from external threats; it assumes that internal threats are handled programmatically. - It does not address access control management, and it doesn't provide a way to assign or change an object's or subject's classification level. - It does not prevent covert channels.
SDN
- It is effectively network virtualization - It allows data transmission paths, communication decision trees, and flow control to be virtualized in the SDN control layer rather than being handled on the hardware on a per-device basis.
Weaknesses of Symmetric Key Cryptography
- Key distribution is a major problem; - Does not implement nonrepudiation; - The algorithm is not scalable; and - Keys must be regenerated often.
Elliptic Curve Cryptosystem (ESS)
- Key length is 160 bits which is shorter but is cryptographically equivalent to RSA's 1,024 bits.
2 Data Link Layer Sublayers
- Logical Link Control (LLC) Sublayer - MAC Sublayer
Electronic Communications Privacy Act of 1986 (ECPA)
- Makes it a crime to invade the electronic privacy of an individual. - Broadened the Federal Wiretap Act. - Protects against the monitoring of email and voicemail communications. - Makes it illegal to monitor mobile telephone conversations (punishable by a fine up to $500 and a prison term of up to 5 years).
Security Capabilities
- Memory protection - Virtualization - Trusted Platform Module - Interfaces - Fault tolerance
Common Hashing Algorithms
- Message Digest 2 (MD2) - Message Digest 5 (MD5) - Secure Hash Algorithm (SHA-0, SHA-1, and SHA-2) - Hashed Message Authentication Code (HMAC)
4 Execution Types
- Multitasking - Multiprocessing - Multiprogramming - Multithreading
The EU Data Protection Directive Principles
- Notifying individuals how their personal data is collected and used. - Allowing individuals to opt out of sharing their personal data with third parties. - Requiring individuals to opt into sharing the most sensitive personal data. - Providing reasonable protections for personal data.
Key Performance and Risk Indicators
- Number of open vulnerabilities - Time to resolve vulnerabilities - Number of compromised accounts - Number of software flaws detected in preproduction scanning - Repeat audit findings - User attempts to visit known malicious sites
Benefits of SDN
- Offers a network design that is directly programmable from a central location, is flexible, is vendor neutral, and is open-standards based. - Using this protocol frees an organization from having to purchase devices from a single vendor. - Allows organizations to mix and match hardware as needed. - It is effectively network virtualization. It allows data transmission paths, communication decision trees, and flow control to be virtualized in the SDN control layer rather than being handled on the hardware on a per-device basis.
3 Main Methods Used to Exhange Secret Keys Securely
- Offline distribution - Public key encryption - Diffie-Hellman key exchange algorithm
California Online Privacy Protection Act (COPA)
- One of the most stringent laws in the US. - Requires a conspicuously posted privacy policy for any commercial websites or online services that collect personal information on California residents.
User Datagram Protocol (UDP)
- Operates at layer 4 (Transport layer) of the OSI model. - It is a connectionless "best-effort" communications protocol. - It offers no error detection or correction, does not use sequencing, does not use flow control mechanisms, does not use a preestablished session, and is considered unreliable. - It has very low overhead and thus can transmit quickly. - Should be used only when the delivery of data is not essential.
Transmission Control Protocol (TCP)
- Operates at layer 4 (the Transport layer) of the OSI model - Supports full-duplex communications - Connection-oriented (employs a handshake process between two systems to establish a communication session) - Employs reliable sessions
Internet Protocol (IP)
- Operates at the Network layer of the OSI model. - It provides route addressing for data packets. - It is connectionless and an unreliable Datagram service. - It does not offer guarantees that packets will be delivered or that packets will be delivered in the correct order. - It does not guarantee that packets will be delivered only once. - Used with TCP to gain reliable and controlled communication sessions.
Network File System (NFS)
- Port 2049 - This is a network service used to support file sharing between dissimilar systems.
6 Access Control Types
- Preventive - Detective - Corrective - Recovery - Deterrent - Compensating
3 Types of Protection Mechanisms
- Protection rings - Operational states - Security modes
Kerberos - Ticket-Granting Ticket
- Provides proof that a subject has authenticated through a KDC and is authorized to request tickets to access other objects. - This "ticket" is encrypted and includes a symmetric key, and expiration time, and the user's IP address. - Subjects present the _________ when requesting a ticket to access objects.
3 Common Public Key Cryptosystems (Asymmetric)
- RSA - El Gamal - Elliptic Curve Cryptosystem (ECC)
States of Operation
- Ready - Waiting - Running - Supervisory - Stopped
Gramm-Leach Bliley Act (GLBA) of 1999
- Relaxed the regulation concerning the services each organization could provide. - Included a number of limitations on the types of information that could be exchanged even among subsidiaries of the same corporations and required financial institutions to provide written privacy policies to all their customers by July 1, 2001
Public Key Cryptosystems
- Relies on pairs of keys assigned to each user of the cryptosystem. - Public keys are made available to anyone with whom they want to communicate. - The private key is reserved for the sole use of the individual who owns the keys. - Entails a higher degree of computational complexity.
General Data Protection Regulation (GDPR)
- Replacement for the EU Data Protection Directive - Organizations to begin adopting the requirements in 2015 and 2016 - Organizations to begin enforcing the requirements in 2017 and 2018
Context-Dependent Control
- Require specific activity before granting users access. - For example: making an online purchase to download content. The system denies access to the download page if users don't go through the purchase process first. - Date and time controls are another example - it's possible to restrict access to computers and applications based on the current day and/or time.
Class E Subnet
- Reserved for future use - First Binary Digits: 1111 - Decimal Range of First Octet: 240-255
Business/Mission Owner
- Responsible for ensuring systems provide value to the organization. - Own processes that use systems managed by other entities.
Data Administrator
- Responsible for granting appropriate access to personnel. - Assign permissions based on the principles of least privilege and the need to know. - Assign permissions using a role-based access control model.
Content-Dependent Control
- Restricts access to data based on the content within an object. - For example: a database view. Users granted access to the view can see the pertinent fields but cannot access the data in the underlying table.
2 Government Standards in Place for the Certification and Accreditation of Computing Systems
- Risk Management Framework (RMF) - the current DoD standard - Committee on National Security Systems (CNSS) Policy (CNSSP) - the standard for all other US government executive branch departments, agencies, and their contractors and consultants.
2 Additional digital Signature Algorithms
- Schnorr's signature algorithm; and - Nyberg-Rueppel's signature algorithm
DevOps Approach
- Seeks to resolve issues of software development, quality assurance, and technology operations by bringing the three functions together in a single operational model. - The name symbolizes that the functions must merge and cooperate to meet business requirements. - Closely aligned with the Agile development approach. - Aims to dramatically decrease the time required to develop, test, and deploy software changes.
Privacy Act of 1974
- Severely limits the ability of federal government agencies to disclose private information to other persons or agencies without the prior written consent of the affected individual(s). - Mandates that agencies maintain only the records that are necessary for conducting their business and that they destroy those records when they are no longer needed for a legitimate government function.
2 Basic Properties of the Biba Model
- Simple Integrity Property - * (Star) Integrity Property
3 Basic Properties of Bell-LaPadula
- Simple Security Property - * (star) Security Property - Discretionary Security Property * All states accessible through the first two rules are secure states.
3 Commonly Recognized Firewall Deployment Architectures
- Single Tier - Two Tier - Three Tier (also known as multitier)
UDP Header Fields
- Source port - Destination port - Message length - Checksum
Strengths of Symmetric Key Cryptography
- Speed - Naturally lends itself to hardware implementations, creating the opportunity for even higher-speed operations.
4 Spectrum Use Techniques
- Spread Spectrum - Frequency Hopping Spread Spectrum (FHSS) - Direct Sequence Spread Spectrum (DSSS) - Orthogonal Frequency-Division Multiplexing (OFDM)
4 Basic Types of Firewalls
- Static Packet-Filtering Firewalls - Application-Level Gateway Firewalls - Circuit-Level Gateway Firewalls - Stateful Inspection Firewalls
Features of SSL and TLS
- Support secure client-server communications across an insecure network while preventing tampering, spoofing, and eavesdropping. - Support one-way authentication. - Support two-way authentication using digital certificates. - Often implemented as the initial payload of a TCP package, allowing it to encapsulate all higher-layer protocol payloads. - Can be implemented at lower layers, such as layer 3 (the Network layer) to operate as a VPN. This implementation is known as OpenVPN.
Class A Subnet
- Supports 16,777,214 hosts - First Binary Digits: 0 - Decimal Range of First Octet: 1-126 - Default Subnet Mask: 255.0.0.0 - CIDR Equivalent: /8
Class C Subnet
- Supports 254 hosts - First Binary Digits: 110 - Decimal Range of First Octet: 192-223 - Default Subnet Mask: 255.255.255.0 - CIDR Equivalent: /24
Class B Subnet
- Supports 65,534 hosts - First Binary Digits: 10 - Decimal Range of First Octet: 128-191 - Default Subnet Mask: 255.255.0.0 - CIDR Equivalent: /16
Major CA's
- Symantec - Thawte - GeoTrust - GlobalSign - Comodo Limited - Starfield Technologies - GoDaddy - DigiCert - Network Solutions, LLC - Entrust * Browser authorities preconfigure browsers to trust the major CA's to avoid placing this burden on users.
Issues Commonly Addressed with Service-Level Agreements (SLAs)
- System uptime - Maximum consecutive downtime - Peak load - Average load - Responsibility for diagnostics - Failover time
Post Office Protocol (POP3)
- TCP Port 110 - This is a protocol used to pull email messages from an inbox on an email server down to an email client.
Internet Message Access Protocol (IMAP)
- TCP Port 143 - This is a protocol used to pull email messages from an inbox on an email server down to an email client. - It is more secure than POP3 and offers the ability to pull headers down from the email server as well as to delete messages directly off the email server without having to download to the local client first.
Telnet
- TCP Port 23 - This is a terminal emulation network application that supports remote connectivity for executing commands and running applications but does not support transfer of files.
Simple Mail Transfer Protocol (SMTP)
- TCP Port 25 - This is a protocol used to transmit email messages from a client to an email server and from one email server to another.
Secure Sockets Layer (SSL)
- TCP Port 443 (for HTTP encryption) - This is a VPN-like security protocol that operates at the Transport layer. - It was originally designed to support secured web communications (HTTPS) but is capable of securing any Application layer protocol communications.
Line Print Daemon (LPD)
- TCP Port 515 - This is a network service that is used to spool print jobs and to send print jobs to printers.
Hypertext Transport Protocol (HTTP)
- TCP Port 80 - This is the protocol used to transmit web page elements from a web server to web browsers.
File Transfer Protocol (FTP)
- TCP Ports 20 and 21 - This is a network application that supports an exchange of files that requires anonymous or specific authentication.
X Window
- TCP Ports 6000-6063 - This is a GUI API for command-line operating systems
3 Main Product Evaluation Models or Classification Criteria Models
- TCSEC - ITSEC - Common Criteria
2 Main Components of an Expert System
- The Knowledge Base: contains the rules known by an expert system. It seeks to codify the knowledge of human experts in a series of "if/then" statements. - The Inference Engine: analyzes information in the knowledge base to arrive at the appropriate decision.
Encapsulation
- The addition of a header, and possibly a footer, to the data received by each layer from the layer above before it's handed off to the layer below. - It occurs as the data moves down through the OSI model layers from Application to Physical.
Major Strengths of Assymmetric Key Cryptography
- The addition of new users requires the generation of only one public-private key pair; - Users can be removed far more easily; - Key regeneration is required only when a user's private key is compromised; - It can provide integrity, authentication, and nonrepudiation; - Key distribution is a simple process; and No preexisting communication link needs to exist.
Reasons for Revocation of a Certificate
- The certificate was compromised. - The certificate was erroneously issued. - The details of the certificate changed. - The security association changed.
Identity and Access Provisioning Life Cycle
- The creation, management, and deletion of accounts - 3 Steps: - Provisioning - Account Review - Account Revocation
A Public Key Listed in a Certificate is Valid if it Satisfies These Requirements
- The digital signature of the CA is authentic. - You trust the CA. - The certificate is not listed on a CRL. - The certificate actually contains the data you are trusting.
RSA
- The most famous public key cryptosystem - Named after its creators, Ronald Rivest, Adi Shamir, and Leonard Adleman - Its algorithm depends on the computational difficulty inherent in factoring large prime numbers. - Key length 1,024 bits.
Data Owner
- The person who has ultimate organizational responsibility for data. - Typically the CEO, the president, or a department head (DH). - Identify the classification of data and ensure that it is labeled properly. - Ensures data has adequate security controls based on the classification and organization's security policy requirements.
System Owner
- The person who own the system that processes sensitive data. - Typically the same person as the data owner, but it can sometimes be someone different. - Responsible for ensuring that data processed on the system remains secure. - Identifies the highest level of data that the system processes and ensures the system is labeled accurately and that appropriate security controls are in place to protect the data.
3 Layers of Addressing and Numbering as Used on TCP/IP-Based Networks
- The third, or bottom, layer is the MAC address. The MAC address, or hardware address, is a "permanent" physical address. - The second, or middle, layer is the IP address. The IP address is a "temporary" logical address assigned over or onto the MAC address. - The top layer is the domain name. The domain name or computer name is a "temporary" human-friendly convention assigned over or onto the IP address.
Data Emanation
- The transmission of data across electromagnetic signals. - This term is often used to focus on ________ that are unwanted or on data that is at risk due to it.
Distance Vector Routing Protocols
- These protocols maintain a list of destination networks along with metrics of direction and distance as measured in hops (the number of routers to cross to reach the destination). - Examples: Routing Information Protocol (RIP), Interior Gateway Routing Protocol (IGRP), and Border Gateway Protocol (BGP).
Link State Routing Protocols
- These protocols maintain a topography map of all connected networks and use this map to determine the shortest path to the destination. - Example: Open Shortest Path First (OSPF)
Constrained Interface
- This access control method uses restricted interfaces to restrict what users can do or see based on their privileges. - Common method is to hide the capability if the user doesn't have permissions to use it. - Other times, the application displays the menu item but shows it dimmed or disabled.
Mandatory Access Controls (MAC)
- This access control model relies on the use of classification levels. Each classification label represents a security domain, or a realm of security. A security domain is a collection of subjects and objects that share a common security policy. - Users have labels assigned to them based on their clearance level, which is a form of privilege. Similarly, objects have labels, which indicate their level of classification or sensitivity. - Using compartmentalization with this model enforces the need to know principle.
Rule-Based Access Controls (Rule-BAC)
- This access control model uses a set of rules, restrictions, or filters to determine what can and cannot occur on a system. - It includes granting a subject access to an object, or granting the subject the ability to perform an action. A distinctive characteristic is that they have global rules that apply to all subjects. - Example: A firewall
Least Privilege
- This principle ensures that subjects are granted only the privileges they need to perform their work tasks and functions. - Sometimes lumped together with need to know, but this privilege will also include rights to take action on a system.
Objectives of the CC Guidelines
- To add buyer's confidence in the security of evaluated, rated IT products. - To eliminate duplicate evaluations. - To keep making security evaluations and the certification process more cost effective and efficient. - To make sure evaluations of IT products adhere to high and consistent standards. - To promote evaluation and increase availability of evaluated, rated IT products. - To evaluate the functionality (what the system does) and assurance (how much you can trust the system) of the TOE.
Simple Network Management Protocol (SNMP)
- UDP Port 161 (UDP Port 162 for Trap Messages) - This is a network service used to collect network health and status information by polling monitoring devices from a central monitoring station
Trivial File Transfer Protocol (TFTP)
- UDP Port 69 - This is a network application that supports an exchange of files that does not require authentication.
Bootstrap Protocol (BootP)/Dynamic Host Configuration Protocol (DHCP)
- UDP Ports 67 and 68 - This is a protocol used to connect diskless workstations to a network through autoassignment of IP configuration and download of basic OS elements. - One is the forerunner to the other (alphabetical)
Dynamic Host Configuration Protocol (DHCP)
- UDP Ports 67 and 68 - Uses port 67 for server point-to-point response - Uses port 68 for client request broadcasts. - It is used to assign TCP/IP configuration settings to systems upon boot up. - Enables centralized control of network addressing.
Synthetic Transactions
- Used in dynamic testing to verify system performance. - These are scripted transactions with known expected results. The testers run these transactions against the tested code and then compare the output of the transactions to the expected state. Any deviations between the actual and expected results represent possible flaws in the code and must be further investigated.
Internet Control Message Protocol (ICMP)
- Used to determine the health of a network or a specific link. - It is utilized by ping, traceroute, pathping, and other network management tools. - IP header protocol field value is 1 (0x01) - The type field in the header defines the type or purpose of the message contained within the payload. - There are more than 40 defined header types, but only 7 are commonly used.
Two Modes of Operation
- User Mode - Privileged Mode
IPv6
- Uses 128 bits for addressing - New features: scoped addresses, autoconfiguration, and Quality of Service (QoS) priority values - Supported by most operating systems released since 2000, either natively or via an add-in.
Network Discovery Scan
- Uses a variety of techniques to scan a range of IP addresses,searching for systems with open network ports. - Most common tool: NMAP - identifies the current state of each network port on the system. - Open - actively accepting connections on that port - Closed - no applications accepting connections on that port - Filtered - NMAP is unable to determine if a port is open or closed because a firewall is interfering with the connection attempt
Classless Inter-Domain Routing (CIDR) notation
- Uses mask bits rather than a full dotted-decimal notation subnet mask. - Example: instead of 255.255.0.0, this is added to the IP address after a slash, as in 172.16.1.1/16 - Significant benefit is the ability to combine multiple noncontiguous sets of addresses into a single subnet.
Biometric - Type 1 Error
- Valid subject is not authenticated - False negative authentication - Type 1 errors/valid authentications = false rejection rate (FRR)
Security Testing
- Verify that a control is functioning properly. - Tests include: - automated scans - tool-assisted penetration tests - manual attempts to undermine security - Should take place on a regular schedule - Attention should be paid to each of the key security controls protecting an organization.
Children's Online Privacy Protection Act of 1998 (COPPA)
- Websites must have a privacy notice that clearly states the types of information they collect and what it's used for. - Parents must be provided with the opportunity to review any information collected from their children and permanently delete it from the site's records. - Parents must give verifiable consent to the collection of information about children younger than the age of 13 prior to any such collection.
Water Suppression Systems
- Wet pipe system - Dry pipe system - Deluge system - Preaction system
Common ICMP Type Field Values
0 Echo Reply 3 Distinction Unreachable 5 Redirect 8 Echo Request 9 Router Advertisement 10 Router Solicitation 11 Time Exceeded
7 Requirements of US Companies Conducting Business in Europe to Qualify for Safe Harbor Provisions
1 - Notice 2 - Choice 3 - Onward Transfer 4 - Access 5 - Security 6 - Data Integrity 7 - Enforcement
Key Rights Under the European Union's Directive of Data Privacy
1 - Right to access the data 2 - Right to know the data's source 3 - Right to correct inaccurate data 4 - Right to withhold consent to process data in some situations 5 - Right of legal action should these rights be violated
Port Assignments
1-1,023 - well-known ports or service ports 1,024-49,151 - registered software ports 49,152-65,535 - random, dynamic, or ephemeral ports
3 Specific Elements Must Exist Before the Security Mode can be Deployed
1. A hierarchical MAC environment. 2. Total physical control over which subjects can access the computer console. 3. Total physical control over which subjects can enter into the same room as the computer console.
6 Major Elements of Quantitative Risk Analysis
1. Assign Asset Value (AV) 2. Calculate Exposure Factor (EF) 3. Calculate Single Loss Expectancy (SLE) 4. Assess the Annualized Rate of Occurrence (ARO) 5. Derive the Annualized Loss Expectancy (ALE) 6. Perform Cost/Benefit Analysis of Countermeasures
National Information Infrastructure Act of 1996
1. Broadens CFAA to cover computer systems used in international commerce in addition to systems used in interstate commerce. 2. Extends similar protections to portions of the national infrastructure other than computing systems, such as railroads, gas pipelines, electric power grids, and telecommunications circuits. 3. Treats any intentional or reckless act that causes damage to critical portions of the national infrastructure as a felony.
