Cybersecurity Quiz1
System Resource (Asset)
A major application, general support system, high impact program, physical plant, mission critical system, personnel, equipment, or a logically related group of systems.
hardware
A major threat to computer system hardware is the threat to availability. Hardware is the most vulnerable to attack and the least susceptible to automated controls. Threats include accidental and deliberate damage to equipment as well as theft. The proliferation of personal computers and workstations and the widespread use of LANs increase the potential for losses in this area. Theft of USB drives can lead to loss of confidentiality. Physical and administrative security measures are needed to deal with these threats.
Risk
A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of 1) the adverse impacts that would arise if the circumstance or event occurs; and 2) the likelihood of occurrence.
ISO
The International Organization for Standardization (ISO) is a worldwide federation of national standards bodies from more than 140 countries. ISO is a nongovernmental organization that promotes the development of standardization and related activities with a view to facilitating the international exchange of goods and services, and to developing cooperation in the spheres of intellectual, scientific, technological, and economic activity. ISO's work results in international agreements that are published as International Standards.
ITU-T
The International Telecommunication Union (ITU) is a United Nations agency in which governments and the private sector coordinate global telecom networks and services. The ITU Telecommunication Standardization Sector (ITU-T) is one of the three sectors of the ITU. ITU-T's mission is the production of standards covering all fields of telecommunications. ITU-T standards are referred to as Recommendations
Systems and Services Acquisition
(i) Allocate sufficient resources to adequately protect organizational information systems; (ii) employ system development life cycle processes that incorporate information security considerations; (iii) employ software usage and installation restrictions; and (iv) ensure that third-party providers employ adequate security measures to protect information, applications, and/or services outsourced from the organization.
Countermeasure
A device or techniques that has as its objective the impairment of the operational effectiveness of undesirable or adversarial activity, or the prevention of espionage, sabotage, theft, or unauthorized access to or use of sensitive information or information systems.
Access Control
A security measure that defines who can access a computer, device, or network, when they can access it, and what actions they can take while accessing it.
Security Policy
A set of criteria for the provision of security services. It defines and constrains the activities of a data processing facility in order to maintain a condition of security for systems and data.
Attacks (treats carried out) - active
An attempt to alter system resources or affect their operation. involve some modification of the data stream or the creation of a false stream and can be subdivided into four categories: replay, masquerade, modification of messages, and denial of service
Attacks (treats carried out) - passive
An attempt to learn or make use of information from the system that does not affect system resources. the nature of eavesdropping on, or monitoring of, transmissions. The goal of the attacker is to obtain information that is being transmitted. Two types of passive attacks are release of message contents and traffic analysis
unauthorized disclosure - interference
An example of inference is known as traffic analysis, in which an adversary is able to gain information from observing the pattern of traffic on a network, such as the amount of traffic between particular pairs of hosts on the network. Another example is the inference of detailed information from a database by a user who has only limited access; this is accomplished by repeated queries whose combined results enable inference.
unauthorized disclosure - intrusion
An example of intrusion is an adversary gaining unauthorized access to sensitive data by overcoming the system's access control protections.
recovery
An example of recovery is the use of backup systems, so that if data integrity is compromised, a prior, correct copy of the data can be reloaded.
prevention
An ideal security scheme is one in which no attack is successful. Although this is not practical in all cases, there is a wide range of threats in which prevention is a reasonable goal. For example, consider the transmission of encrypted data. If a secure encryption algorithm is used, and if measures are in place to prevent unauthorized access to encryption keys, then attacks on confidentiality of the transmitted data will be prevented.
Threat
Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.
Attack
Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.
Computer Security Challenges
Because of Point 2, the procedures used to provide particular services are often counterintuitive. Typically, a security mechanism is complex, and it is not obvious from the statement of a particular requirement that such elaborate measures are needed. Only when the various aspects of the threat are considered do elaborate security mechanisms make sense.