General Wi-Fi Security Procedure
1. Change the default=let administrator password. 2. Disable the SSID broadcast. 3. Change the SSID to something else. 4. Emailing MAC filtering if the pool of wireless clients is relatively small (usually less that 20) and state. 5. Consider using static IP addresses, or configure DHCP with reservation (applicable only for small deployments) 6. Turn on the highest form of authentication and. encryption supported, If WPA2 is not available, WPA and WEP provide very little protection but are better than an unencrypted network. 7. Treat wireless as remote access, and manage access using 802.1X 8.Treat wireless as external access, and separate the WAP from the wired network using a firewall. 9. Treat wireless as an entry point for attackers, and monitor all WAP-to-wired network communications with an IPS 10. Require all transmissions between wireless clients and WAPs to be encrypted, in other words, require a VPM link.
Best Practices for Working within the Public Key Infrastructure
1. Choose your encryption wisely. 2. Select your keys in an appropriate manner. 3. When using public encryption, keep your private key private. 4. Retire keys when they've served their useful life. 5. Back up your key and ensure it is handles in a secure manner..
TCP Three-Way Handshake Process
1. Client sends a SYN (synchronize) flagged packet to the server. 2. The server responds with a SYN/ACK (synchronize and acknowledge) flagged packet back to the client. 3. The client responds with an ACK (acknowledge) flagged packet back to the server.
System Development Life Cycle (Common Activities)
1. Conceptual definition 2. Functional requirements determination 3. Control specifications development 4. Design review 5. Code review walk-through 6. System test review 7. Maintenance and change management
Incident Response Steps (7 Steps)
1. Detection 2. Response 3. Mitigation 4. Reporting 5. Recovery 6. Remediation 7. Lessons Learned
3-Step Incident Response Process
1. Detection and identification 2. Response and reporting 3. Recovery and remediation
Functional Order in which Controls Should be Used
1. Deterrence 2. Denial 3. Detection 4. Delay
5 Modes of DES
1. Electronic Codebook (ECB) 2. Cipher Block Chaining (CBC) 3. Cipher Feedback (CFB) 4. Output Feedback (OFB) 5. Counter (CTR)
2 Major Approaches to Key Escrow Proposed over the Last Decade
1. Fair Cryptosystems 2. Escrowed Encryption Standard
Major Differentiators Between Encryption Tools
1. How they protect keys stored in memory. 2. Whether they provide full disk or volume-only encryption. 3. Whether they integrate with hardware-based Trusted Platform Modules (TPM) to provide added security.
5 Steps of the BIA Process
1. Identification of priorities 2. Risk identification 3. Likelihood assessment 4. Impact assessment 5. Resource prioritization
7 Steps to Implementing a Classification Scheme
1. Identify the custodian, and define their responsibilities 2. Specify the evaluation criteria of how information will be classified and labeled. 3. Classify and label each resource (performed by owner). 4. Document any exceptions to the classifications policy that are discovered. 5. Select security control. 6. Specify procedures for declassifying resources. 7. Create an enterprise-wide awareness program.
Simple Rules about Encrypting Email
1. If you need confidentiality when sending an email message, encrypt the message. 2. If your message must contain integrity, you must hash the message. 3. If your message needs authentication, integrity and/or nonrepudiation, you should digitally sign the message. 4. If your message needs confidentiality, integrity, authentication, and nonrepudiation. you should encrypt and digitally sign the message.
Stages of the Software Capability Maturity Model
1. Initial - Little or no defined software development process 2. Repeatable - Basic life cycle management processes are introduced. Reuse of code in an organized fashion begins to enter the picture, and repeatable results are expected from similar projects. 3. Defined - Developers operate according to a set of formal, documented software development processes. 4. Managed - Quantitative measures are utilized to gain a detailed understanding of the development process. 5. Optimizing - Process of continuous improvement occurs. Processes are in place that ensure feedback from one phase reaches the previous phase to improve future results.
Major Critiques of TCSEC
1. It doesn't exercise control over what users do with information once access is granted. 2. It focuses its concerns entirely confidentiality. This doesn't work well in commercial environments where concerns about data accuracy and integrity can be more important. 3. It doesn't carefully address the kinds of personnel, physical, and procedural policy matters or safeguards that must be exercised to fully implement security policy. 4. The Orange Book, per se, doesn't deal with networking issues (though the Red Book does). * These criticisms reflect the unique security concerns of the military.
Computer Abuse Amendments Act of 1994
1. Outlawed the creation of any type of malicious code that might cause damage to a computer system. 2. Modified the CFAA to cover any computer used in interstate commerce rather than just "federal interest" computer systems. 3. Allowed for the imprisonment of offenders, regardless of whether they actually intended to cause damage. 4. Provided legal authority for the victims of computer crime to pursue civil action to gain injunctive relief and compensation for damages.
3 Techniques to Protect Against SQL Injection
1. Perform Input Validation - limit the types of data a user provides in a form. 2. Limit Account Privileges - the database account used by the web server should have the smallest set of privileges possible. 3. Use Stored Procedures - to limit the application's ability to execute arbitrary code.
Penetration Testing Methodology
1. Planning 2. Reconnaissance 3. Scanning (also called enumerations) 4. Vulnerability Assessment 5. Exploitation 6. Reporting
7-Step Lifecycle for Incident Handling
1. Preparation 2. Detection (aka Identification) 3. Response (aka Containment) 4. Mitigation (aka Eradicaton) 5. Reporting 6. Recovery 7. Remediation 8. Lessons Learned (aka Post-Incident Activity, Post-Mortem, or Reporting
3 Integrity Issues Addressed by Biba
1. Prevent modification of objects by unauthorized subjects. 2. Prevent unauthorized modification of objects by authorized subjects. 3. Protect internal and external object consistency.
Developing a BCP/DRP Steps
1. Project initiation 2. Scope the project 3. Business impact assessment 4. Identify Preventive Controls 5. Recovery strategy 6. Plan design and development 7. Implementation, training and testing 8. BCP/DRP maintenance
(ISC)2 Code of Ethics Canons
1. Protect society, the commonwealth, and the infrastructure. 2. Act honorably, honestly, justly, responsibly, and legally. 3. Provide diligent and competent service to principals. 4. Advance and protect the profession.
Two Key Elements of the Common Criteria Process
1. Protection Profiles (PPs) - specify for a product that is to be evaluated (the TOE) the security requirements and protections (i.e., the security desires or the "I want" from a customer). 2. Security Targets (STs) - specify the claims of security from the vendor that are built into a TOE (i.e., the implemented security measures or the "I will provide" from the vendor). In addition to offering security targets, vendors may offer packages of additional security features. A "package" is an intermediate grouping of security requirement components that can be added or removed from a TOE.
5 Common Memory Addressing Schemes
1. Register Addressing 2. Immediate Addressing 3. Direct Addressing 4. Indirect Addressing 5. Base+Offset Addressing
Screen Scaper/Screen Scaping
1. Remote control, remote access, or Remote Desktop-like services. 2. A technology that can allow an automated tool to interact with a human interface in order to parse the results to extract just the relevant information.
Change Management Process (3 Basic Components)
1. Request Control Process - provides an organized framework within which users can request modifications, managers can conduct cost/benefit analysis, and developers can prioritize tasks. 2. Change Control Process - includes conforming to quality control restrictions, developing tools for update or change deployment, properly documenting any coded changes, and restricting the effects of new code to minimize diminishment of security. 3. Release Control Process - should include acceptance testing to ensure that any alterations to end-user tasks are understood and functional. *ensure that debugging code and/or back doors are removed before release to production
Stages of the Waterfall Model
1. System Requirements 2. Software Requirements 3. Preliminary Design 4. Detailed Design 5. Code and Debug 6. Testing 7. Operations and Maintenance
Differences Between TCSEC and ITSEC
1. TCSEC concentrates almost exclusively on confidentiality, ITSEC addresses concerns about the loss of integrity and availability in addition to confidentiality, thereby covering all 3 elements. 2. ITSEC does not rely on the notion of a TCB, and it doesn't require that a system's security components be isolated within a TCB. 3. Unlike TCSEC, which required any changed systems to be reevaluated anew, ITSEC includes coverage for maintaining targets of evaluation after such changes occur without requiring a new formal evaluation.
4 Primary Stages of Fire
1. The Incipient Stage - there is only air ionization but no smoke. 2. The Smoke Stage - smoke is visible from the point of ignition. 3. The Flame Stage - a flame can be seen with the naked eye. 4. The Heat Stage - the fire is considerable further down the timescale to the point where there is an intense heat buildup and everything in the area burns.
Kerberos - Accessing an Object
1. The client sends it TGT back to the KDC with a request for access 2. The KDC verifies that the TGT is valid and checks its access control 3. The KDC generates a service ticket and sends it to the client 4. The client sends the ticket to the server or service hosting the resource 5. The server or service hosting the resource verifies the validity of the ticket with the KDC 6. Once identity and authorization is verified, Kerberos activity is complete. The server host then opens a session with the client and begins communications or data transmission.
5 Basic Requirements for a Cryptographic Hash Function
1. The input can be of any length. 2. The output has a fixed length. 3. The hash function is relatively easy to compute for any input. 4. The hash function is one-way. 5. The hash function is collision free (meaning it is extremely hard to find two messages that produce the same hash value)
Benefits of Applets:
1. The processing burden is shifted to the client. 2. The client is able to produce data using local resources rather than waiting for a response from the server. 3. The web server does not receive any data provided to the applet as input, therefore maintaining the security and privacy of the user's financial data.
Steps for Receiving a Digitally Signed Message
1. The recipient decrypts the digital signature using the sender's public key. 2. The recipient uses the same hashing function to create a message digest of the full plaintext message received from the sender. 3. The recipient then compares the decrypted message digest he received from the sender with the message digest he computed himself. If the two digests match, he can assume that the message he received was sent by the sender. If they do not match, either the message was not sent by the sender or the message was modified while in transit.
Steps for Sending a Digitally Signing a Message
1. The sender generates a message digest of the original plaintext message using one of the cryptographically sound hashing algorithms, such as SHA-512. 2. The sender then encrypts only the message digest using her private key. This encrypted message is the digital signature. 3. The sender appends the signed message digest to the plaintext message. 4. The sender transmits the appended message to the recipient.
Kerberos - Logon Process
1. The user types a username and password into the client. 2. The client encrypts the username with AES for transmission to the KDC. 3. The KDC verifies the username against a database of known credentials. 4. The KDC generates a symmetric key that will be used by the client and the Kerberos server. It encrypts this with a hash of the user's password. The KDC also generates an encrypted time-stamped TGT. 5. The KDC then transmits the encrypted symmetric key and the encrypted time-stamped TGT to the client. 6. The client installs the TGT for use until it expires. The client also decrypts the symmetric key using a hash of the user's password.
Security Concerns of Applets
1. They allow a remote system to send code to the local system for execution. 2. Security administrators must take steps to ensure that code sent to systems on their network is safe and properly screened for malicious activity. 3. The end user can never be certain that the applet doesn't contain a Trojan horse component.
10 Commandments of Computer Ethics
1. Thou shalt not use a computer to harm other people. 2. Thou shalt not interfere with other people's computer work. 3. Thou shalt not snoop around in other people's computer files. 4. Thou shalt not use a computer to steal. 5. Thou shalt not use a computer to bear false witness. 6. Thou shalt not copy or use proprietary software for which you have not paid. 7. Thou shalt not use other people's computer resources w/o authorization or proper compensation. 8. Thou shalt not appropriate other people's intellectual output. 9. Thou shalt think about the social consequences of the program you are writing or system you are designing. 10. Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans.
2 Principles Used by the Clark-Wilson Model
1. Well-formed transactions 2. Separation of Duties
SSL Steps
1. When a user accesses a website, the browser retrieves the web server's certificate and extracts the server's public key from it. 2. The browser then creates a random symmetric key, uses the server's public key to encrypt it, and then sends the encrypted symmetric key to the server. 3. The server then decrypts the symmetric key using its own private key, and the two systems exchange all future messages using the symmetric encryption key.
Admissible Evidence
3 Basic Requirements: 1. The evidence must e relevant to determining a fact. 2. The fact that the evidence seeks to determine must be material to the case. 3. The evidence must be competent (must have been obtained legally).
Response Team Responsibilities
4 Primary Responsibilities: 1. Determine the amount and scope of damage caused by the incident. 2. Determine whether any confidential information was compromised during the incident. 3. Implement any necessary recovery procedures to restore security and recover from incident-related damages. 4. Supervise the implemenation of any additional security measures necessary to improve security and prevent recurrence of the incident.
7 Layers of the OSI Model
7 - Application 6 - Presentation 5 - Session 4 - Transport 3 - Network 2 - Data Link 1 - Physical "All People Seem To Need Data Processing"
Electronic Discovery Reference Model
9 Steps: 1. Information Governance 2. Identification 3. Preservation 4. Collection 5. Processing 6. Review 7. Analysis 8. Production 9. Presentation
Exception in the Bell LaPadula Model
A "trusted subject" is not constrained by the * Security Property. A trusted subject is defined as "a subject that is guaranteed not to consummate a security-breaching information transfer even if it is possible." This means that a trusted subject is allowed to violate the * Security Property and perform a write-down, which is necessary when performing valid object declassifications or reclassification.
LEAP (Lightweight Extensible Authentication Protocol)
A Cisco proprietary alternative to TKIP and WPA. It was developed to address deficiencies in TKIP before the 802.11/WPA2 system was ratified as a standard. This protocol should be avoided when possible.
Erasable Programmable Read-Only Memory (EPROM)
A Prom chip that has a small window through which the illumination of a special ultraviolet light causes the contents of the chip to be erased. After this process is complete, the end user can burn new information into it as if it had never been programmed.
Local Alarm System
A alarm system that must broadcast an audible (up to 120 decibels [db]) alarm signal that can be easily heard up to 400 feet away. Additionally, they must be protected from tampering and disablement, usually by security guards. For this alarm type to be effective, there must be a security team or guards positioned nearby who can respond when the alarm is triggered.
SQL Injection
A attack against vulnerable web applications where a hacker submits SQL database expressions and script code in order to bypass authentication and interact directly with the DBMS or underlying operating system.
Full Backup
A backup method that stores a complete copy of the data contained on the protected device. This backup duplicates every file on the system regardless of the setting of the archive bit. Once complete, the archive bit on every file is reset, turned off, or set to 0.
Implicit Deny
A basic principle of access control that most authorization mechanisms use. This principle ensures that access to an object is denied unless access has been explicitly granted to a subject.
Twofish
A block cipher that operates on 128-bit blocks of data and is capable of using cryptographis keys up to 256 bits in length. It uses two techniques not found in other algorithms: - Prewhitening: involves XORing the plain text with a separate subkey before the first round of encryption; - Postwhitening: uses a similar operation after the 16th round of encryption.
Blowfish
A block cipher that operates on 64-bit blocks of text and uses variable length keys ranging from a relatively insecure 32 bits to an extremely strong 448 bits. It is a much faster algorithm than IDEA and DES.
International Data Encryption Algorithm (IDEA)
A block cipher that was developed in response to complaints about the insufficient key length of the DES algorithm. It operates on 64-bit blocks of plain/cipher text, but it begins it operations with a 128-bit key. This key is broken up in a series of operations into 52 16-bit subkeys. This algorithm is capable of operating in the same 5 modes used by DES.
Coaxial Cable
A cable with a center core of copper wire surrounded by a layer of insulation and then by a conductive braided shielding and finally encased in an insulation sheath. It is fairly resistant to EMI, had a low cost, and is easy to install.
Fiber-Optic Cable
A cabling form that transmits light instead of electrical signals. Supports throughputs up to 2Gbps and lengths of up to 2 kilometers. Advantages: extremely fast and nearly impervious to tapping and interference. Disadvantages: it is difficult to install and expensive.
Asynchronous Transfer Mode (ATM)
A cell-switching technology rather than a packet-switching technology like Frame Relay. ATM uses virtual circuits much like Frame Relay, but because it uses fixed-size frames or cells, it can guarantee throughput. This makes it an excellent WAN technology for voice and videoconferencing.
Covert Timing Channel
A channel that conveys information by altering the performance of a system component or modifying a resource's timing in a predictable manner.
Covert Storage Channel
A channel that conveys information by writing data to a common storage area where another process can read it.
Block Ciphers
A cipher that applies the encryption algorithm to an entire message block at the same time. Example: transposition ciphers
Shimming
A class of lock mechanism attack (i.e., picking the lock).
Platform-as-a-Service (PaaS)
A cloud computing concept that provides all the aspects of a platform (the operating system and complete solution package). The primary attraction of this concept is the avoidance of having to purchase and maintain high-end hardware and software locally.
Infrastructure-as-a-Service
A cloud computing concept that provides not just on-demand operating solutions but complete outsourcing of IT infrastructure.
Software-as-a-Service (SaaS)
A cloud computing concept that provides on-demand online access to specific software applications or suites without the need for local installation.
Payment Card Industry-Data Security Standard (PCI-DSS)
A collection of requirements for improving the security of electronic payment transactions. This standard defines requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.
Content-Distribution Networks (CDN) or Content Delivery Networks
A collection of resource services deployed in numerous data centers across the Internet in order to provide low-latency, high performance, high-availability of the hosted content. They provide the desired multimedia performance quality demanded by customers through the concept of distributed data hosts.
Preaction System
A combination dry pipe/wet pipe system. The system exists as a dry pipe until the initial stages of a fire (smoke, heat, and so on) are detected, and then the pipes are filled with water. The water is released only after the sprinkler head activation triggers are melted by sufficient heat. If the fire is quenched before sprinklers are triggered, pipes can be manually emptied and reset. This allows manual intervention to stop the release of water before sprinkler triggering occurs. This is the most appropriate water-based system for environments that house both computers and humans together.
Ethernet
A common shared media LAN technology (also known as broadcast technology). It employs broadcast and collision domains and can support full-duplex communications and usually employs twisted-pair cabling. It is most often deployed on star or bus topologies. Based on the IEEE 802.3 standard.
Lighting
A commonly used form of perimeter security control. The primary purpose is to discourage casual intruders, trespassers, prowlers, or would-be thieves who would rather perform their misdeeds in the dark. However, this is not a strong deterrent.
IEEE 802.1x
A commonly used security standard that provides a flexible framework for authentication and key management in wired and wireless networks.
Modem
A communication device that covers or modulates between an analog carrier signal and digital information in order to support computer communications of PSTN (public switched telephone network) lines.
Broadband
A communication medium that supports multiple communication signals simultaneously. It is a form of analog signal.
Baseband
A communication medium that supports only a single communication signal at a time.
Baseband
A communication medium that supports only a single communication signal at a time. Most networking cables are of this type.
Broadcast
A communications transmission to multiple but unidentified recipients.
Blackout
A complete loss of power.
Parallel Data Systems/Parallel Computing
A computation system design to perform numerous calculations simultaneously.
Fuzzy Logic
A computational technique designed to more closely approximate human thought patterns than the rigid mathematics of set theory or algebraic approaches that utilize "black-and-white" categorization of data. This technique has 4 phases: 1 - Fuzzification 2 - Inference 3 - Composition 4 - Defuzzification
Zero-Knowledge Proof
A concept of communication whereby a specific type of information is exchanged but no real data is exchanged. Good examples of this idea are digital signatures and digital certificates.
Cloud Computing
A concept of computing where processing and storage are performed elsewhere over a network connection rather than locally.
Network Access Control (NAC)
A concept of controlling access to an environment through strict adherence to and enforcement of a security policy. The goals are to prevent/reduce zero-day attacks, enforce security policy compliance throughout the network, and use identities to perform access control. It acts as an automated detection and response system that can react in real time to stop threats as they occur and before they cause damage or a breach.
Isolation
A concept that ensures that any behavior will affect only the memory and resources associated with the process.
Bell-LaPadula Model
A confidentiality-focused security model based on the state machine model and employing mandatory access controls and the lattice model. By design, this model prevents the leaking or transfer of classified information to less secure clearance levels. This is accomplished by blocking lower-classified subjects from accessing higher-classified objects. Focus of this model is on confidentiality.
Hot Site
A configuration in which a backup facility is maintained in constant working order, with a full complement of servers, workstations, and communications links ready to assume primary operations responsibilities.
Shared Key Authentication (SKA)
A connection scheme for wireless networks that requires that some form of authentication must take place before network communications can occur. The 802.11 standard defines one optional technique for this scheme known as WEP.
Open System Authentication (OSA)
A connection scheme for wireless networks where no real authentication is required; as long as radio signal can be transmitted between the client and WAP, communications are allowed.
Switched Multimegabit Data Service (SMDS)
A connectionless network communication service that provides bandwidth on demand. It is a preferred connection mechanism for linking remote LANs that communicate infrequently.
Gate
A controlled exit and entry point in a fence. Hinges and locking/closing mechanisms should be hardened against tampering, destruction, or removal. Keep the number of them to a minimum.