Assets of computer system
Communication facilities and networks: Local and wide area network communication links, bridges, routers, and so on.
Computer Security Challenges
Computer security is essentially a battle of wits between a perpetrator who tries to find holes, and the designer or administrator who tries to close them. The great advantage that the attacker has is that he or she need only find a single weakness, while the designer must find and eliminate all weaknesses to achieve perfect security.
Computer Security Challenges
Computer security is not as simple as it might first appear to the novice. The requirements seem to be straightforward; indeed, most of the major requirements for security services can be given self-explanatory one-word labels: confidentiality, authentication, nonrepudiation, and integrity. But the mechanisms used to meet those requirements can be quite complex, and understanding them may involve rather subtle reasoning.
Essential Network and Computer Security Requirements
Confidentiality, Integrity, Authenticity, Accountability, Availability
attack surfaces
Consist of the reachable and exploitable vulnerabilities in a system
Audit and Accountability
Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.
Assets of computer system
Data: Including files and databases, as well as security-related data, such as password files.
Availability
Ensuring timely and reliable access to and use of information
Integrity
Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity
data
Hardware and software security are typically concerns of computing center professionals or individual concerns of personal computer users. A much more widespread problem is data security, which involves files and other forms of data controlled by individuals, groups, and business organizations.
Assets of computer system
Hardware: Including computer systems and other data processing, data storage, and data communications devices
Computer Security Challenges
Having designed various security mechanisms, it is necessary to decide where to use them. This is true both in terms of physical placement (e.g., at what points in a network are certain security mechanisms needed) and in a logical sense [e.g., at what layer or layers of an architecture such as TCP/IP (Transmission Control Protocol/Internet Protocol) should mechanisms be placed].
internet society
ISOC is a professional membership society with worldwide organizational and individual membership. It provides leadership in addressing issues that confront the future of the Internet, and is the organization home for the groups responsible for Internet infrastructure standards, including the Internet Engineering Task Force (IETF) and the Internet Architecture Board (IAB). These organizations develop Internet standards and related specifications, all of which are published as Requests for Comments (RFCs).
response
If security mechanisms detect an ongoing attack, such as a denial of service attack, the system may be able to respond in such a way as to halt the attack and prevent further damage.
detection
In a number of cases, absolute protection is not feasible, but it is practical to detect security attacks. For example, there are intrusion detection systems designed to detect the presence of unauthorized individuals logged onto a system. Another example is detection of a denial of service attack, in which communications or processing resources are consumed so that they are unavailable to legitimate users.
Computer Security Challenges
In developing a particular security mechanism or algorithm, one must always consider potential attacks on those security features. In many cases, successful attacks are designed by looking at the problem in a completely different way, therefore exploiting an unexpected weakness in the mechanism.
deception - repudiation
In this case, a user either denies sending data or a user denies receiving or possessing the data.
Adversary (threat agent)
Individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.
Attacks (treats carried out) - inside
Initiated by an entity inside the security perimeter (an "insider"). The insider is authorized to access system resources but uses them in a way not approved by those who granted the authorization
Attacks (treats carried out) - outside
Initiated from outside the perimeter, by an unauthorized or illegitimate user of the system (an "outsider"). On the Internet, potential outside attackers range from amateur pranksters to organized criminals, international terrorists, and hostile governments
unauthorized disclosure - interception
Interception is a common attack in the context of communications. On a shared local area network (LAN), such as a wireless LAN or a broadcast Ethernet, any device attached to the LAN can receive a copy of packets intended for another device. On the Internet, a determined hacker can gain access to e-mail traffic and other data transfers. All of these situations create the potential for unauthorized access to data.
security implementation
Involves four complementary courses of action: - Prevention - Detection - Response - Recovery
Computer Security Challenges
Many users and even security administrators view strong security as an impediment to efficient and user-friendly operation of an information system or use of information.
usurpation - misuse
Misuse can occur by means of either malicious logic or a hacker that has gained unauthorized access to a system. In either case, security functions can be disabled or thwarted.