Memory Protection
A core security component that must be designed and implemented into an operating system that is used to prevent an active process from interacting with an area of memory that was not specifically assigned or allocated to it.
Frequency Analysis and the Ciphertext Only Attack
A cryptographic analysis or attack that looks for repetition of letters in an encrypted message and compares that with the statistics of letter usage for a specific language, such as the frequency of the letters E, T, A, O, N, R, I, S, and H in the English language.
Key Escrow
A cryptographic recovery mechanism by which keys are stored in a database and can be recovered only by authorized key escrow agents in the event of key loss or damage.
Kerchoff Principle
A cryptographic system should be secure even if everything about the system, except the key, is public knowledge. The principle can be summed up as "The enemy knows the system."
Polyalphabetic Substitution
A cryptographic transformation that encrypts a message using letter-by-letter conversion and multiple alphabets from different languages or countries. Example: Vigenere cipher
Trusted Platform Module
A cryptoprocessor chip on a main board used to store and process cryptographic keys for the purpose of a hardware supported/implemented hard drive encryption system.
Trusted Platform Module (TPM)
A cryptoprocessor chip on a mainboard used to store and process cryptographic keys for the purposes of a hardware supported/implemented hard drive encryption system.
Circuit Switching
A dedicated physical pathway is created between the two communication parties. Once a call is established, the links between the two parties remain the same throughout the conversation. It employs "permanent", physical connections. This provides for the following: - fixed or known transmission times; - a uniform level of quality; and - little or no loss of signal or communication interruptions.
Black Boxes
A device used to manipulate line voltages to steal long-distance services.
Blue Boxes
A device used to simulate 2600 Hz tones to interact directly with telephone trunk systems (that is, backbones).
Application Firewalls
A device, server add-on, virtual service, or system filter that defines a strict set of communications rules for a service and all users.
Mantrap
A double set of doors that is often protected by a guard or some other physical layout that prevents piggybacking and can trap individuals as the discretion of security personnel. The purpose is to immobilize a subject until their identity and authentication is verified. If a subject is not authorized, both doors remain closed and locked until an escort (typically a guard or police officer) arrives to escort the subject off the property or arrest the subject for trespassing (delay feature). Prevents piggybacking or tailgating.
Deluge System
A dry pipe system that uses larger pipes and therefore delivers a significantly larger volume of water. This type of system is inappropriate for environments that contain electronics and computers.
Escrowed Encryption Standard
A failed government attempt to create a backdoor to all encryption solutions. The solution employed the Clipper chip, which used the Skipjack algorithm.
Fair Cryptosystems
A failed government attempt to create a backdoor to all encryption solutions. This technology used a segmented key that was divided among several trustees.
Automatic Private IP Addressing (APIPA)
A feature of Windows that assigns an IP address to a system should DHCP address assignment fail. - The IP address range used is 169.254.0.0 - 169.254.255.255. - This allows the system to communicate with other similarly configured clients within the same broadcast domain but not with any systems across a router with a correctly assigned IP address.
Nonrepudiation
A feature of security control or an application that prevents the sender of a message or the subject of an activity or event from denying that the event occurred.
Bastion Host/Screened Host
A firewall system logically positioned between a private network and an untrustworthy network. It is responsible for filtering traffic coming into the private network as well as for protecting the identity of the internal client.
Static Packet Filtering Firewalls
A firewall that filters traffic by examining data from a message header. Usually the rules are concerned with source, destination, and port addresses. These firewall are known as first-generation firewalls; they operate at the Network layer (layer 3) of the OSI model. They can also be called screening routers or common routers.
Turnstile
A form of a gate that prevents more than one person at a time from gaining entry and often restricts movement in one direction. It is used to gain entry but not exit, or vice versa. It is basically the fencing equivalent of a revolving door.
Industrial Control Systems (ICS)
A form of computer-management device that controls industrial processes and machines. They are used across a wide range of industries, including manufacturing, fabrication, electricity generation and distribution, water distribution, sewage processing, and oil refining. There are several forms, including distributed control systems (DCS), programmable logic controllers (PLC), and supervisory control and data acquisition (SCADA).
Assymetric Key Algorithms
A form of cryptography that does not use symmetric keys. It either uses complex formulas to solve problems (such as Diffie-Hellman to generate/exchange symmetric keys) or uses key pair sets to provide digital signatures and digital envelopes. This latter form is also known as public key cryptography.
Distributed Data Model
A form of database in which data is stored in more than one database but remains logically connected. The user perceives the database as a single entity, even though it consists of numerous parts interconnected over a network. Each field may have numerous children as well as numerous parents. Thus, the data mapping relationship is many-to-many.
Hierarchical Data Model
A form of database that combines records and fields that are related in a logical tree structure. This is done so that each field can have one child or many or no children, but each field can have only a single parent. Therefore, the data mapping relationship is one-to-many.
Wired Equivalent Privacy (WEP)
A form of encrypted authentication that employs RC4. It supports only one-way authentication from client to WAP. It is considered insufficient for security because of several deficiencies in its design and implementation. Provides 64- and 128-bit encryption. Described as IEEE 802.11 as an optional component of the wireless networking standard.
Wired Equivalent Privacy (WEP)
A form of encrypted authentication that employs RC4. It supports only one-way authentication from client to WAP. It is considered insufficient for security because of several deficiencies in its designs and implementation. It offers no real protection and may lead to a false sense of security.
Proxy
A form of gateway that does not translate across protocols. It performs a function or requests a service on behalf of another system and connects network segments that use the same protocol. They are most often used in the context of providing clients on a private network with Internet access while protecting the identity of the clients.
Grid Computing
A form of parallel distributed processing that loosely groups a significant number of processing nodes toward the completion of a specific processing goal. Grid projects will not likely be able to maintain secrecy and are not appropriate for private, confidential, or proprietary data. This processing often uses a central primary core of servers to manage the project, track work packets, and integrate returned work segments.
802.1x
A form of wireless authentication protection that requires all wireless clients to pass a gauntlet of RADIUS or TACACS services before network access is granted.
Site Survey
A formal assessment of wireless signal strength, quality, and interference using a RF signal detector.
Extensible Authentication Protocol (EAP)
A framework for authentication instead of an actual protocol. - It allows customized authentication security solutions, such as supporting smart cards, token, and biometrics.
Point-to-Point Protocol (PPP)
A full-duplex protocol used for the transmission of TCP/IP packets over various non-LAN connections, such as modems, ISDN, VPNs, Frame Relay, and so on. It is widely supported and is the transport protocol of choice for dial-up Internet connections. -It is a replacement for SLIP and can support any LAN protocol, not just TCP/IP.
Exclusive OR (XOR)
A function that returns a true value when only one of the input values is true. If both values are false or both values are true, the output of the XOR function is false.
Wireless Application Protocol (WAP)
A functioning industry-driven protocol stack that allows users through their WAP-capable devices, such as mobile phones, to communicate over a carrier's network with the Internet.
Wireless Application Protocol (WAP)
A functioning industry-driven protocol stack that allows users through their ___-capable devices, such as mobile phones, to communicate over a carrier's network with the Internet. It is a suite of protocols working together. One of these protocols is Wireless Transport Layer Security (WTLS), which provides security connectivity services similar to those of SSL and TLS. Few phones still use this protocol stack today.
WPA2
A further improvement to WPA which adds AES cryptography. It provides secure algorithms appropriate for use on modern wireless networks.
Broadcast Domain
A group of networked systems in which all other members receive a broadcast signal when one of the members of the group transmits it. These domains are divided by using any layer 3 or higher device.
Collision Domain
A group of networked systems that could cause a collision if any two (or more) of the systems in that group transmitted simultaneously. These domains are divided by using any layer 2 or higher device.
Network Firewall
A hardware device, typically called an appliance, designed for general network filtering.
Fiber Distributed Data Interface (FDDI)
A high-speed token-passing technology that employs two rings with traffic flowing in opposite directions. It's often used as a backbone for large enterprise networks. It's dual-ring design allows for self-healing by removing the failed segment from the loop and creating a single loop out of the remaining inner and outer ring portions. Disadvantage: expensive.
Diffie-Hellman
A key exchange algorithm useful in situations in which two parties might need to communicate with each other but they have no physical means to exchange key material and there is no public key infrastructure in place to facilitate the exchange of secret keys.
High Speed Serial Interface (HSSI)
A layer 1 protocol used to connect routers and multiplexers to ATM or Frame Relay connection devices.
Synchronous Data Link Control (SDLC)
A layer 2 protocol employed by networks with dedicated or leased lines. It was developed by IBM for remote communications with SNA systems. It uses polling and is a bit-oriented synchronous protocol.
High-Level Data Link Control (HDLC)
A layer 2 protocol used to transmit data over synchronous communication lines. It is an ISO standard based on IBM's SDLC. It supports full-duplex communications, supports both point-to-point and multipoint connections, offers flow control, and includes error detection and correction.
Software IP Encryption (swIPe)
A layer 3 protocol for IP. It provides authentication, integrity, and confidentiality using an encapsulation protocol.
Defense-in-Depth
A layered approach to security. Multiple layers of security are implemented, requiring attackers to circumvent several security controls to be successful.
Registers
A limited amount of onboard memory in a CPU that provide it with directly accessible memory locations that the brain of the CPU, the arithmetic-logical unit (ALU), uses when performing calculations or processing instructions.
MAC Filter
A list of authorized client interface MAC addresses that is used by a wireless access point to block access to all non-authorized devices.
VLAN
A logical network segmentation implemented on switches and bridges to manage traffic. Multiple _______s can be hosted on the same switch but are isolated as if they are separate physical networks. Only through a routing function, often provided by a multilayer switch, can cross-________ communications occur.
Virtual LAN (VLAN)
A logical network segmentation implemented on switches and bridges to manage traffic. They function like physical network segments. They are used to allow what is necessary, but block/deny anything that is not necessary.
One-Way Function
A mathematical operation that easily produces output values for each possible combination of inputs but makes it impossible to retrieve the input values.
Spread Spectrum
A means or method of communication that occurs over multiple frequencies at the same time.
DomainKeys Identified Mail (DKIM)
A means to assert that valid mail is sent by an organization through verification of domain name authority.
Frequency
A measurement of the number of wave oscillations within a specific time identified using the Hertz (Hz), or oscillations per second. Radio waves are between 3 Hz and 300 Hz.
Network Address Translation (NAT)
A mechanism for converting the internal private IP addresses found in packet headers into public IP addresses for transmission over the Internet.
Revocation
A mechanism that allows a PKI certificate to be cancelled, effectively removing a user from the system.
Direct Memory Access (DMA)
A mechanism that allows devices to exchange data directly with real memory (RAM) without requiring assistance from the CPU.
Interrupt (IRQ)
A mechanism used by devices and components in a computer to get the attention of the CPU.
Discretionary Access Controls (DAC)
A mechanism used to control access to objects. The owner or creator of an object controls and defines the access other subjects have to it. This access control list serves as a dynamic access rule set that the subject can modify.
Cipher text
A message that has been encrypted for transmission.
Digital Signature
A method for ensuring a recipient that a message truly came from the claimed sender and that the message was not altered while in transit between the sender and recipient. - These algorithms rely on a combination of public-key cryptography and hashing functions.
Object-Oriented Programming (OOP)
A method of programming that uses encapsulated code sets called objects. It is best suited for eliminating error propagation and mimicking or modeling the real world. From a security standpoint, this programming provides a black-box approach to abstraction. Users need to know the details of an object's interface, but won't necessarily need to know the inner workings of the object to use it effectively.
Warm Site
A middle ground between hot sites and cold sites for disaster ecovery specialists. This type of facility always contains the equipment and data circuits necessary to rapidly establish operations but does not typically contain copies of the client's data.
Cipher Feedback (CFB) Mode
A mode in which the DES algorithm is used to encrypt the preceding block of cipher text. This block is then XORed with the next block of plain text to produce the next block of cipher text.
Output Feedback (OFB) Mode
A mode in which the Data Encryption Standard XORs plain text with a seed value. For the first encrypted block, an initialization vector is used to create the seed value. Future seed values are derived by running the DES algorithm on the preceding seed value. The major advantage of OFB mode is that transmission errors do not propagate to affect the decryption of future blocks.
Transport Mode
A mode of IPSec when used in a VPN; the IP packet data is encrypted but the header of the packet is not.
Counter (CTR) Mode
A mode that uses a stream cipher. It uses a simple counter that increments for each operation. This mode allows you to break an encryption or decryption operation into multiple independent steps. This makes it well suited for use in parallel computing.
Noninterference Model
A model based loosely on the information flow model. This model is concerned with the actions of one subject at a higher security level affecting the system state or actions of another subject at a lower security level. This model can be imposed to provide a form of protection against damage caused by malicious programs such as Trojan horses..
Take-Grant Model
A model that employs a directed graph to dictate how rights can be passed from one subject to another or from a subject to an object. - Take Rule: Allows a subject to take rights over an object. - Grant Rule: Allows a subject to grant rights to an object. - Create Rule: Allows a subject to create new rights. - Remove Rule: Allows a subject to remove rights it has. The key to model is that using these rules allows you to figure out when rights in a system can change and where leakage can occur.
Clark-Wilson Model
A model that employs limited interfaces or programs to control and maintain object integrity. Designed for the commercial environment, this model defines each data item and allows modifications through only a small set of programs. It does not require the use of a lattice model; rather, it uses a three-part relationship of subject/program/object (or subject/transaction/object) known as a triple or access control triple. Subjects do not have direct access to objects. Objects can only be access through programs.
Information Flow Model
A model that focuses on the flow of information to ensure that security is maintained and enforced no matter how information flows. These models are based on a state machine model. Examples: Bell LaPadula model and Biba model. These models are designed to prevent unauthorized, insecure, or restricted information flow, often between different levels of security (often referred to as multilevel models). This flow can be between subjects and objects at the same classification level as well as between subjects and objects at different classification levels. This model also addresses covert channels by specifically excluding all nondefined flow pathways.
Restricted Interface Model
A model that uses classification-based restrictions to offer only subject-specific authorized information and functions. One subject at one classification level will see one set of data and have access to one set of functions whereas another subject at a different classification level will see a different set of data and have access to a different set of functions.
Fault
A momentary loads of power.
Passive Audio Motion Detector
A motion detector that listens for abnormal sounds in the monitored area.
Infrared Motion Detector
A motion detector that monitors for significant or meaningful changes in the infrared lighting pattern of a monitored area.
Heat-Based Motion Detector
A motion detector that onitors for significant or meaningful changes in the heat levels and patterns in a monitored area.
Capacitance Motion Detector
A motion detector that senses changes in the electrical or magnetic field surrounding a monitored object.
Photoelectric Motion Detector
A motion detector that senses changes in the visible light levels for the monitored area. They are usually deployed in internal rooms that have no windows and are kept dark.
Wave Pattern Motion Detector
A motion detector that transmits a consistent low ultrasonic or high microwave frequency signal into a monitored area and monitors for significant or meaningful changes or disturbances in the reflected pattern.
Virtual Private Network (VPN)
A network connection established between two systems over an existing private or public network. It provides confidentiality and integrity for network traffic through the use of encryption.
Brouters
A network device that first attempts to route and then defaults to bridging if routing fails. It operates primarily at OSI layer 3 but can operate at layer 2 when necessary.
Switch
A network device that is an intelligent hub because it knows the addresses of the systems connected on each outbound port. Instead of repeating traffic on every outbound port, this device repeats only traffic of the port on which the destination is known to exist. They offer greater efficiency for traffic delivery, create separate broadcast and collision domains, and improve the overall throughput of data. They operate primarily at OSI layer 2; when. They have additional features, such as routing, they can operate at OSI layer 3.
Repeaters, Concentrators and Amplifiers
A network device used to amplify signals on network cabling to allow for longer distances between nodes. Operate at OSI layer 1.
Hubs
A network device used to connect multiple systems together in a star topology. These devices repeat inbound traffic over all outbound ports. Operate at OSI layer 1.
Bridge
A network device used to connect networks with different speeds, cable types, or topologies that still use the same protocol. It is a layer 2 device.
Router
A network device used to control traffic flow on networks. Routers are often used to connect similar networks together and control traffic flow between them. They can function using statistically defined routing tables or employ a dynamic routing system.They operate at OSI layer 3.
Firewall
A network device used to filter traffic. It is typically deployed between a private network and a link to the Internet, but it can be deployed between departments within an organization. They filter traffic based on a defined set of rules.
Voice over Internet Protocol (VoIP)
A network service that provides voice communication services by transporting the voice traffic as network packets over an IP network.
Voice over IP (VoIP)
A network service that provides voice communications services by transporting the voice traffic as network packets over an IP network.
Internet Small Computer System Interface (iSCSI)
A networking storage standard based on IP. This technology can be used to enable location-independent file storage, transmission, and retrieval over LAN, WAN, or public Internet connections. It is often viewed as a low cost alternative to Fibre Channel.
Service Provisioning Markup Language (SPML)
A newer framework based on XML but specifically designed for exchanging user information for federated identity single sign-on purposes. It is based on the Directory Service Markup Language (DSML), which can display LDAP-based directory service information in an XML format.
Initialization Vector (IV)
A nonce used by numerous cryptography solutions to increase the strength of encrypted data by increasing the randomness of the input.
Open Web Application Security Project (OWASP)
A nonprofit security project focusing on improving security for online or web-based applications.
Aggregation
A number of functions that combine records from one or more tables to produce potentially useful information.
Object
A passive entity that provides information or data to subjects. An object can be a file, a database, a computer, a program, a process, a file, a printer, a storage media, and so on.
Fence
A perimeter-defining device. Various types are effective against different types of intruders: - 3 to 4 feet high deter casual trespassers. - 6 to 7 feet high are too hard to climb easily and deter most intruders, except determined ones. - 8 or more feet high with three strands of barbed-wire deter even determined intruders.
Occupant Emergency Plans (OEP)
A plan that provides guidance on how to minimize threats to life, prevent injury, manage duress, handle travel, provide for safety monitoring, and protect property from damage in the event of a destructive physical event. This plan does not address IT issues or business continuity and recovery issues.
Java Applets
A platform-independent programming language developed by Sun Microsystems.
Layer 2 Tunneling Protocol (L2TP)
A point-to-point tunnel protocol developed by combining elements from PPTP and L2F. It lacks a built-in encryption scheme but typically relies on IPSec as its security mechanism. It supports TACACS+ and RADIUS.
Reference Monitor
A portion of the security kernel that validates user requests against the system's access control mechanisms. Effectively, it is the access control enforcer for the TCB.
Foreign Key
A primary key from another table used to cross-link or express relationships between the contents of two tables.
System Call
A process by which an object in a less-trusted protection ring requests access to resources or functionality by objects in more trusted protection rings.
Direct Addressing
A process by which the CPU is provided with the actual address of the memory location to be accessed.
Cipher Block Chaining (CBC) Mode
A process in which each block of unencrypted test is XORed with the next block of cipher text immediately preceding it before it is encrypted using the DES algorithm.
Multithreading
A process that allows multiple users to use the same process without interfering with each other. Example: when multiple documents are opened at the same time in a word processing program.
Cache RAM
A process that takes data from slower devices and temporarily stores it in higher-performance devices when its repeated use is expected.
Misuse Case Testing
A process used by software testers to evaluate the vulnerability of their software to known risks. Testers first enumerate the known misuse cases and then attempt to exploit those use cases with manual and/or automated attack techniques. Aka: Abuse Case Testing
Simple Security Property (SS Property)
A property of the Bell LaPadula Model that states that a subject at a specific classification level cannot read data with a higher sensitivity level ("no read up").
Discretionary Security Property
A property of the Bell LaPadula Model that states that the system uses an access control matrix to enforce discretionary access control.
Layer 2 Forwarding Protocol (L2F)
A protocol developed by Cisco as a mutual authentication tunneling mechanism. It does not offer encryption.
Internet Security Association and Key Management Protocol (ISAKMP)
A protocol that provides background security support services for IPSec by negotiating, establishing, modifying, and deleting security associations.
Address Resolution Protocol (ARP)
A protocol used to reolve IP addresses into MAC addresses
Reverse Address Resolution Protocol (RARP)
A protocol used to resolve MAC addresses into IP addresses
Secure Multipurpose Internet Mail Extensions (S/MIME)
A protocol used to secure the transmission of email and attachments. - It offers authentication and confidentiality to email through public key encryption and digital signatures. - Authentication is provided through X.509 certificates. - Privacy is provided through the use of Public Key Cryptography Standard (PKCS) encryption.
S/MIME (Secure Multipurpose Internet Mail Extensions)
A protocol used to secure the transmission of email and attachments. It uses the RSA encryption algorithm and has received the backing of major industry players, including RSA Security. It is included in a large number of commercial products: - Microsoft Outlook and Outlook Web Access - Mozilla Thunderbird - Mac OS X Mail It relies on the use of X.509 certificates for exchanging cryptographic keys. RSA is the only public key cryptographic protocol supported by S/MIME. The protocol supports the AES and 3DERS symmetric encryption algorithm.
Internet Message Access Protocol (IMAP)
A protocol used to transfer email messages from an email server to an email client.
Post Office Protocol version 3 (POP3)
A protocol used to transfer email messages from an email server to an email client.
Pretty Good Privacy (PGP)
A public-private key system that uses a variety of encryption algorithms to encrypt files and email messages. - It is not a standard but rather an independently developed product that has wide Internet grassroots support.
Pretty Good Privacy (PGP)
A public/private key system that uses the IDEA algorithm to encrypt files and email messages. It is not a standard but rather an independently developed product that has wide Internet grassroots support. Available in 2 versions: 1 - The Commercial version uses RSA for key exchange, IDEA for encryption/decryption, and MD5 for message digest production. 2 - The freeware version uses Diffie-Hellman key exchange, the Carlisle Adams/Stanford Tavares (CAST) 128-bit encryption/decryption algorithm, and the SHA-1 hashing function.
Cryptographic Salt
A random number appended to a password before hashing to increase randomness and ensure uniqueness in the resulting stored hash value. This dramatically increases the difficulty of brute-force attacks.
Nonce
A random number that acts as a placeholder variable in mathematic functions. It must be a unique number each time it is used.
Registration Authorities (RA)
A read-only version of a certificate authority that is able to distribute the CRL and perform certificate verification processes but is not able to create new certificates. An RA is used to share the workload of a CA.
Permanent Virtual Circuit (PVC)
A redefined virtual circuit that is always available. It is like a dedicated leased line; the logical circuit always exists and is waiting for the customer to send data. It is like a two-way radio or walkie-talkie (whenever communication is needed, you press the button and start talking; the radio reopens the predefined frequency automatically).
LAN Extenders
A remote access, multilayer switch used to connect distant networks over WAN links. This is a strange beast of a device in that it creates WANs, but marketers of this device steer clear of the term WAN. The idea behind this device was to make the terminology easier to understand and thus make the device easier to sell than a more conventional WAN device grounded in complex concepts and terms.
Trusted System
A secured computer system. A system in which all protection mechanisms work together to process sensitive data for many types of users while maintaining a stable and secure computing environment.
Protection Rings
A security design that organizes code and components in an operating system (as well as applications, utilities, or other code that runs under the operating system's control) into concentric rings, each having increasing or decreasing levels of capabilities and access,
Compartmented Mode
A security mode in which systems process two or more types of compartmented information. Three requirements: 1. Valid security clearance that permits access to all information processed by the system. 2. Access approval for any information they will have access to on the system. 3. Valid need to know for all information they will have access to on the system.
Brewer and Nash Model (Chinese Wall)
A security model designed to permit access controls to change dynamically based on a user's previous activity (making it a kind of state machine model as well. This model applies to a single integrated database; it seeks to create security domains that are sensitive to the notion of conflict of interest. It is also know as the Chinese Wall because it creates a class of data that defines which security domains are potentially in conflict and prevents any subject with access to one domain that belongs to a specific conflict class from accessing any other domain that belongs to the same conflict class. Metaphorically, this puts a wall around all other information in an conflict class.
Graham-Denning Model
A security model focused on the secure creation and deletion of both subjects and objects. It is a collection of 8 primary protection rules or actions that define the boundaries of certain secure actions: - Securely create an object. - Securely create a subject. - Securely delete an object. - Securely delete a subject. - Securely provide the read access right. - Securely provide the grant access right. - Securely provide the delete access right. - Securely provide the transfer access right.
Examples of Compensation Access Controls
A security policy might dictate the use of smart cards by all employees but it takes a long time for new employees to get a smart card. The organization could issue hardware tokens to employees as this type of control. These tokens provide stronger authentication than just a username and password.
Secure Electronic Transaction (SET)
A security protocol for transmissions of transactions over the Internet. It is based on RSA encryption and DES. It has the support of major credit card companies, such as Visa and MasterCard. However, it has been abandoned in light of newer and more secure alternatives.
Authenticated Scan
A security scanner is granted authenticated read-only access to the server being scanned (typically via a user account) and can use this access to read configuration information from the target system and use that information when analyzing vulnerability testing results.
Alarm
A separate mechanism that triggers: - a deterrent; - a repellent; and/or - a notification.
Security Token
A separate object that is associated with a resource and describes its security attributes.
Remote Authentication Dial-In User Service (RADIUS)
A service used to centralize the authentication of remote dial-up connections.
Frame Relay
A shared connection medium that uses packet-switching technology to establish virtual circuits for customers. Requires the use of a DTE/DCE at each connection point.
Transient
A short duration of line noise disturbance.
Caesar Cipher
A simple three-position shifting monoalphabetic substitution cipher employed by Julius Caesar
Time Slice
A single chunk or division of processing time.
State
A snapshot of a system at a specific instance in time.
Open Source
A solution where the source code and other internal logic is exposed to the public.
Closed Source
A solution where the source code and other internal logic is hidden from the public.
Faraday Cage
A special enclosure that acts as an electromagnetic (EM) capacitor. When this device is used, no EM signals can enter or leave the enclosed area.
Virtual memory
A special type of secondary Emory that is managed by the operating system in such a manner that it appears to be real memory.
Fuzz Testing
A specialized dynamic testing technique that provides many different types of input to software to stress its limits and find previously undetected flaws. Testing software supplies invalid input to the software, either randomly generated or specially crafted to trigger known software vulnerabilities. The tester then monitors the performance of the application, watching for software crashes, buffer overflows, or other undesirable and/or unpredictable outcomes.
Primary Key
A specific key from the set of candidate keys that is used as the main differentiator between records. Every record must have a unique value in this key field.
Phreaking
A specific type of attack directed toward the telephone systems
IPSec (Internet Protocol Security standard)
A standard architecture set forth by the Internet Engineering Task Force (IETF) for setting up a secure channel to exchange information between two entities (two systems, two routers, two gateways, or any combination of entities). It uses public key cryptography to provide encryption, access control, nonrepudiation, and message authentication, all using IP-based protocols. The primary use is for virtual private networks (VPNs), so it can operate in either transport or tunnel mode. Commonly paired with L2TP.
Data Encryption Standard (DES)
A standard cryptosystem proposed in 1977 for all government communications. - It is a 64-bit block cipher that has 5 modes of operation. - ___ and 3___ were superseded by Advanced Encryption Standard (AES) in December 2001.
Triple DES (3DES)
A standard that uses three iterations of DES with two or three different keys to increase the effective key strength to 112 bits.
Password Authentication Protocol (PAP)
A standardized authentication protocol for PPP. - It transmits usernames and passwords in the clear. - It offers no form of encryption; it simply provides a means to transport the logon credentials from the client to the authentication server.
IP Security Protocol (IPSec)
A standards-based mechanism for providing encryption for point-to-point TCP/IP traffic. It is the most commonly used VPN protocol.It provides for secured authentication as well as encrypted data transmissions. Two primary components: - Authentication Header (AH) - Encapsulating Security Payload (ESP)
Integrity
A state characterized by the assurance that modifications are not made by unauthorized users and authorized users do not make unauthorized modifications.
Noise
A steady interfering power disturbance.
Volatile Storage
A storage medium, such as RAM, that loses its contents when power is removed from the resource.
Volatile Storage
A storage medium, such as RAM, that loses its contents when power is removed from the source.
Electronic Vaulting
A storage scenario in which database backups are transferred to a remote site in a bulk transfer fashion. The remote location may be a dedicated alternative recovery site (such as a hot site) or simply an offsite location managed within the company or by a contractor for the purpose of maintaining backup data.
Nonvolatile Storage
A storage system that does not depend on the presence of power to maintain its contents, such as magnetic/optical media and nonvolatile RAM (NVRAM).
Electrically Erasable Programmable Read-Only Memory (EEPROM)
A storage system that uses electric voltages delivered to the pins of the chip to force erasure. These chips can be erased without removal from the computer, giving them much greater flexibility than standard PROM and EPROM.
Screened Subnet
A subnet is placed between two routers and the bastion host(s) is located within that subnet. All inbound traffic s directed to the bastion host, and only traffic proxies by the bastion host can past through the second router into the private network. This is the concept of a DMZ.
Candidate Key
A subset of attributes that can used to uniquely identify any record in a table.
Keys
A subset of fields of a table that are used to uniquely identify records. They are also used to join tables when you wish to cross-reference information. 3 Types: - Candidate - Primary - Foreign
Message Digest (MD)
A summary of a message's content (not unlike a file checksum) produced by a hashing algorithm.
Rivest Cipher 5 (RC5)
A symmetric algorithm patented by Rivest, Shamir, and Adleman (RSA) Data Security, the people who developed RSA asymmetric encryption. It is a block cipher of variable block sizes (32, 64, or 128 bits) that uses key sizes between 0 (zero) length and 2,040 bits.
Multitasking
A system handling two or more tasks simultaneously.
Multilevel Mode
A system that is authorized to process information at more than one level of security even when all system users do not have appropriate clearances or a need to know for all information processed by the system. Three requirements: - Access is controlled by whether the subject's clearance level dominates the object's sensitivity label. - Access approval for all information they will have access to on the system. - Valid need to know for all information they will have access to on the system. * This mode is exposed to the highest level of risk.
State Machine Model
A system that is designed so that no matter what function is performed, it is always a secure system. If all aspects of a state meet the requirements of the security policy, the state is considered secure.
Closed System
A system that is designed to work well with a narrow range of other systems, generally all from the same manufacturer. The standards for these systems are often proprietary and not normally disclosed.
Open System
A system that is designed using agreed-upon industry standards. These systems are much easier to integrate with systems from different manufacturers that support the same standards.
Next-Generation Intrusion Detection Expert System (NIDES)
A system that provides an inference engine and knowledge base that draws information from a variety of audit logs across a network and provides notification to security administrators when the activity of an individual user varies from the user's standard usage profile.
Critical Path Analysis
A systematic effort to identify relationships between mission-critical applications, processes, and operations and all of the necessary supporting elements.
Access Control Matrix
A table of subjects and objects that indicates the actions or functions that each subject can perform on each object. Each column of the matrix is an ACL. Each row of the matrix is a capability list.
Data Mining
A technique or tool that allows analysts to comb through data warehouses and look for potential correlated information amid the historical data.
Hardware Segmentation
A technique that implements process isolation at the hardware level by enforcing memory access constraints.
Memory-Mapped I/O
A technique used to manage input/output between system components and the CPU.
Multiprocessing
A technology that makes it possible for a computing system to harness the power of more than one processor to complete the execution of a single application.
Virtualization
A technology used to host one or more operating systems within the memory of a single host computer. The mechanism allows virtually any OS to operate on any hardware. It also allows multiple operating systems to work simultaneously on the same hardware.
Virtualization
A technology used to host one or more operating systems within the memory of a single host computer. This mechanism allows virtually any OS to operate on any hardware. It also allows multiple operating systems to work simultaneously on the same hardware.
Vulnerability Scan
A test (or attack) performed on a system to find weaknesses in the security infrastructure. They automatically probe systems, applications, and networks looking for weaknesses that may be exploited by an attacker. The scanning tool used in these tests provide quick point-and-click tests that perform otherwise tedious task without requiring manual intervention.
Network Vulnerability Scan
A test performed on a system to find weaknesses in the security infrastructure. This test automatically probes systems, applications, and networks looking for weaknesses that may be exploited by an attacker. The scanning tools used in these tests provide quick point-and-click tests that perform otherwise tedious tasks without requiring manual intervention.
Identity as a Service or Identity and Access as a Service (IDaaS)
A third party service that provides identity and access management. Effectively provides SSO for the cloud and is especially useful when internal clients access cloud-based Software as a Service (SaaS) applications.
Time-of-Check-to-Time-of-Use (TOCTTOU or TOC/TOU)
A timing vulnerability that occurs when a program checks access permissions too far in advance of a resource request.
Time of Check to Time of Use
A timing vulnerability that occurs when a program checks across permissions too far in advance of a resource request.
Shielded Twisted Pair (STP)
A twisted pair wire that includes a metal foil wrapper inside the outer sheath to provide additional protection from EMI.
SYN Flood Attack
A type of DoS attack. This attack is waged by not sending the final ACK packet, which breaks the standard three-way handshake used by TCP/IP to initiate communication sessions.
Man in the Middle Attack
A type of attack that occurs when malicious users are able to position themselves between the two end points of a communication's link. The client and server are unaware that there is a third party intercepting and facilitating their communication session.
Denial-of-Service (DoS) Attacks
A type of attack that prevents a system from processing or responding to legitimate traffic or requests for esources and objects.
Gantt Chart
A type of chart that shows the interrelationships over time between projects and schedules. It provides a graphical illustration of a schedule that helps to plan, coordinate, and track specific tasks in a project.
Radio Frequency Interference (RFI)
A type of noise that is generated by a wide number of common electrical appliances, including fluorescent lights, electrical cables, electric space heaters, computers, elevators, motors, electric magnets, and so on. It can affect many of the same systems EMI affects.
Digital Rights Management (DRM)
A type of protection software that uses encryption to enforce copyright restrictions on digital media. Over the past decade, publishers attempted to deploy DRM schemes across a variety of media types including music, media, and books.
Beacon Frame
A type of wireless network packet that broadcasts the presence of the wireless network by announcing the network's SSID or network name.
Software Defined Networking (SDN)
A unique approach to network operation, design, and management. The concept is based on the theory that the complexities of a traditional network with on-device configuration (i.e., routers and switches) often force an organization to stick with a single device vendor, such as Cisco, and limit the flexibility of the network to changing physical and business conditions. This protocol aims at separating the infrastructure layer (i.e., hardware and hardware-based settings) from the control layer (i.e., network services of data transmission management).
Software-Defined Networking (SDN)
A unique approach to network operations, design and management. The concept is based on the theory that the complexities of a traditional network with on-device configuration (i.e., routers and switches) often force an organization to stick with a single device vendor, such as Cisco, and limit the flexibility of the network to adapt to changing physical and business conditions. It aims at separating the infrastructure layer (i.e., hardware and hardware-based settings) from the control layer (i.e., network services of data transmission management). This also removed the traditional networking concepts of IP addressing, subnets, routing, and the like from needing to be programmed into or be deciphered by hosted applications
Software Escrow Agreement
A unique tool use to protect a company against the failure of a software developer to provide adequate support for its products or against the possibility that the developer will go out of business and no technical support will be available for the product.
Rule-Based Access Control
A variation of mandatory access control, this system sues a set of rules, restrictions, or filters to determine what can and cannot occur on the system, such as granting subject access, performing an action on an object, or accessing a resource. Firewalls, proxies, and routers are common examples.
Stealth Virus
A virus that hides itself by tampering with the operating system to fool antivirus packages into thinking everything is functioning normally
Polymorphic Virus
A virus that modifies its own code as it travels from system to system. The virus' propagation and destruction techniques remain the same, but the signature of the virus is somewhat different each time it infects a new system.
Encrypted Virus
A virus that uses cryptographic techniques to avoid detection. In their outward appearance, they are quite similar to polymorphic viruses - each infected system has a virus with a different signature. However, they do not generate these modified signatures by changing their code; instead, they alter the way they are stored on the disk.
Multipartite Virus
A virus that uses more than one propagation technique in an attempt to penetrate systems that defend against only one method or the other.
Buffer Overflows
A vulnerability that can cause a system to crash or allow the user to execute shell commands and gain access to the system. Buffer overflow vulnerabilities are especially prevalent in code developed rapidly for the Web using CGI or other languages that allow unskilled programmers to quickly create interactive web pages.
Work Function/Work Factor
A way of measuring the strength of a cryptography system by measuring the effort in terms of cost and/or time. Usually the time and effort required to perform a complete brute‐force attack against an encryption system is what the work function rating represents. The security and protection offered by a cryptosystem is directly proportional to the value of the work function/factor.
Immediate Addressing
A way of referring to data that is supplied to the CPU as part of an instruction.
Service-Level Agreement (SLA)
A way to ensure that organizations providing services to internal and/or external customers maintain an appropriate level of service agreed on by both the service provider and the vendor. These agreements should be put in place for: data circuits, applications, information processing systems, databases, or other critical components.
Orthogonal Frequency-Division Multiplexing (OFDM)
A wireless technology that employs a digital multi carrier modulation scheme that allows for a more tightly compacted transmission. The modulated signals are perpendicular and thus do not cause interference with each other. It requires a smaller frequency set (aka channel bands) but can offer greater data throughput.
Direct Sequence Spread Spectrum (DSSS)
A wireless technology that employs all of the available frequencies simultaneously in parallel. Uses a special encoding mechanism known as a chipping code to allow a receiver to reconstruct data even if parts of the signal were distorted because of interference.
Commonly Used Symmetric Algorithms
Advanced Encryption Standard (AES) - selected as the replacement for Des in 2001. - supports key sizes of 128 bits, 192 bits, and 256 bits. - US Govt has approved its use to protect classified data up to top secret. Triple DES (3DES) - created as possible replacement for DES - first implementation used 56-bit keys, newer use 112-bit or 168-bit Blowfish - created as possible alternative to DES - key sizes of 32 bits to 448 bits (strong encryption protocol)
Attribute
Aka field; Corresponds to a column in a table.
Bluetooth (802.15)
Aka personal area networks (PANs), it is a wireless standard commonly used to pair accessories to mobile phones or computers. Typically has a limited range of 30 feet, but some devices can function from more than 100 meters away.
Cryptography
Algorithms applied to data that are designed to ensure confidentiality, integrity, authentication, and/or nonrepudiation.
Application Programming Interfaces (APIs)
Allow application developers to bypass traditional web pages and interact directly with the underlying service through function calls. While offering and using APIs creates tremendous opportunities for service providers, it also poses some security risks. Developers must be aware of these challenges and address them when they create and use these interfaces.
High Level Languages (C++, Ruby, Java, Visual Basic)
Allow programmers to write instructions that: - better approximate human communication. - decrease the length of time needed to craft an application. - possibly decrease the number of programmers needed on a project. - also allow some portability between different operating systems and hardware platforms.
Covert Storage Channels
Allow the transmission of sensitive data between classification levels through the direct or indirect manipulation of shared storage media.
Fail-Open Failure State
Allows users to bypass failed security controls, erring on the side of permissiveness.
Application-Level Gateway Firewalls
Also called a proxy firewall, it is a firewall that filters traffic based on the Internet service (in other words, application) used to transmit or receive data. These firewalls are known as second-generation firewalls; they operate at the Application layer (layer 7) of the OSI model. This type of firewall negatively affects network performance because each packet must be examined and processed as it passes through a firewall.
Mutual Assistance Agreement (MAA)
Also called reciprocal agreements, are popular in disaster recovery literature but are rarely implemented in real-world practice. Under this agreement, two organizations pledge to assist each othe in the event of a disaster by sharing computing facilities or other technological resources.
10Base-T
Also called twisted-pair (UTP). A type of network cable that consists of four pairs of wires that are twisted around each other and then sheathed in a PVC insulator.
Temporary Internet Files
Also know as Internet cache files, it is a temporary storage of files downloaded from the Internet sites that are being held by the client's utility for current and possibly future use.
Real Evidence
Also known as "object evidence", consists of things that may actually be brought into a court of law.
One-Time Pads
Also known as Vernam ciphers, an extremely powerful type of substitution cipher that uses a different key for each message. The key length is the same length as the message.
Running Key Cipher
Also known as a book cipher, it is a form of cryptography in which the key is a designation of a changing source, such as the third page of the New York Times.
Wet Pipe System
Also known as a closed head system, is always full of water. Water discharges immediately when suppression is triggered.
Birthday Attack
Also known as a collision attack or reverse hash matching, seeks to find flaws in the one-to-one nature of hashing functions. In this attack, the attacker seeks to substitute a digitally signed communication with a different message that produces the same message digest, thereby maintaining the validity of the original digital signature. This si based on the statistical anomaly that in a room of 23 people, the probability of two or more people having the same birthday is greater than 50 percent.
Circuit-Level Gateway Firewalls
Also known as circuit proxies, it is a firewall used to manage communication sessions between trusted partners. This type of firewall is known as a second-generation firewall because they represent a modification of the application-level gateway firewall concept; they operate at the Session layer (layer 5) of the OSI model. SOCKS is a common implementation of this type of firewall.
Stateful Inspection Firewalls
Also known as dynamic packet filtering firewalls, it is a firewall that evaluates the state or the context of network traffic. By examining source and destination address, application usage, source of origin, and relationship between current packets with the previous packets of the same session, these firewalls are able to grant a broader range of access for authorized users and activities and actively watch for and block unauthorized users and activities. These firewalls operate more efficiently than application-level gateway firewalls and they are known as third-generation firewalls.
Replay Attack
Also known as playback attack, an attack in which the attacker records the traffic between a client and server. The packets sent from the client to the server are then played back or retransmitted to the server with slight variations of the time stamp and source IP address (in other words, spoofing). In some cases, this allows the malicious user to restart an old communication link with a server.
Structured Walk-Through
Also referred to as table-top testing, members of the disaster recovery team gather in a large conference room and role-play a disaster scenario.
802.11 Wireless Networking Amendments
Amendment Speed Frequency 802.11 2 Mbps 2.4 GHz 802.11a 54 Mbps 5 GHz 802.11b 11 Mbps 2.4 GHz 802.11g 54 Mbps 2.4 GHz 802.11n 200+ Mbps 2.4 GHz or 5 GHz 802.11ac 1 Gbps 5 GHz
Supervisory Control and Data Acquisition (SCADA)
An ICS unit that can operate as a stand-alone device, be networked together with other systems, or be networked with traditional IT systems. Most of these systems systems are designed with minimal human interfaces. Often, they use mechanical buttons and knobs or simple LCD screen interfaces (similar to what you might have on a business printer or a GPS navigation device). However, networked devices may have more complex remote-control software interfaces.
Basic Rate Interface (BRI)
An ISDN service type that provides two B, or data, channels and one D, or management, channel. Each B channel offers 64 Kbps, and the D channel offers 16 Kbps.
Security Assertion Markup Language (SAML)
An XML-based language that is commonly used to exchange authentication and authorization (AA) information between federated organizations. It is often used to provide SSO capabilities for browser access.
Mandatory Access Controls (MAC)
An access control mechanism that uses security labels to regulate subject access to objects. Each subject possesses attributes that define its clearance, or authority, to access resources.Each object possesses attributes that define its classification.
Principle of Least Privilege
An access control philosophy that states that subjects are granted the minimal access possible for the completion of their work tasks.
Subject
An active entity that seeks information about or data from passive objects trough the exercise of access. It can be a user, a program, a process, a file, a computer, a database, and so on.
Penetration Testing
An activity use to test the strength and effectiveness of deployed security measures with an authorized attempted intrusions attack. These tests should only be performed with the consent and knowledge of the management staff.
Hardware
An actual physical device, such as a hard drive, LAN card, printer, and so on.
Base+Offset Addressing
An addressing scheme that uses a value stored in one of the CPU's registers as the base location from which to begin counting. The CPU then adds the offset supplied with the instruction to that base address and retrieves the operand from the computed memory location.
Certificate Authority (CA)
An agency that authenticates and distributes digital certificates. These neutral organizations offer notarization services for digital certificates. To obtain a digital certificate from a reputable ____, you must prove your identity to the satisfaction of the ____
Analytic Attack
An algebraic manipulation that attempts to reduce the complexity of a cryptographic algorithm. This attack focuses on the logic of the algorithm itself.
Symmetric Key Algorithms
An algorithm that relies on a "shared secret" encryption key that is distributed to all members who participate in communications. This key is used by all parties to both encrypt and decrypt messages. Can also be called secret key cryptography and private key cryptography.
Terminal Access Controller Access-Control System (TACACS+)
An alternative to RADIUS. Available in 3 versions: - TACACS: It integrates the authentication and authorization processes. - XTACACS: Keeps the authentication, authorization, and accounting processes separate - TACACS+: Improves XTACACS by adding two-factor authentication.
Guard Dogs
An alternative to security guards. They can often be deployed as a perimeter security control. As a detection and deterrent, they are extremely effective. However, they are costly, require a high level of maintenance, and impose serious insurance and liability requirements.
802.11i (WPA2)
An amendment to the 802.11 standard that defines a new authentication and encryption technique that is similar to IPSec. To date, no real-world attack has compromised a properly configured wireless network utilizing this standard.
Security Label
An assigned classification or sensitivity level used in security models to determine the level of security required to protect an object and prevent unauthorized access. Once it is set, it usually cannot be altered.
ARP Cache Poisoning
An attach where an attacker inserts bogus information into the ARP cache (the local memory store of discovered IP to MAC relationships).
Replay Attack
An attack in which a malicious user records the traffic between a client and server. The packets sent from the client to the server are then played back or retransmitted to the server with slight variations of the time stamp and source IP address (in other words, spoofing). Countermeasures include: one-time authentication mechanisms and sequenced session identification.
Modification Attack
An attack in which captured packets are altered and then played against a system. The altered packets are designed to bypass the restrictions of improved authentication mechanisms and session sequencing. Countermeasures include: using digital signature verifications and packet checksum verifications.
Known Plaintext Attack
An attack in which the attacker has a copy of the encrypted message along with the plain-text message used to generate the cipher text (the copy). This greatly assists the attacker in breaking weaker codes.
Chosen Ciphertext Attack
An attack in which the attacker has the ability to decrypt chosen portions of the cipher-text message and use the decrypted portion of the message to discover the key.
Chosen Plaintext Attack
An attack in which the attacker has the ability to encrypt plaintext messages of their choosing and then analyze the cipher-text output of the encryption algorithm.
Brute Force Attack
An attack made against a system to discover the password to a known identity (in other words, username). This attack uses a systematic trial of all possible character combinations to discover an account's password. This attack will always be successful given enough time. Every additional bit of key length doubles the time to perform this attack because the number of potential keys double.
Salami Attack
An attack performed by gathering small amounts of data to construct something of greater value or higher sensitivity.
IP Probes
An attack technique that uses automated tools to ping each address in a range. Systems that respond to the pin request are logged for further analysis. Addresses that do not produce a response are assumed to be unused and are ignored.
Bluesnarfing
An attack that allows hackers to connect with your Bluetooth devices without your knowledge and extract information from them. This form of attack can offer attackers access to your contact lists, your data, and even your conversations.
Bluebugging
An attack that grants hackers remote control over the features and functions of a Bluetooth device. This could include the ability to turn on the microphone to use the phone as an audio bug.
Inference
An attack that involves using a combination of several pieces of non sensitive information to gain access to information that should be classified at a higher level.
Hyperlink Spoofing
An attack used to redirect traffic to a rogue or imposter system or to simply divert traffic away from its intended destination, often through the malicious alteration of the hyperlink URLs in the HTML code of documents sent to clients.
ARP Cache Poisoning
An attack where an attacker inserts bogus information into the ARP cache (the local memory store of discovered IP to MAC relationships).
Captive Portal
An authentication technique that redirects a newly connected wireless Web client to a portal access control page. The portal page may require the user to input payment information, provide logon credentials, or input an access code. They are most often located on the wireless networks implemented for public use, such as hotels, restaurants, bars, airports, libraries, and so on. They can also be used on cables\d Ethernet connections as well.
Simple Integrity Property
An axiom of the Biba Model that states that a subject at a specific classification level cannot read data with a lower classification level ("no read down"). You don't want invalidated data to read into validated documents.
Wi-Fi Protected Access (WPA)
An early alternative to WEP based on a secret passphrase and employing LEAP and TKIP crypto systems, It is attackable through passphrase guessing.
WiFi Protected Access (WPA)
An early alternative to WEP based on a secret passphrase and employing the LEAP and TKIP (Temporal Key Integrity Protocol) crypto systems. It is attackable through passphrase guessing.
Frequency Hopping Spread Spectrum (FHSS)
An early implementation of the spread spectrum concept. This wireless access technology transmits data in a series while constantly changing the frequency in use. Only one frequency at a time is used. It was designed to help minimize interference by not using only a single frequency that could be affected.
IP Header Protocol Field Value
An element in an IP header that identifies the protocol used in the IP packet payload (usually this will be 6 for TCP, 17 for UDP, or 1 for ICMP, or any of a number of other valid routing protocol numbers).
Privacy Enhanced Mail (PEM)
An email encryption mechanism that provides authentication, integrity, confidentiality, and non repudiation. - It uses RSA, DES, and X.509.
Point-to-Point Tunneling Protocol (PPTP)
An encapsulation protocol developed from the dial-up Point-to-Point Protocol. It operates at the Data Link Layer (layer 2) of the OSI model and is used on IP networks. It creates as point-to-point tunnel between two systems and encapsulates PPP packets. The initial negotiation process is not encrypted. Does not support TACACS+ and RADIUS.
End-to-End Encryption
An encryption algorithm that protects communications between two parties (in other words, a client and a server) and is performed independently of link encryption. An example would be the use of Privacy Enhanced Mail (PEM) to pass a message between a sender and a receiver. This protects against an intruder who might be monitoring traffic on the secure side of an encrypted link or traffic sent over an encrypted link. Encryption done at the higher OSI layers are usually this type. Example: SSH.
Secure Sockets Layer (SSL)
An encryption protocol developed by Netscape to protect the communications between a web server and a web browser. It relies on the exchange of server digital certificates to negotiate encryption/decryption parameters between the browser and the web server. The goal is to create secure communications channels that remain open for an entire web browsing session. It depends on a combination of symmetric and asymmetric cryptography. Uses TCP port 443.
Secure Sockets Layer (SSL)
An encryption protocol developed by Netscape to protect the communications between a web server and web browser. - A session-oriented protocol that provides confidentiality and integrity. - Deployed using a 40-bit key or a 128-bit key.
Link Encryption
An encryption technique that protects entire communications circuits by creating a secure tunnel between two points. This is done by using either a hardware or software solution that encrypts all traffic entering one end of the tunnel and decrypts all traffic exiting the other end of the tunnel. Encryption done at the lower OSI layers are usually this type.
Simple Key Management for Internet Protocol (SKIP)
An encryption tool used to protect sessionless Datagram protocols. - designed to integrate with IPSec; it functions at layer 3 - able to encrypt any subprotocol of the TCP/IP suite - replaced by Internet Key Exchange (IKE) in 1998
Computer Architecture
An engineering discipline concerned with the construction of computing systems from the logical level.
Mean Time to Repair (MTTR)
An estimate of the length of time to repair a hardware or media component.
Mean Time Between Failures (MTBF)
An estimation of the time between the first and any subsequent failures.
Security Incident
An event that has a negative outcome affecting the confidentiality, integrity, or availability of an organization's data.
Data Hiding
An important characteristic in multilevel secure systems. It ensures that data existing at one level of security is not visible to processes running at different security levels.
Sutherland Model
An integrity model that focuses on preventing interference in support of integrity. It is formally based on the state machine model and the information flow model. This model is based on the idea of defining a set of system states, initial states, and state transitions. Through the use of only these predetermined secure states, integrity is maintained and interference is prohibited.
Biba Model
An integrity-focused security model based on the state machine model and employing mandatory access controls and the lattice model. This model is based on information flow and is a multilevel model. Focus of this model is on integrity.
X.25 WAN Connection
An older WAN protocol that uses carrier switching to provide end-to-end connections over a shared network medium.
Serial Line Internet Protocol (SLIP)
An older technology developed to support TCP/IP communications over asynchronous serial connections, such as serial cables or modem dial-up. - It is rarely used but is still supported on many systems. - It can support only IP, requires states IP addresses, offers no error detection or correction, and does not support compression.
OAuth
An open SSO standard designed to work with HTTP and it allows users to log on with one account across multiple sites/locations.
Open ID
An open SSO standard maintained by the Open ID Foundation that can be used in conjunction with OAuth or on its own.
NOT
An operation (represented by the - or ! symbol) that reverses the value of an input variable. This function operates on only one variable at a time.
OR
An operation (represented by the v symbol) that checks to see whether at least one of the input values is true.
Proprietary Data
Any data that helps an organization maintain a competitive advantage. Examples: - Software code IT developed - Technical plans for products - Internal processes - Intellectual property - Trade secrets
Access Control
Any hardware, software, or administrative policy or procedure that controls access to resources. Includes the following overall steps: 1. Identify or authenticate users or other subjects attempting to access resources. 2. Determine whether the access is authorized. 3. Grant or restrict access based on the subject's identity. 4. Monitor and record access attempts.
Protected Health Information (PHI)
Any information, whether oral or recorded in any form or medium, that: (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearingouse; and (B) relates to the past, present, or future physical or mental health or condition of any individual, the provision of healthcare to an individual, or the past, present, or future payment for the provision of healthcare to an individual.
Sanitizing
Any number of processes that prepares that prepares media for destruction. It's the process that ensures that data cannot be recovered by any means from destroyed or discarded media. It can also be the actual means by which media is destroyed. Media can be _________ed by purging or degaussing without physically destroying the media.
Security Event
Any occurrence that takes place during a certain period of time.
Role - User
Any person who has access to the secured system
Target of Evaluation (TOE)
Any system being evaluated using ITSEC. All ratings are expressed as these ratings in two categories: functionality and assurance: - Functionality of a system is rated from F-D through F-B3 - The assurance of a system is rated from E0 through E6. Most ITSEC ratings generally correspond to TCSEC ratings.
Local Cache
Anything that is temporarily stored on the client for future reuse. There are many local ______ on a typical client, including ARP _______, DNS ________, and Internet files _______.
TCP/IP Protocol Suite - 4 Layers and Component Protocols
Application (OSI Session, Presentation & Application) - FTP, Telnet, SNMP, LPD, TFTP, SMTP, NFS, X Windows Transport (OSI Transport) - TCP, UDP Internet (OSI Network) - ICMP, IGMP, IP Link (OSI Physical & Data Link) - Ethernet, Fast Ethernet, Token Ring, FDDI
Interface Testing
Assesses the performance of modules against the interface specifications to ensure that they will work together properly when all of the development efforts are complete. 3 Types of Interfaces should be tested: - Application Programming Interfaces (APIs) - User Interfaces - Physical Interfaces This testing provides an added degree of assurance that interfaces meet the organization's security requirements.
Skipjack
Associated with the Escrowed Encryption Standard, an algorithm that operates on 64‐bit blocks of text. It uses an 80‐bit key and supports the same four modes of operation supported by DES. Skipjack was proposed but never implemented by the US government. It provides the cryptographic routines supporting the Clipper and Capstone high‐speed encryption chips designed for mainstream commercial use.
Military and Intelligence Attacks
Attacks launched primarily to obtain secret and restricted information from law enforcement or military and technological research sources. The disclosure of such information could compromise investigations, disrupt military planning, and threaten national security.
Grudge Attacks
Attacks that are carried out to damage an organization or a person. The damage could be in the loss of information or information processing capabilities or harm to the organization or a person's reputation.
Thrill Attacks
Attacks that are launched for the fun of it. The main motivation behind these attacks is the "high" of successfully breaking into a system.
Business Attacks
Attacks that focus on illegally obtaining an organization's confidential information. The gathering of a competitor's confidential information is also called industrial espionage. The goal of this type of attack is solely to extract confidential information.
Directive Access Controls
Attempts to direct, confine, or control the actions of subjects to force or encourage compliance with security policies.
Deterrent Access Control
Attempts to discourage security policy violations. These controls often depend on individuals deciding not to take an unwanted action.
Detective Access Controls
Attempts to discover or detect unwanted or unauthorized activity. These controls operate after the fact and can discover the activity only after it has occurred.
Preventive Access Control
Attempts to thwart or stop unwanted or unauthorized activity from occurring.
Examples of Recovery Access Controls
Backups and restores, fault-tolerant drive systems, system imaging, server clustering, antivirus software, and database or virtual machine shadowing.
Transport Layer Security (TLS)
Based on SSL technology, it incorporated many security enhancements and was eventually adopted as a replacement for SSL in most applications. As with SSL, it uses TCP port 443.
6 Steps of the Risk Management Framework
CSIAAM: 1. Categorize - information system 2. Select - security controls 3. Implement - security controls 4. Assess - security controls 5. Authorize - information system 6. Monitor - security controls *NIST Special Publication 800-37r1
4 Major Categories Defined by TCSEC
Category A - Verified protection. The highest level of security. Category B - Mandatory protection. More granularity of control is mandated, so security administrators can apply specific controls that allow only very limited sets of subject/object access. Category C - Discretionary protection. Systems provide some access controls but are lacking in more sophisticated and stringent controls that address specific needs for secure systems. Category D - Minimal protection. Reserved for systems that have been evaluated but do not meet requirements to belong to any other group.
Data Dictionary
Central repository of data elements and their relationships. Stores critical information about data usage, relationships, sources, and formats.
Neural Networks
Chains of computational units are used in an attempt to imitate the biological reasoning process of the human mind. A system in which a long chain of computational decisions that feed into each other and eventually sum to produce the desired output is set up. Benefits include linearity, input-output mapping, and adaptivity. Used for voice recognition, face recognition, weather prediction, and the exploration of models of thinking and consciousness. Related Terms: "delta rule" or "learning rule"
Verfication
Checking the CA's digital signature using the CA's public key. Next, you must check and ensure that the certificate was not published on a certificate revocation list (CRL)
Input Validation
Checking, scanning, filtering, or sanitizing input received from users (especially over the Internet) before processing the received input.
Transposition Ciphers
Cipher that uses an encryption algorithm to rearrange the letters of a plain‐text message to form the cipher‐text message.
Substitution Cipher
Cipher that uses an encryption algorithm to replace each character or bit of the plain-text message with a different character, such as a Caesar cipher.
Stream Ciphers
Ciphers that operate on each character or bit of a message (or data stream) one character/bit at a time. Example: the Caesar cipher
Document DRM
Common permissions restricted by these solutions: - Reading a file - Modifying the contents of a file - Removing watermarks from a file - Downloading/saving a file - Printing a file - Taking screenshots of file content These solutions allow organizations to control these rights by granting them when needed, revoking them when no longer necessary, and even automatically expiring rights after a specified period of time.
Commercial Business/Private Sector Classification Levels
Confidential or Proprietary (Company Data): Drastic Effects Private (Data related to individuals, such as medical data): Significant Negative Impact Sensitive: Negative Impact Public: No Serious Negative Impact
Service-Oriented Architecture (SOA)
Constructs new applications or functions out of existing but separate and distinct software services.
Multilevel Security Databases
Contain information at a number of different classification levels. They must verify the labels assigned to users and, in response to user requests, provide only information that's appropriate.
Enticement
Could still involve agents of law enforcement making the conditions for commission of a crime favorable, but the person is determined to have already broken a law or is intent on doing so.
General Maximum Tolerable Downtime (MTD) Estimates
Critical = minutes to hours Urgent = 24 hours Important = 72 hours Normal = 7 days Nonessential = 30 days
Cryptographic Key
Cryptographic keys provide the "secret" portion of a cryptographic algorithm used to encrypt and decrypt data.
Codes
Cryptographic systems of symbols that represent words or phrases and are sometimes secret, but they are not necessarily meant to provide confidentiality. See also cipher.
Certificate Extensions
Customized variables containing data inserted into the certificate by the certificate authority to support tracking of certificates or various applications. Supported by version 3 of the X.509 standard.
Domain Name Resolution
DNS resolves a human-friendly domain name into its IP address equivalent. Then ARP resolves the IP address into its MAC address equivalent. Both of these resolutions also have an inverse: DNS reverse lookups and RARP.
International Organization for Standardization (ISO)
Defines standards for industrial and commercial equipment, software, protocols, and management, among others. It issues 6 main products: - International Standards - Technical Reports - Technical Specifications - Publicly Available Specifications - Technical Corrigenda - Guides
Federal Information Processing Standard 140 (FIPS-140)
Defines the hardware and software requirements for cryptographic modules that the US federal government uses.
Boolean Mathematics
Defines the rules used for the bits and bytes that form the nervous system of any computer.
Copper Distributed Data Interface (CDDI)
Deployments of FDDI using twisted-pair (in other words, copper) wires. This reduces the maximum segment length to 100 meters and is susceptible to interference. It is less expensive, but slower.
TKIP (Temporal Key Integrity Protocol)
Designed a s a replacement for WEP without requiring replacement of legacy wireless hardware.
Direct Inward System Access (DISA)
Designed to help manage external access and external control of a PBX by assigning access codes to users.
Red Book
Developed to interpret the TCSEC in a networking context. The official title is Trusted Network Interpretation of the TCSEC so it could be considered an interpretation of the Orange Book with a bent on networking.
Generational (Intelligent) Fuzzing
Develops data models and creates new fuzzed input based on an understanding of the types of data used by the program.
White Boxes
Device used to control the phone system. It is a dual-tone multifrequency (DTMF) generator (that is, a keypad).
Sequential Access Storage
Devices that require that you read (or speed past) all of the data physically stored prior to the desired location. A common example is a magnetic tape drive.
Sequential Storage Access
Devices that require that you read (or speed past) all of the data physically stored prior to the desired location. A common example of a sequential storage device is a magnetic tape drive.
Red Boxes
Devices used to simulate tones of coins being deposited into a pay phone.
Random Access Storage
Devices, such as RAM and hard drives, that allow the operating system to request content from any point within the media.
Random Access Storage
Devices, such as RAM and hard drives, that allow the operating system to request contents from any point within the media.
Common Mode Noise
Electromagnetic interference (EMI) noise generated by the difference in power between the hot and ground wires of a power source or operating electrical equipment.
Traverse Mode Noise
Electromagnetic interference (EMI) noise generated by the difference in power between the hot and neutral wires of a power source or operating electrical equipment.
Electromagnetic (EM) Radiation
Emanations that can be intercepted. These emanation leaks can cause serious security issues but are generally easy to address.
Token Ring
Employs a token-passing mechanism to control which systems can transmit data over the network medium. It can be deployed on ring or start network topologies. It is rarely used today because of its performance limitations, higher cost compared to Ethernet, and increased difficulty in deployment and management.
PEAP (Protected Extensible Authentication Protocol)
Encapsulates EAP methods within a TLS tunnel that provides authentication and potentially encryption. Since EAP was originally designed for use over physically isolated channels and hence assumed secured pathways, EAP is usually not encrypted. This protocol can provide encryption for EAP methods
Certificate
Endorsed copy of an individual's public key that verifies their identity It provides communicating parties with the assurance that the people they are communicating with truly are who they claim to be.
Account Management Reviews
Ensure that users only retain authorized permissions and that unauthorized modifications do not occur. * May be a function of infrastructure security management personnel or internal auditors.
Common TCP Ports
FTP - 21 NTP - 123 SSH- 22. HTTPS - 443 Telnet - 23. MS SQL Server - 1433 SMTP - 25. Oracle - 1521 DNS - 53. H.323 - 1720 HTTP - 80. PPTP - 1723 POP3 - 110. RDP - 3389
Control Zones
Faraday cages used to block purposely broadcast interference to keep it from affecting normal operations of your devices.
Digital Signature Standard (DSS)
Federal Information Processing Standard (FIPS) 186-4 - Specifies that all federally approved digital algorithms must use SHA-2 hashing functions. - It also specifies which algorithms can be used to support a digital signature infrastructure: - Digital Signature Algorithms (DSA) - Rivest, Shamir, Adleman (RSA) algorithm - Elliptic Curve DSA (ECDSA)
Examples of Preventive Access Controls
Fences, locks, biometrics, mantraps, lighting, alarm systems, separation of duties policies, job rotation policies, data classification, penetration testing, access control methods, encryption, auditing, security cameras or closed circuit television (CCTV), smartcards, callback procedures, security policies, security awareness training, antivirus software, firewalls, and intrusion prevention systems.
Copyright Law
Guarantees the creators of "original works of authorship" protection against the unauthorized duplication of their work. 8 Broad Categories: - Literary works - Musical works - Dramatic works - Pantomimes and choreographic works - Pictorial, graphical, and sculptural works - Motion pictures and other audiovisual works - Sound recordings - Architectural works
Organization for Economic Cooperation and Development (OECD) - 8 Driving Principles
Guidelines on the Protection of Privacy and Transborder Flows of Personal Data - 1980 - Collection Limitation Principle - Data Quality Principle - Purpose Specification Principle - Use Limitation Principle - Security Safeguards Principle - Openness Principle - Individual Participation Principle - Accountability Principle *30 member nations from around the world
Hashing Algorithm Memorization Chart
HAVAL (an MD5 Variant - 128, 160, 192, 224 and 256 bits HMAC - Variable (*does not provide for nonrepudiation) MD2 - 128 bits MD4 - 128 bits MD5 - 128 bits SHA-1 - 160 bits SHA-224 - 224 bits SHA-256 - 256 bits SHA-384 - 384 bits SHA-512 - 512 bits
Security Association (SA)
In an IPSec session, the representation of the communication session and process of recording any configuration and status information about the connection. Two main components: - The Authentication Header (AH) - provides assurances of message integrity and nonrepudiation. It also provides authentication and access control and prevents replay attacks. - The Encapsulating Security Payload (ESP) - provides confidentiality and integrity of packet contents. It provides encryption and limited authentication and prevents replay attacks.
Class
In the context of object-oriented programming terminology and techniques, a collection of common methods from a set of objects that defines the behavior of those objects.
Simulation Test
In these tests, disaster recovery team members are presented with a scenario and asked to develop an appropriate response. Unlike other tests, some of these response measures are then tested. This may involve the interruption of noncritical business activities and the use of some operational personnel.
Read-Through Test
In this test, you distribute copies of the disaster recover plans to members of the disaster recovery team for review. 3 Goals: 1. Ensures key personnel are aware of their responsibilities and have knowledge refreshed periodically. 2. Provides individuals with an opportunity to review the plans for obsolete information and update any items that require modification due to changes. 3.Helps identify situations in which key personnel have left the company and nobody bothered to reassign their disaster recovery responsibilities.
Technical Physical Security Controls
Include access controls; intrusion detection; alarms; closed-circuit television (CCTV); monitoring; heating, ventilating, and air conditioning (HVAC); power supplies; and fire detection and suppression.
Physical Controls for Physical Security
Include fencing, lighting, locks, construction materials, man traps, dogs, and guards.
Software License Agreement - Click-wrap agreements
Included in a package but require the user to accept the terms during the software installation process.
Documentary Evidence
Includes any written items brought into court to prove a fact at hand. This type of evidence must be authenticated.
Electronic Access Control (EAC) Lock
Incorporates 3 elements: - an electromagnet to keep the door closed; - a credential reader to authenticate subjects and to disable the electromagnet; and - a sensor to reengage the electromagnet when the door is closed.
Programmable Logic Controllers (PLC)
Industrial control system (ICS) units that are effectively single purpose or focused-purpose digital computers. They are typically deployed for the management and automation of various industrial electromechanical operations such as controlling systems on an assembly line or a large-scale digital light display.
Distributed Control Systems (DCS)
Industrial control system (ICS) units that are typically found in industrial process plants where the need to gather data and implement control over a large-scale environment from a single location is essential. An important aspect of this system is that the controlling elements are distributed across the monitored environment, such as a manufacturing floor or a production line, while the centralized monitoring location sends commands out of those localized controllers while gathering status and gathering data.
Cascading Composition Theory
Input for one system comes from the output of another system.
X.509
International standard for digital certificates. Certificates that conform to this standards contain the following data: - Version of ________ to which it conforms - Serial number (from the certificate creator) - Signature algorithm identifier - Issuer name - Validity period - Subject's name - Subject's public key (the meat of the certificate)
Switched Virtual Circuit (SVC)
It is a virtual circuit that is more like a dial-up connection because a virtual circuit has to be created using the best paths currently available before it can be used and then disassembled after the transmission is complete. It is like a shortwave or ham radio (you must tune the transmitter and receiver to a new frequency every time you want to communicate with someone).
ACL
It is tied to the object and lists valid actions each subject can perform.
Capabilities List
It is tied to the subject and lists valid actions that can be taken on each object.
Capability List
It is tied to the subject and lists valid actions that can be taken on the object.
Physical Access Controls
Items you can physically touch. They include physical mechanisms deployed to prevent, monitor, or detect direct contact with systems or areas within a facility.
Detailed Levels of TCSEC
Level Label Requirements D Minimal Protection C1 Discretionary Protection C2 Controlled Access Protection B1 Labeled Security B2 Structured Protection B3 Security Domains A1 Verified Protection
Secondary Memory
Magnetic/optical/flash-based media and other storage devices that contain data not immediately available to the CPU.
Communications Assistance for Law Enforcement Act (CALEA)
Mandates that all telcos, regardless of the technologies involved, must make it possible to wiretap voice and data communications when a search warrant is presented. A telco cannot provide customers with end-to-end encryption. Knowing this, use telco services appropriately, and whenever possible, feed pre-encrypted data into the telco link rather than clear form data.
Video Game DRM
Many video games implement this technology that depends on consoles using as active Internet connection to verify the game license with a cloud-based service.
Mission-Critical System (per the Govt Information Security Reform Act of 2000)
Meets any of the following criteria: 1. It is defined as a national security system by other provisions of the law. 2. It is protected by procedures established for classified information. 3. The loss, misuse, disclosure, or unauthorized access to or modification of any information it processes would have a debilitating impact on the mission of an agency. * GISRA provides specific evaluation and auditing authority for these systems to the secretary of defense and the director of central intelligence.
Read-Only Memory (ROM)
Memory that can be read but cannot be written to.
Enveloped Message
Message formed using S/MIME that provides integrity, sender authentication, and confidentiality.
Signed Message
Message formed using S/MIME that provides integrity, sender authentication, and nonrepudiation.
ActiveX Controls
Microsoft's component object model (COM) technology used in web applications. It is implemented using any one of a variety of languages, including Visual Basic, C, C++, and Java.
Fire Triangle
Middle - Chemical Reaction Points: - Heat - Oxygen - Fuel When selecting a suppression medium, consider which aspect it addresses.
Dedicated Mode
Mode in which the system in authorized to process only a specific classification level at a time. Three requirements exist for uses of these systems: 1. Security clearance that permits access to all information processed by the system. 2. Access approval for all information processed by the system. 3. Valid need to know all information processed by the system.
Corrective Access Controls
Modifies the environment to return systems to normal after as unwanted or unauthorized activity has occurred. These controls attempt to correct any problems that occurred as a result of a security incident.
Sag
Momentary low voltage.
Mobile Sites
Non-mainstream alternatives to traditional recovery sites that typically consist of self-contained trailers or other easily relocated units.
EAP (Extensible Authentication Protocol)
Not a specific mechanism for authentication; rather it is an authentication framework. It allows for new technologies to be compatible with exiting wireless or point-to-point connection technologies. More than 40 different methods of this authentication are widely supported. Not all methods are secure.
Network Layer (Layer 3)
OSI Reference Model - Responsible for adding routing and addressing information to the dtaa. This layer accepts the segment from the Transport layer and adds information to it to create a packet. This packet includes the source and destination IP address. - The routing protocols are located at this layer: ICMP, RIP, OSPF, BGP, IGMP, IP, IPSec, IPX, NAT, SKIP - This layer is responsible for providing routing or delivery information, bit is not responsible for verifying guaranteed delivery. This layer also manages error detection and node data traffic (traffic control). - Hardware at this layer: routers and bridge routers (brouters)
Session Layer (Layer 5)
OSI Reference Model - Responsible for establishing, maintaining, and terminating communication sessions between two computers. It (1) manages dialogue control (simplex, half-duplex, full duplex), (2) establishes checkpoints for grouping and recovery, and (3) retransmits PDUs that have failed or been lost since the last verified checkpoint. - Protocols: NFS, SQL, RPC
Application Layer (Layer 7)
OSI Reference Model - Responsible for interfacing user applications, network services, or the operating system with the protocol stack. This layer determines whether a remote communication partner is available and accessible. It also ensures that sufficient resources are avilable to support the requested communications. - Protocols and services required to transmit files, exchange messages, connect to remote terminals, and so on are found here (not the application) - Application-Specific Protocols: HTTP, FTP, LPD, SMTP, TFTP, EDI, POP3, IMAP, SNMP, NNTP, S-RPC, SET - Devices at this Layer: Application layer gateway, Application layer firewall
Transport Layer (Layer 4)
OSI Reference Model - Responsible for managing theintegrity of a connection and controlling the session. It accepts a PDU (Protocol Data Unit) from the Session layer and converts it into a segment. - This layer (1) controls how devices on the network are addresses or referenced, (2) establishes communication connections between nodes, and (3) defines the rules of a session. Session rules are established through a handshaking process. - This layer establishes a logical connection between two devices and provides end-to-end transport services to ensure data delivery. It includes mechanisms for: segmentation, sequencing, error checking, controlling data flow, error correction, multiplexing, and network service optimization. - Protocols: TCP, UDP, SPX, SSL, TLS
Presentation Layer (Layer 6)
OSI Reference Model - Responsible for transforming data received from the Application layer into a format that any system following the OSI model can understand. It imposes common or standardized structure and formatting rules onto the data. This layer is also reponsible for encryption and compression. Acts as an interface between the network and applications. - Most file or data formats operate within this layer. - Format Standars in the Layer: ASCII, EBCDICM, TIFF, JPEG, MPEG, MIDI
Physical Layer (Layer 1)
OSI Reference Model: - Accepts the frame from the Data Link layer and converts the frame into bits for transmission over the physical connection medium. - Also responsible for receiving bits from the physical connection medium and converting them into a frame to be used by the Data Link layer. - Contains the device drivers that tell the protocol hpt to employ the hardware for the transmission and reception of bits. Located within this layer are electrical specifications, protocols, and interface standards. - Hardware at this layer: NIC cards, hubs, repeaters, concentrators and amplifiers
Data Link Layer (Layer 2)
OSI Reference Model: - Responsible for formatting the packet from the Network layer into theproper format for transmission. - Within this layer resides the technology-specific protocols that convert the packet into a properly formatted frame. - Protocols at this layer: SLIP, PPP, ARP*, RARP*, L2F, L2TP, PPTR and ISDN - Part of processing includes adding the hardware source and destination address to the frame. Media Access Control (MAC) address id a 6-byte (48 bit) binary address written in hexadecimal notation. -Hardware at this layer: switches and bridge
Diffusion
Occurs when a change in the plain text results in multiple changes spread throughout the ciphertext.
Bridge Mode Infrastrusture
Occurs when a wireless connection is used to link two wired networks.
State Transition
Occurs when accepting input or producing output resulting in a new state.
Enterprise Extended Mode Infrastructure
Occurs when multiple wireless access points (WAPs) are used to connect a large physical area to the same wired network. Each WAP will use the same extended service set identifier (ESSID) so clients can roam the area while maintaining network connectivity, even while their wireless NICs change associations from one wireless access point to another.
Distributed Denial of Service (DDoS)
Occurs when the attacker compromises several systems to be used as launching platforms against one or more victims. The compromised systems used in the attack are often called slaves or zombies. This attack results in the victims being flooded with data from numerous sources.
Packet Switching
Occurs when the message or communication is broken up into small segments (usually fixed-length packets, depending on the protocols and technologies employed) and sent across the intermediary networks to the destination. Each segment of data has its own header that contains source and destination information. As soon as the packet is sent, the channel is made available for other communications.
Confusion
Occurs when the relationship between the plain text and the key is complicated enough that an attacker can't just alter the plain text and analyze the result in order to determine the key.
Wired Extension Mode Infrastructure
Occurs when the wireless access point acts as a connection point to link the wireless clients to the wired network.
Stand-Alone Mode Infrastructure
Occurs when there is a wireless access point connecting connecting wireless clients to each other but not to any wired resources. The wireless access point serves as a wireless hub exclusively.
Polyinstantiation
Occurs when two or more rows in the same relational database table appear to have identical primary key elements but contain different data for use at differing classification levels.
Collision
Occurs when two systems transmit data at the same time onto a connection medium that supports only a single transmission path.
Trusted Recovery
On a secured system, a process that ensures the system always returns to a secure state after an error, failure, or reboot.
Challenge Handshake Authentication Protocol (CHAP)
One of the authentication protocols used over PPP links. It encrypts usernames and passwords. - It performs authentication using a challenge-response dialogue that cannot be replayed. - It periodically reauthenticates the remote system throughout the established communication session to verify a persistent identity of the remote client.
Process Isolation
One of the fundamental security procedures put into place during system design. Basically, using these mechanisms (whether part of the operating system or part of the hardware itself) ensures that each process has its own isolated memory space for storage of data and the actual executing application code itself.
Encapsulating Security Payload (ESP)
One of to primary components of IPSec. It provides encryption to protect the confidentiality of transmitted data, but it can perform limited authentication. It operates at the Network layer (layer 3) and can be used in transport mode or tunnel mode.
Structure of the Common Criteria - 3 Areas
Part 1 - Introduction and General Model Part 2 - Security Functionality Requirements Part 3 - Security Assurance
Phases of Certification and Accreditation Systems
Phase 1 - Definition Phase 2 - Verification Phase 3 - Validation Phase 4 - Post Accreditation
Examples of Deterrent Access Controls
Policies, security awareness training, locks, fences, security badges, guards, mantrap, and security cameras.
Solid State Drives (SSDs)
Present a unique problem in relation to sanitization. ___ wear leveling ,eans that there are often blocks of data that are not marked as "live" but that hold a copy of the data when it was copied off to lower wear level blocks. This means that a traditional zero wipe is ineffective as a data security measure for this media.
Rights
Primarily refers to the ability to take an action on an object.
COBIT 5 - 5 Key Principles
Principle 1: Meeting Stakeholder Needs Principle 2: Covering the Enterprise End-to-End Principle 3: Applying a Single, Integrated Framework Principle 4: Enabling a Holistic Approach Principle 5: Separating Governance from Management
Health Insurance Portability and Accountability Act (HIPAA) of 1996
Privacy and security regulations requiring strict security measures for hospitals, physicians, insurance companies, and other organizations that process or store private medical information about individuals.
Configuration Management
Process used to control the version(s) of software used throughout an organization and formally track and Control changes to the software configuration. There are 4 Main Components: 1. Configuration identification 2. Configuration control 3. Configuration status accounting 4. Configuration audit
4 Main Steps of the BCP Process and 3 Distinct BCP Phases
Processes: 1. Project scope and planning 2. Business impact assessment 3. Continuity planning 4. Approval and implementation Phases: 1. BCP Development 2. BCP Testing, Training and Maintenance 3. BCP Implementation
Digital Millennium Copyright Act (DMCA) of 1998
Prohibits the circumvention of copy protection mechanisms placed inn digital media and limits the liability of Internet service providers for the activities of their users.
Surge
Prolonged high voltage.
Brownout
Prolonged low voltage.
Lightweight Extensible Authentication Protocol (LEAP)
Proprietary Cisco authentication protocol which was developed as an initial response to insecure WEP. - It supported frequent reauthentication and changing of WEP keys.
Privacy
Protecting personal information from disclosure to any unauthorized individual or entity.
Secure Communications Protocols
Protocols that provide security services for application-specific communication channels.
Uniform Computer Information Transactions Act
Provides a framework for the enforcement of shrink-wrap and click-wrap agreements by federal and state governments.
Security Model
Provides a way for developers to map abstract statements into a security policy that prescribes the algorithms and data structures necessary to build hardware and software.
Compensation Access Controls
Provides an alternative when it isn't possible to use a primary control or when necessary to increase the effectiveness of a primary control.
Fail-Secure Failure State
Puts the system into a high level of security (and possibly even disables it entirely) until an administrator can diagnose the problem and restore the system to normal operation.
Internet Activities Board (IAB) "Ethics and the Internet"
RFC 1087 - Five Basic Ethical Principles: The following practices would be considered unethical behavior if someone purposely: 1 - Seeks to gain unauthorized access to resources of the Internet. 2 - Disrupts the intended use of the Internet. 3 - Wastes resources (people, capacity, computer) through such actions. 4 - Destroys the integrity of computer-based information. 5 - Compromises the privacy of users.
Random Access Memory (RAM)
Readable and writable memory that contains information the computer uses during processing. This type of memory retains its contents only when power is continuously supplied to it.
Provisioning
Refers to granting accounts with appropriate privileges when they are created and during the lifetime of the account.
Permissions
Refers to the access granted for an object and determine what you can do with it.
Asynchronous Communications
Rely on a stop and start delimiter bit to manage the transmission of data. These communication is best suited for smaller amounts of data. Public Switched Telephone Network (PSTN) modems are good examples of this type of communication device.
Synchronous Communications
Rely on a timing or clocking mechanism based on either an independent clock or a time stamp embedded in the data stream. This communication are typically able to support very high rates of data transfer.
Common Criteria
Represents a more or less global effort that involves everybody who worked on TCSEC and ITSEC as well as other global players. It defines various levels of testing and confirmation of system' security capabilities, and the number of the level indicates what kind of testing and confirmation has been performed. This model was designed as a product evaluation model. In 1998, it was converted by IOS into an official standard: ISO 15408, Evaluation Criteria for Information Technology Security.
Information Technology Security Evaluation Criteria (ITSEC)
Represents an initial attempt to create security evaluation criteria in Europe. It was developed as an alternative to the TCSEC guidelines. The functionality rating of a system states how well the system performs all necessary functions based on its design and intended purpose. The assurance rating represents the degree of confidence that the system will work properly in a consistent manner.
Federal Information Security Management Act (FISMA) of 2002
Requires that federal agencies implement an information security program that covers the agencies' operations. * Also requires that government agencies include the activities of contractors in the security management program.
Role - Data Owner
Responsible for classifying information
Role - Security Professional
Responsible for following the directives mandated by senior management. Not decision makers; they are implementer.
Role - Auditor
Responsible for reviewing and verifying that the security policy is properly implemented and that security solutions are adequate.
Role - Data Custodian
Responsible for the tasks of implementing the prescribed protection defined by security policy and senior management.
Four-Ring Model
Ring 0: OD Kernel/Memory (Resident Components) Ring 1: Other OS Components Ring 2: Drivers, Protocols Ring 3: User-level Programs and Applications Rings 0-2 run in supervisory or privileged mode Ring 3 runs in user mode
Temperature
Rooms intended primarily to house computers should generally be kept at 60 to 75 degrees Fahrenheit (15 to 23 degrees Celsius).
Waterfall Model
SDLC Model developed in 1970 - Seven stages - as each stage is completed, the project moves into the next phase. - Modern version does allow development to return to the previous phase to correct defects discovered during the subsequent phase (feedback loop characteristic)
Spiral Model
SDLC Model developed in 1988 - Alternative life cycle model that allows for multiple iterations of a waterfall-style process. - Because this model encapsulates a number of iterations of another model, it is known as a meta model, or a "model of models". - Each "loop" of the spiral results in the development of a new system prototype. - It allows developers to return to the planning stages as changing technical demands and customer requirements necessitate the evolution of a system.
Agile Software Development
SDLC Model developed in 2001 - A set of software development approaches that eschew the rigid models of the past in favor of approaches that place an emphasis on the needs of the customer and on quickly developing new functionality that meets those needs in an iterative fashion.
IDEAL Model
SDLC model developed by the Software Engineering Institute (SEI) 5 Phases: 1. Initiating - business reasons behind the change are outlined, support is built, and appropriate infrastructure is put in place. 2. Diagnosing - engineers analyze current state and make recommendations for change. 3. Establishing - takes the recommendations from "2" and develops specific plan of action. 4. Acting - develops solutions and then tests, refines and implements them. 5. Learning - continuously analyze efforts to determine whether desired goals have been achieved and, when necessary, propose new actions to put the organization back on course.
EU Data Protection Directive Safe Harbor Principles
Safe Harbor Program run by the Dept of Commerce - 7 Principles: 1. Notice - purpose why Data is collected and used 2. Choice - opt out 3. Onward Transfer - only transfer data to other orgs that comply w/1&2 4. Security - must take reasonable precautions to protect data 5. Data Integrity - only use data for intended purpose. Ensure data is reliable. 6. Access - individuals have access to personal information held about them. Individuals also have ability to correct, amend, or delete info when inaccurate. 7. Enforcement - must implement mechanisms to assure compliance with principles.
Web Vulnerability Scan
Scanning tool probes the web application using automated techniques that manipulate inputs and other parameters to identify web vulnerabilities. The tool then provides a report of its findings, often including suggested vulnerability remediation techniques.
Examples of Detective Access Controls
Security guards, motion detectors, recording/reviewing of events captured by security cameras or CCTV, job rotation policies, mandatory vacation policies, audit trails, honeypots or honeynets, intrusion detection systems, violation reports, supervision and reviews of users, and incident investigations
Evidence
Should be: - Relevant - Authentic - Accurate - Complete - Convincing
Programmable Read-Only Memory (PROM)
Similar to a ROM chip, but with one exception. During the manufacturing process, this chip's contents aren't "burned in" at the factory as with standard ROM chips. Instead, this chip incorporates special functionality that allows an end user to burn in the chip's contents later. They are commonly used for hardware applications where some custom functionality is necessary but seldom changes once programmed.
Unified Extensible Firmware Interface (UEFI)
Since 2011, most manufacturers have replaced traditional BIOS with this. It is a more advanced interface between hardware and the operating system, which maintains support for legacy devices.
TCP Header Construction
Size in bits. Field 16 Source port 16 Destination port 32 Sequence number 4 Data offset 4 Reserved for future use 8 Flags 16 Window size 16 Checksum 16 Urgent pointer Variable Various options; must be a multiple of 32 bits
Major Weakness of Assymmetric Cryptography
Slow speed of operation. For this reason, many applications that require the secure transmission of large amounts of data use public key cryptography to establish a connection and then exchange a symmetric secret key.
Gray-Box Testing
Software testing that combines the other two approaches and is popular for software validation. Testers examine the software from a user perspective, analyzing input and outputs. They also have access to source code and use it to help design their tests. They do not, however, analyze the inner workings of the program during their testing.
Black-Box Testing
Software testing that examines the program from a user perspective by providing a wide variety of input scenarios and inspecting the output. Testers DO NOT have access to the internal code. An example of this testing is the final acceptance testing that occurs prior to system delivery.
Firmware
Software that is stored in a ROM chip.
Port Scan
Software used by an intruder to probe all of the active systems on a network and determine what public services are running on each machine.
Wrappers
Something used to enclose or contain something else. - Often used in relation to Trojan horse malware, combining a benign host with a malicious payload. - They can also be used as encapsulation solutions. It may include integrity and authentication features to ensure that only intended and authorized updates are applied to the system.
Type 3 Authentication Factor
Something you are or something you do
Type 2 Authentication Factor
Something you have
Type 1 Authentication Factor
Something you know
Cryptosystems
Specific implementations of a code or cipher in hardware and software.
MIME Object Security Services (MOSS)
Standard that provides authentication, confidentiality, integrity, and no repudiation for email messages. - It employs Message Digest 2 (MD2) and MD5 algorithms, RSA public key, and Data Encryption Standard (DES) to provide authentication and encryption services.
Cold Site
Standby facilities large enough to handle the processing load of an organization and equipped with appropriate electrical and environmental support systems. This type of facility has no computing facilities (hardware or software) preinstalled and also has no active broadband communication links. Many sites do have at least a few copper telephone lines, and some sites have standby links that can be activated with minimal notification.
Certificate Practice Statement (CPS)
States the practices a CA employs when issuing or managing certificates.
DREAD Rating System
System used to determine threat prioritization: - Damage Potential - Reproducibility - Exploitability - Affected Users - Discoverability
System High Mode
Systems running in this mode are not trusted to maintain separation between security levels, and all information processed by these systems must be handled as if it were classified at the same level as the most highly classified information processed by the system. Three requirements: 1. Valid security clearance that permits access to all information processed by the system. 2. Access approval for all information processed by the system. 3. Valid need to know for some information processed by the system but not necessarily all information processed by the system.
Multistate
Systems that are certified to handle multiple security levels simultaneously by using specialized security mechanisms that are designed to prevent information from crossing between security levels. In actual practice, multistate systems are relatively uncommon owing to the expense of implementing the necessary technical mechanisms.
Single-State
Systems that require the use of policy mechanisms to manage information at different levels. In this type of arrangement, security administrators approve a processor and system to handle only one security level at a time.
State Attacks
TOCTTOU attacks, race condition exploits and communication disconnects are known as this type of attack because they attack timing, data flow control, and transition between one system state to another.
Examples of Corrective Access Controls
Terminating malicious activity, rebooting a system, antivirus solutions that can remove or quarantine a virus, backup and restore plans to ensure that lost data can be restored, active intrusion detection systems that can modify the environment to stop an attack in process.
Dynamic Testing
Testing that evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else.
Static Testing
Testing that evaluates the security of software without running it by analyzing either the source code or the compiled application.
Trusted Computer System Evaluation Criteria (TCSEC)
The "Orange Book" - established guidelines to be used when evaluating a stand-alone computer from a security perspective. It combines the functionality and assurance rating of the confidentiality protection offered by a system into 4 main categories. These categories are assigned through the evaluation of a target system.
Loopback Address
The IP address used to create a software interface that connects to itself via TCP/IP. This address is handled by software alone. It permits testing of the TCP/IP protocol stack even if network interfaces or their device drivers are missing or damaged.
Loopback Address
The IP address used to create a software interface that connects to itself via TCP/IP. This address is handles by software alone. It permits the testing of the TCP/IP stack protocol even if network interfaces or their device drivers are missing or damaged. The entire 127.x.x.x network is reserved for this use, but only the 127.0.0.1 address is widely used.
Sliding Windows
The ability of TCP to dynamically alter its transmission window size based on link reliability
Fault Tolerance
The ability of a system to suffer a fault but continue to operate. It is achieved by adding redundant components such as additional disks within a redundant array of independent disks (RAID) or additional servers within a failover clustered configuration. It is part of avoiding single points of failure and the implementation of redundancy.
Stateful NAT
The ability or means by which NAT maintains information about the communications sessions between clients and external clients. It operates by maintaining a mapping between requests made by internal clients, a client's internal IP address, and the IP address of the Internet service contacted.
VLAN Hopping
The ability to make network traffic jump between VLANs through an abuse of IEEE 802.1Q VLAN tagging known as double encapsulation.
DNS Cache Poisoning
The act of altering or falsifying DNS information at a source location (i.e., HOSTS file, caching DNS server, or authoritative DNS server) in order to route or misdirect legitimate traffic.
DNS Spoofing
The act of altering or falsifying DNS information using a rogue DNS server to send false DNS replies in order to route or misdirect legitimate traffic.
Shoulder Surfing
The act of gathering information from a system by observing the monitor or the use of the keyboard by the operator.
Network Segmentation
The act of subdividing a network into numerous smaller units. These smaller units, groupings, segments, or sub networks (i.e., sub nets) can be used to improve various aspects of the network. It can boost performance, reduce congestion, compartmentalize communication problems (such as broadcast storms), and provide security improvements through traffic isolation. They can be created by using switch-based VLANs, routers, or firewalls (as well as combinations of all of these).
Segmentation
The act of subdividing a network into numerous smaller units. These smaller units, groupings, segments, or subnetworks (i.e., subnets) can be used to improve various aspects of the network. Segmentation can boost performance, reduce congestion, compartmentalize communication problems (such as broadcast storms) and provide security improvements through traffic isolation. Segments can be created by using switch-based VLANSs, routers, or firewalls (as well as Combinations of all of these).
War Driving
The act of using a radio wave signal detector or a wireless network detector to locate wireless networks.
Wireless Cells
The areas within a physical environment where a wireless device can connect to a wireless access point.
Steganography
The art of using cryptographic techniques to embed secret messages within another message, commonly used within an image or WAV file. These techniques are often used for illegal or questionable activities, such as espionage and child pornographers. It can also be used for legitimate purposes such as adding watermarks to documents to protect intellectual property. The hidden information is known only to file's creator.
Impersonation
The assumption of someone's identity or online account, usually through the mechanism of spoofing and session replay. This type of attack is considered a more active attack than masquerading.
Confidentiality
The assurance that information is protected from unauthorized disclosure and the defined level of secrecy is maintained throughout all subject-object interactions.
User Mode
The basic mode used by the CPU when executing user applications.
Processor
The central processing unit in a PC; it handles all functions on the system.
Transparency
The characteristic of a service, security control, or access mechanism that ensures that it is unseen by users.
Abstraction
The collection of similar elements into groups, classes, or roles(classes) for the assignment of security controls, restrictions, or permissions as a collective. It is one of the fundamental principles behind the field know as object-oriented programming. It is the "black-box doctrine that says the users of an object (or operating system component) don't necessarily need to know the details of how the object works; they need to know just the proper syntax for using the object and the type of data that will be returned as a result.
Trusted Computing Base (TCB)
The combination of hardware, software, and controls that form a trusted base that enforces your security policy. It must provide methods to access resources both inside and outside the ___. It is the responsibility of the components to ensure that a system behaves properly in all cases and adheres to the security policy under all circumstances.
Certification
The comprehensive evaluation, made in support of the accreditation process, of the technical and nontechnical security features of an IT system and other safeguards to establish the extent to which a particular design and implementation meet a set of specified security requirements. This is often an internal verification of security and the results of that verification are trusted only by your organization.
Cell Suppression
The concept of hiding individual database fields or cells or imposing more security restrictions on them.
Endpoint Security
The concept that each individual device must maintain local security whether or not its network or telecommunications channels provide or offer security. Sometimes this concept is expressed as "The end device is responsible for its own security".
Transitive Trust
The concept that if A trusts B and B trusts C, then A inherits trust of C through the transitive property.
Security Kernel
The core set of operating system services that handles all user/application requests for access to system resources. The purpose is to launch appropriate components to enforce reference monitor functionality and resist all know attacks. It requires descriptive information (classification and designation) about each resource that it protects.
Assurance
The degree of confidence that security needs are satisfied. It must be continually maintained, updated, and reverified. It is an assessment of the reliability and usability of security features in a real-world situation.
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol)
The designed replacement for WEP and TKIP/WPA. It implements AES (Advanced Encryption Standard) with a 128-bit key as a stream cipher.
Advanced Encryption Standard (AES)
The encryption standard selected in October 2000 by the National Institute of Standards and Technology (NIST) that is based on the Rijindael cipher. It only allows the processing of 128-bit blocks, but Rijindeal exceeded this specification, allowing cryptographers to use a block size equal to the key length. The number of encryption rounds depends on the key length chosen.
Accreditation
The formal declaration by the Designated Approving Authority (DAA) that an IT system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. This is often performed by a third-party testing service, and the results are trusted by everyone in the world who trusts the specific testing group involved.
Logical/Technical Access Controls
The hardware and software mechanisms used to manage access and to provide protection for resources and systems.
UDP Header Construction
The header is 8 bytes (64-bits long), divided into 4 sections, or fields, (each 16 bits long). - Source port - Destination port - Message length - Checksum
Security Perimeter
The imaginary boundary that separates the trusted computing base from the rest of the system. This boundary ensures that no insecure communications or interactions occur between the TCB and the remaining elements of the computer system.
Mean Time to Failure (MTTF)
The length of time or number of uses a hardware or media component can endure before its reliability is questionable and it should be replaced.
ACID Model
The letters represent the four required characteristics of database transactions: 1. Atomocity - a database transaction must be an "all-or-nothing" affair. If any part of the transaction fails, the entire transaction must be rolled back. 2. Consistency - all transactions must begin operating in an environment that is consistent with all of the database's rules (e.g. All records have a unique primary key). 3. Isolation - requires that transactions operate separately from each other. 4. Durability - the concept that database transactions must be resilient. Once a transaction is committed to the database, it must be preserved. This is ensured through the use of backup mechanisms, such as transaction logs.
Bounds
The limits to the memory and resources a process can access
Security Boaundary
The line of intersection between any two areas, subnets, or environments that have different security requirements or needs.
Certificate Revocation List (CRL)
The list of certificates that have been revoked by a certificate authority before the lifetimes of the certificates have expired. They are maintained by the various certificate authorities. The major disadvantage is that they must be downloaded and cross-referenced periodically, introducing a period of latency between the time a certificate is revoked and the time end users are notified of the revocation. *Remains the most common method of checking certificate status in use today.
Music DRM
The major use for this technology is for subscription-based services such as Napster and Kazaa, which use it to revoke a user's access to downloaded music when their subscription period expires.
Covert Channel
The means by which data can be communicated outside of normal, expected, or detectable methods. Best defense is to implement auditing and analyze logs for any of this type of activity.
Indirect Addressing
The memory address that is supplied to the CPU as part of the instruction and doesn't contain the actual value that the CPU is to use as an operand.
Converged Protocols
The merging of specialty or proprietary protocols with standard protocols, such as those from the TCP/IP suite. Some common examples of these protocols include: FCoE, MPLS, iSCSI, and VoIP. Primary benefit is the ability to use existing TCP/IP supporting network infrastructure to host special or proprietary services without the need for unique deployments of alternate networking hardware. This can result in cost savings.
Privileged Mode
The mode designed to give the operating system access to the full range of instruction supported by the CPU. Also known as kernel mode.
Server Rooms - Human Incompatibility
The more human incompatible a server room is, the more protection it will offer against casual and determined attacks. This can be accomplished by including: Halotron, PyroGen, or other halon-substitute oxygen-displacement fire detection and extinguishing systems, low temperatures, little or no lighting, and equipment stacked with little room to maneuver.
Fagan Inspections
The most formal code review processes. Found only in highly restrictive environments where code flaws may have catastrophic impact. Six Steps: 1. Planning 2. Overview 3. Preparation 4. Inspection 5. Rework 6. Follow-up *Each step has well-defined entry and exit criteria that must be met before the process may formally transition from one stage to the next.
E-book DRM
The most successful deployment of this technology is in the area of books and document publishing. Adobe offers Adobe Digital Experience Protection Technology (ADEPT) top provide this technology for e-books sold in a variety of formats. ADEPT uses a combination of AES technology to encrypt the media content and RSA encryption to protect the AES key.
Offline Distribution
The most technically simple method of key exchange, it involves the physical exchange of key material.
Basic Service Set Identifier (BSSID)
The name of a wireless network when in ad hoc or peer-to-peer mode (i.e., when a base station or WAP is not used).
Tunneling
The network communications process that protects the contents of protocol packets by encapsulating them in packets of another protocol.
Transmission Window
The number of packets transmitted before an acknowledge packet is sent.
Cardinality
The number of rows in the relation
Basic Input/Output System (BIOS)
The operating system-independent primitive instructions that a computer needs to start up and load the operating system from disk.
AND
The operation (represented by the ^ symbol) that checks to see whether two values are both true.
Network Topology (aka Physical Topology)
The physical layout and organization of computers and networking devices.
Administrative Access Controls
The policies and procedures defined by an organization's security policy and other regulations or requirements. These controls are sometimes referred to as management controls and they focus on personnel and business practices.
Simple Mail Transfer Protocol (SMTP)
The primary protocol used to move email messages from clients to servers and from server to server.
Separation of Privilege
The principle that builds on the principle of least privilege. It requires the use of granular access permissions - that is, different permissions for each type of privileged operation. This allows designers to assign some processes rights to perform certain supervisory functions without granting them unrestricted access to the system.
IP Spoofing
The process by which a malicious individual reconfigures their system so that it has the IP address of a trusted system and then attempts to gain access to other external resources.
Enrollment
The process of establishing a new user identity or authentication factor on a system. Secure enrollment requires physical proof of a person's identity or authentication factor. Generally, if the enrollment process takes longer than two minutes, the identification or authentication mechanism (typically biometrics) is not approved.
Accountability
The process of holding someone responsible for something. In this context, accountability is possible if a subject's identity and actions can be tracked and verified.
Hash Functions
The process of taking a full message and generating a unique output value derived from the content of the message. This value is commonly referred to as the message digest (which is 128 bits or larger).
Hash Function
The process of taking a full message and generating a unique output value derived from the content of the message. This value is commonly referred to as the message digest.
Authentication
The process of verifying or testing that the identity claimed by a subject is valid.
Encrypt
The process used to convert a message into cipher text.
Moore's Law
The processing capabilities of a state-of-the-art microprocessor will double approximately every two years.
Multiprogramming
The pseudo-simultaneous execution of two tasks on a single processor coordinated by the operating system for the purpose of increasing operational efficiency. It requires specially written software that coordinates its own activities and execution through the operating system. It is considered relatively obsolete technology and is rarely found in use today except in legacy systems.
Constrained Interfaces
The purpose is to limit or restrict the actions of both authorized and unauthorized users. The use of such an interface is a practical implementation of the Clark-Wilson model of security.
Terrorist Attacks
The purpose of this type of attack is to disrupt normal life and instill fair.
Modulo Function
The remainder value left over after a division operation is performed.
Need to Know
The requirement to have access to, knowledge about, or possession of data or a resource in order to perform specific work tasks. A user must have this in order to gain access to data or resources. Even if that user has an equal or greater security classification than the requested information, if they to not have this, they are denied access.
Data Analytics
The science of raw data examination with the focus of extracting useful information out of the bulk information set. The results of data analytics could focus on important outliers or exceptions to normal or standard items, a summary of all data items or some focused extraction and organization of interesting information.
Domain of an Attribute
The set of allowable values that the attribute can take
Electronic Codebook (ECB) Mode
The simplest encryption mode to understand and the least secure. Each time the algorithm processes a 64-bit block, it simply encrypts the block using the chosen secret key. This means that if the algorithm encounters the same block multiple times, it produces the same encrypted block. Used for exchanging small amounts of data.
Split Knowledge
The specific application of the ideas of separation of duties and two‐man control into a single solution. The basic idea is that the information or privilege required to perform an operation is divided among multiple users. This ensures that no single person has sufficient privileges to compromise the security of the environment.
Structured Query Language (SQL)
The standard language used by all relational databases to provide users with a consistent interface for the storage, retrieval, and modification of data and for administrative control of the DBMS. Each DBMS vendor implements a slightly different version, but all support a core feature set. Primary security feature is granularity of authorization. Access can be limited by table, row, column, or even an individual cell in some cases.
Problem State
The state associated with user mode, where privileges are low and all access requests must be checked against credentials for authorizations before they are granted or denied.
Running State
The state in which a process is actively executing. This is another name for problem state.
Stopped State
The state in which a process is finished or must be terminated. At this point, the operating system can recover all memory and other resources allocated to the process and reuse them for other processes as needed.
Supervisor State
The state in which a process is operating in a privileged, all-access mode.
Supervisory State
The state in which a process is operating in a privileged, all-access mode.
Ready State
The state in which a process is ready to execute but is waiting for its turn on the CPU.
Waiting State
The state in which a process is ready to execute but s waiting for an operation such as a keyboard input, printing, or file writing to complete.
Memory
The storage bank for information that the computer needs to keep readily available.
Data Mart
The storage facility used to secure metadata.
TEMPEST
The study and control of electronic signals produced by various types of electronic hardware, such as computers, televisions, phones, and so on. It's primary goal is to prevent EM and RF radiation from leaving a strictly defined area so as to eliminate the possibility of external radiation monitoring, eavesdropping, and signal sniffing.
Cryptanalysis
The study of methods to defeat codes and ciphers.
Technology Convergence
The tendency for various technologies, solutions, utilities, and systems to evolve and merge over time.
Time of Use
The time at which the decision is made by a subject to access an object.
Number of Keys Formula
The total number of keys required to completely connect n parties using symmetric cryptography is given as follows: Number of Keys = n* (n-1)/2.
Kerberos - Key Distribution Center
The trusted third party that provides authentication services. Kerberos uses symmetric-key cryptography to authenticate clients to servers. All clients and servers register with the ___________, and it maintains the secret keys for all network members.
Control
The use of access rules or countermeasures to limit a subject's access to an object.
Layering
The use of multiple security controls in series to provide for maximum effectiveness of security deployment. Similar to the structure of the ring model used for operating modes (most sensitive functions are at the core, surrounded by a series of increasingly larger concentric circles. Using levels, rather than rings, the highest highest level is the most privileged, while the lowest level is the least privileged. Top layer of a multilevel system is the same as the sender ring of a protection ring schema.
Ground
The wire in an electrical circuit that is grounded.
Full-Interruption Test
These tests operate like parallel tests, but they involve actually shutting down operations at the primary site and shifting them to the recovery site. These tests are extremely difficult to arrange, and resistance is often encountered from management.
Security Guards
They can be posted around a perimeter or inside to monitor access points or watch detection and surveillance monitors. The real benefit is that they are able to adapt and react to various conditions or situations. They can learn and recognize attack and intrusion activities and patterns, can adjust to a changing environment, and make decisions and judgment calls.
Role-Based Access Control (Role-BAC)
This access control model defines a subject's ability to access an object based on the subject's role or assigned tasks and is often implemented using groups.
Auxiliary Station System
This alarm system can be added to either local or centralized alarm systems. When the security perimeter is breached, emergency services are notified to respond to the incident and arrive at the location. This could include fire, police, and medical services.
Proprietary Alarm System
This alarm system is similar to a central station system, but the host organization has its own onsite security staff waiting to respond to security breaches.
Central Station Alarm
This alarm system is usually silent locally, but offsite monitoring agents are notified so they can respond to the security breach. Most residential security systems are this type. Most of these systems are well-known or national security companies, such as Brinks and ADT.
Hashed Message Authentication Code (HMAC)
This algorithm implements a partial digital signature - it guarantees the integrity of a message during the transmission, but it does not provide for nonrepudiation. - It can be combined with any standard message digest generation algorithm, such as SHA-2, by using a shared secret. Therefore only communicating parties who know the key can generate or verify the digital signature. - Because this algorithm relies on a shared secret key, it does not provide any nonrepudiation functionality. - It represents a halfway point between unencrypted use of a message digest algorithm and computationally expensive digital signature algorithms based on public key cryptography.
Secure Remote Procedure Call (S-RPC)
This is an authentication service and is simply a means to prevent unauthorized execution of code on remote systems.
Secure State Machine
This machine model always: 1. boots into a secure state, 2. maintains a secure state across all transitions, and 3. allows subjects to access resources only in a secure manner compliant with security policy.
Separation of Duties and Responsibilities
This principle ensures that sensitive functions are split into tasks performed by two or more employees. It helps to prevent fraud and errors by creating a system of checks and balances.
Need to Know
This principle ensures that subjects are granted access only to what they need to know for their work tasks and job functions. Subjects may have clearance to access classified or restricted data but are not granted authorization to the data unless they actually need it to perform a job.
Online Certificate Status Protocol (OCSP)
This protocol eliminates the latency inherent in the use of CRLs by providing a means for real-time certificate verification.
Statistical Attack
This type of attack exploits statistical weaknesses in a cryptosystem, such as floating-point errors or an inability to produce random numbers. It attempts to find vulnerabilities in the hardware or operating system hosting the cryptography application.
Implementation Attack
This type of attack exploits weaknesses in the implementation of a cryptography system. It focuses on exploiting the software code, not just errors and flaws but methodology employed to program the encryption system.
Infrastructure Mode
This wireless mode means a wireless access point is required, wireless NICs on systems can't interact directly, and the restrictions of the wireless access point for wireless network access are enforced.
Ad Hoc Mode
This wireless mode means that any two wireless networking devices, including two wireless network interface cards (NICs), can communicate without centralized control authority.
Exigent Circumstances
Those in which there is an immediate threat to human life or of evidence being destroyed. This is the one exception to the requirement for a search warrant in computer crimes.
STRIDE
Threat categorization scheme used in relation to assessing threats against applications or operating systems: - Spoofing - Tampering - Repudiation - Information Disclosure - Denial of Service (DoS) - Elevation of Privilege
Government Data Classifications and Adverse Impact from a Data Breach
Top Secret - unauthorized disclosure could be expected to cause exceptionally grave damage to national security. Secret - unauthorized disclosure could be expected to cause serious damage to national security. Confidential - unauthorized disclosure could be expected to cause damage to national security. Unclassified - any data that doesn't meet one of the descriptions for top secret, secret, or confidential data.
Remote Journaling
Transferring copies of the database transaction logs containing the transactions that occurred since the previous bulk transfer. Transfers occur on a frequent basis, usually once every hour and sometimes more frequently.
DoS and DDoS
Two basic forms: - Attacks exploiting a vulnerability in hardware or software; and - Attacks that flood the victim's communication pipeline with garbage network traffic.
Real Memory
Typically the largest RAM storage resource available to the computer. It is normally composed of a number of dynamic RAM chips and therefore must be refreshed by the CPU on a periodic basis; also known as main memory or primary memory.
TCP Header Flag Field Values
URG - Urget - Indicates urgent data ACK - Acknowledgement - Acknowledges synchronization or shutdown request PSH - Push - Indicates need to push data immediately to application RST - Reset - Causes immediate disconnect of TCP session SYN - Synchronization - Requests synchronization with new sequencing numbers FIN - Finish - Requests graceful shutdown of TCP session "Unskilled Attackers Pester Real Security Folk"
Role - Senior Manager
Ultimately responsible for security
Back Door
Undocumented command sequences that allow individuals with knowledge of it to bypass normal access restrictions. They may be placed and left by the manufacturer or planted by hackers using exploits.
Back Doors
Undocumented command sequences that allow individuals with knowledge of the back door to bypass normal access restrictions. They may be placed and left by the manufacturer or planted by hackers using exploits.
Phreakers
Use various types of technology to circumvent the telephone system to make free long-distance calls, to alter the function of telephone service, to steal specialized services, and even to cause service disruptions.
Meet in the Middle Attack
Used to defeat encryption algorithms that use two rounds of encryption. An attack in which the attacker uses a known plain-text message. The plain text is then encrypted using every possible key (k1), while the equivalent cipher text is decrypted using all possible keys (k2). When a match is found, the corresponding pair (k1, k2) represents both portions of the double encryption.
Extensible Access Control Markup Language (XACML)
Used to define access control policies within an XML format, and it commonly implements role-based access controls. It helps provide assurance to all members in a federation that they are granting the same level of access to different roles.
Dynamic NAT
Used to grant multiple internal clients access to a few leased public IP addresses.
Static NAT
Used when a specific internal client's IP address is assigned a permanent mapping to a specific external public IP address.
Compartmented Mode Workstations (CMW)
Users with the necessary clearances can process multiple compartments of data at the same time. It requires that two forms of security labels be placed on objects: - Sensitivity Levels - describe the levels at which objects must be protected. These are common among all four of the modes - Information Labels - prevent data overclassification and associate additional information with the objects, which assists in proper and accurate data labeling not related to access control.
Gas Discharge Systems
Usually more effective than water discharge systems, but they should not be used in environments in which people are located. These systems usually remove the oxygen from the air,making them hazardous to personnel. They employ a pressurized gaseous suppression medium, such as CO2, halon, or FM-200 (a halon replacement).
Process States/Operating States
Various forms of execution in which a process may run.
Kerberos - Authentication Service
Verifies or rejects the authenticity and timeliness of tickets. This server is often called the KDC.
Input Validation
Verifies that the values provided by a user match the programmer's expectation before allowing further processing. Related terms: limit check, escaping input
Database Contamination
What happens when data or records of different values, classifications, security domains, and the like are co-mingled or mixed together. It can by a form of integrity and confidentiality violation.
"Best Evidence Rule"
When a document is used as evidence in a court proceeding, the original document must be introduced.
"Parole Evidence Rule"
When an agreeent between parties is put into written form, the written document is assumed to contain all the terms of the agreement and no verbal agreements may modify the written agreement.
Entrapment
When law enforcement, or an agent of law enforcement, persuades someone to commit a crime when the person otherwise had no intention to commit a crime.
Register Addressing
When the CPU needs information from one of its registers to complete an operation, it uses a register address to access its contents.
Computer Fraud and Abuse Act (CFAA) of 1986
Widened coverage of the CCCA of 1984 to include: 1. Any computer used exclusively by the US government. 2. Any computer used by a financial institution. 3. Any computer used by the government or financial institution when the offense impeded the ability of the government or institution to use that system. 4. Any combination of computers used to commit an offense when they are not all located in the same state.
Jamming or Noise Generators
Work on the idea that it is difficult or impossible to retrieve a signal when there is too much interference. This, by broadcasting your own interference, you can prevent unwanted electromagnetic (EM) interception.
Software License Agreement - Contractual License Agreements
Written agreements between a software vendor and a user
Software License Agreement - Shrink-wrap agreements
Written on software packaging and take effect when a user opens the package
Comprehensive Crime Control Act (CCCA) of 1984
Written to exclusively cover crimes that crossed state boundaries. Major provisions - it is a crime to perform: 1. Access classified information or financial information in a federal system without authorization. 2. Access a computer used exclusively by the federal government w/o authorization. 3. Use a federal computer to perpetrate fraud. 4. Cause malicious damage to a federal computer system >$1,000. 5. Modify medical records in a computer when doing so affects patient care. 6. Traffic in computer passwords if the trafficking affects interstate commerce or involves a federal computer system.
Authentication Header (AH)
One of two primary components of IPSec. It provides authentication, integrity, and non repudiation.
Feedback Composition Theory
One system provides input to another system, which reciprocates by reversing these roles (so that system A first provides input for system B and then system B provides input to system A).
Hookup Composition Theory
One system sends input to another system but also sends input to external entities.
Relational Database
A database that consists of tables that contain a set of related records.
Discretionary Access Controls (DAC)
This access control model allows the owner, creator, or data custodian of an object to control and define access to that access. Permissions (such as read and modify for files) are maintained in an ACL, and owners can easily change permissions.
Manual Updates
Should be used in static environments to ensure that only tested and authorized changed are implemented.
Eavesdropping
Another term for sniffing. However, it can include more than just capturing and recording network traffic. It also includes recording or listening to audio communications, faxes, radio signals, and so on.
Confinement
The principle that allows a process to read and write to certain memory locations and resources only. This is an alternate name for the * (star) Security Property of the Bell-LaPadula model.
Economic Espionage Act of 1996
Provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties apply when the individual knows that the information will benefit a foreign government.
Data Diddling
The act of making small changes to data during storage, processing, input, output, or transaction rather than obviously altering file contents or damaging or deleting entire files, typically malicious in intent.
Privileges
The combination of rights and permissions. Example: an administrator for a computer will have full privileges granting the administrator full rights and permissions on the computer.
Logical Topology
The logical operation of a network. It defines the arrangement and organization of devices as well as the means used to communicate to and with each other. Also known as signal topology.
Attenuation
The loss of signal strength and integrity on a cable because of the length of the cable.
Dry Pipe System
Contains compressed air. Once suppression is triggered, the air escapes, opening a water valve that in turn causes the pipes to fill and discharge water into the environment.
Applets
Code objects sent from a server to a client to perform some action. They are self-contained miniature programs that execute independently of the server that sent them.
Certificate Path Validation (CPV)
Each certificate in a certificate path from the original start or root of trust down to the server or client in question is valid and legitimate. This can be important if you need to verify that every link between "trusted" endpoints remains current, valid, and trustworthy.
Secondary Storage
Data repositories that include magnetic and optical media, such as tapes, disks, hard drives, and CD/DVD storage.
Data Remanence
Data that remains on the media after the data has been supposedly removed. Purging and sanitization methods attempt to ensure that all data is removed from media without any data remanence.
Protected Extensible Authentication Protocol (PEAP)
Encapsulate EAP in a TLS tunnel. - It is used for securing communications over 802.11 wireless communications. - It can be employed by Wi-Fi Protected Access (WPA) and WPA-2 connections.
Evaluation Assurance Levels (EALs)
EAL1 - Functionally tested EAL2 - Structurally tested EAL3 - Methodically tested and checked EAL4 - Methodically designed, tested, and reviewed EAL5 - Semi-formally designed, and tested EAL6 - Semi-formally verified, designed, and tested EAL7 - Formally verified, designed, and tested
Firmware Version Control
Firmware updates should be implemented on a manual basis, only after a testing and review.
Primary Rate Interface (PRI)
As ISDN service type that provides up to 23 B channels and one D channel. Thus, a full PRI ISDN connection offers 1.544 Mbps throughput, the same as a T1 line.
Recovery Access Controls
Attempts to repair or restore resources, functions, and capabilities after a security policy violation. These controls are an extension of corrective controls but have more advanced or complex abilities.
Examples of Logical/Technical Access Controls
Authentication methods (such as passwords, smart cards, and biometrics), encryption, constrained interfaces, access control lists, protocols, firewalls, routers, intrusion detection systems, and clipping levels.
5-4-3 Rule
Between any two nodes, there can be a maximum of 5 segments connected by 4 repeaters/concentrator, and it states that only 3 of those five segments can be populated (in other words, have additional or other user, server, or networking device connections). * This rule does not apply to switched networks or the use of bridges or routers.
Control Redundancy and Diversity
By using these concepts, a static environment can avoid the pitfalls of a single security feature failing; the environment has several opportunities to feel the, deny, detect, and deter any threat.
Fire Extinguisher Classes
Class Type Suppression Material A Common Combustibles Water, soda acid (a dry powder or liquid chemical) B Liquids CO2, halon*, soda-acid C Electrical CO2, halon* D Metal Dry powder
Non-Governement Classifications and Adverse Impact from a Data Breach
Class3/Confidential/Proprietary - exceptionally grave damage Class2/Private - serious damage Class1/Sensitive - damage Class0/Public - no damage
Security Assessments
Comprehensive reviews of the security of a system, application, or other tested environment. - Include a thoughtful review of the threat environment, current and future risks, and the value of the targeted environment. - Main work product of this type of engagement is an assessment report addressed to management that contains the results of the assessment in nontechnical language and concludes with specific recommendations for improving the security of the tested environment.
Static Testing
Evaluates the security of software without running it by analyzing either the source code or the compiled application.
Testimonial Evidence
Evidence consisting of the testimony of a witness, either verbal testimony in court or written testimony in a recorded deposition.
White-Box Testing
Examines the internal logical structures of a program and steps through the code line by line, analyzing the program for potential errors.
Public Key Encryption
Exchange of a secret key over the secure public key link.
Security Layers
Exists where devices with different levels of classification or sensitivity are grouped together and isolated from other groups with different levels. A lower level may not be able to initiate communication with a higher level, but a higher level may initiate with a lower level. This can be logical or physical.
Piggybacking
Following someone through a secured gate or doorway without being identified or authorized personally.
Transport Layer Security (TLS)
Functions in the same general manner as SSL, but it uses stronger authentication and encryption protocols. Can be used to encrypt UDP and Session Initiation Protocol (SIP) connections.
Examples of Physical Access Controls
Guards, fences, motion detectors, locked doors, sealed windows, lights, cable protection, laptop locks, badges, swipe cards, guard dogs, video cameras, man traps, and alarms.
Bluejacking
Hijacking a Bluetooth connection to eavesdrop or extract information from devices.
Kerberos - Authentication Server
Hosts the functions of the KDC: a ticket-granting service (TGS), and an authentication service (AS).
Humidity
Humidity in a computer room should be maintained between 40 and 60 percent.
Transport Mode
IPSec mode of operation whereby only the packet payload is encrypted. This mode is designed for peer-to-peer communication.
Tunnel Mode
IPSec mode of operation whereby the entire packet, including the header, is encrypted. This mode is designed for gateway-to-gateway communication.
TCP/IP Vulnerabilities
Improperly implementedTCP/IP stacks in various operating systems are vulnerable to: - buffer overflows - SYN flood attacks - various DoS attacks - fragment attacks - oversized packet attacks - spoofing attacks - man-in-the-middle attacks - hijack attacks - coding error attacks Also subject to passive attacks via monitoring or sniffing.
Remote Mirroring
Maintaining a live database server at the backup site. It is the most advanced database backup solution.
Computer Security Act (CSA) of 1987
Mandate baseline security requirements for all federal agencies. 4 main purposes of the act: 1. To give NIST responsibility for developing standards and guidelines for federal computer systems. 2. To provide for the enactment of such standards and guidelines. 3. To require the establishment of security plans by all operators of federal computer systems that contain sensitive information. 4. To require mandatory periodic training for all people involved in management, use, or operation of federal computer systems that contain sensitive information. *Divided responsibility for computer security among two federal agencies: NSA & NIST
Peer-to-peer (P2P)
Networking and distributed applications solutions that share tasks and workloads among peers. Examples: many VoIP services, such as Skype, BitTorrent, and Spotify.
Threat Modeling Approaches
Structured approach to identify relevant threats. 1. Focused on Assets - uses asset valuation results and attempts to identify threats to the valuable assets. 2. Focused on Attackers - identifies potential attackers and identifies the threats they represent based on the attacker's goals. 3. Focused on Software - if an organization develops software, it can consider potential threats against the software.
Wireless Channels
Subdivisions of a wireless frequency, but it is possible that signals in adjacent subdivisions will interfere with each other. In the US there are 11.
Test Coverage Analysis
Test Coverage = Number of UseCases Tested / Total Number of Use Cases
Green Book
The Department of Defense Password Management Guidelines, provides password creation and management guidelines; it's important for those who configure and manage trusted systems.
DNS Poisoning
The act of altering or falsifying DNS information at a source location (i.e., HOSTS file, caching DNS server, or authoritative DNS server) in order to route or misdirect legitimate traffic.
802.11
The IEEE standard for wireless network communications.
Primary Storage
The RAM that a computer uses to keep necessary information readily available.
Time of Check (TOC)
The time at which a subject checks on the status of an object.
Fire Suppression Mediums
Water - suppresses the temperature. Soda acid and other dry powders - suppress the fuel supply. CO2 - suppresses the oxygen supply. Halon substitutes and other nonflammable gasses - interfere with the chemistry of combustion and/or suppress the oxygen supply.