System and Communications Protection
Monitor, control and protect organizational communications at the external boundaries and key internal boundaries of the information systems
National Institute of Standards and Technology
NIST is a U.S. federal agency that deals with measurement science, standards, and technology related to U.S. government use and to the promotion of U.S. private sector innovation. Despite its national scope, NIST Federal Information Processing Standards (FIPS) and Special Publications (SP) have a worldwide impact.
deception - masquerade
One example of masquerade is an attempt by an unauthorized user to gain access to a system by posing as an authorized user; this could happen if the unauthorized user has learned another user's logon ID and password. Another example is malicious logic, such as a Trojan horse, that appears to perform a useful or desirable function but actually gains unauthorized access to system resources or tricks a user into executing other malicious logic.
disruption - obstruction
One way to obstruct system operation is to interfere with communications by disabling communication links or altering communication control information. Another way is to overload the system by placing excess burden on communication traffic or processing resources.
Confidentiality
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information
Certification and Accreditation
Process for implementing information Security
Computer Security Challenges
Security is still too often an afterthought to be incorporated into a system after the design is complete, rather than being an integral part of the design process.
Computer Security Challenges
Security mechanisms typically involve more than a particular algorithm or protocol. They also require that participants be in possession of some secret information (e.g., an encryption key), which raises questions about the creation, distribution, and protection of that secret information. There may also be a reliance on communications protocols whose behavior may complicate the task of developing the security mechanism. For example, if the proper functioning of the security mechanism requires setting time limits on the transit time of a message from sender to receiver, then any protocol or network that introduces variable, unpredictable delays may render such time limits meaningless.
Computer Security Challenges
Security requires regular, even constant monitoring, and this is difficult in today's short-term, overloaded environment.
software
Software includes the operating system, utilities, and application programs. A key threat to software is an attack on availability. Software, especially application software, is often easy to delete. Software can also be altered or damaged to render it useless. Careful software configuration management, which includes making backups of the most recent version of software, can maintain high availability. A more difficult problem to deal with is software modification that results in a program that still functions but that behaves differently than before, which is a threat to integrity/authenticity. Computer viruses and related attacks fall into this category. A final problem is protection against software piracy. Although certain countermeasures are available, by and large the problem of unauthorized copying of software has not been solved.
Low level of impact
The loss could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals
Moderate level of impact
The loss could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals
High level of impact
The loss could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals
Configuration Management
The process of ensuring that only authorized changes are made to a system.
Incident Response
The process of responding to a security incident. Organizations often create an incident response plan that outlines the procedures to be used when responding to an incident.
identification and authentication
The process of verifying an identity that is bound to the person that asserts it.
Authenticity
The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator. This means verifying that users are who they say they are and that each input arriving at the system came from a trusted source.
Accountability
The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity. This supports nonrepudiation, deterrence, fault isolation, intrusion detection and prevention, and after-action recovery and legal action. Because truly secure systems aren't yet an achievable goal, we must be able to trace a security breach to a responsible party. Systems must keep records of their activities to permit later forensic analysis to trace security breaches or to aid in transaction disputes.
Computer Security Challenges
There is a natural tendency on the part of users and system managers to perceive little benefit from security investment until a security failure occurs.
unauthorized disclosure - exposure
This can be deliberate, as when an insider intentionally releases sensitive information, such as credit card numbers, to an outsider. It can also be the result of a human, hardware, or software error, which results in an entity gaining unauthorized knowledge of sensitive data. There have been numerous instances of this, such as universities accidentally posting student confidential information on the Web.
usurpation - misappropriation
This can include theft of service. An example is a distributed denial of service attack, when malicious software is installed on a number of hosts to be used as platforms to launch traffic at a target host. In this case, the malicious software makes unauthorized use of processor and operating system resources.
human attack surface
This category refers to vulnerabilities created by personnel or outsiders, such as social engineering, human error, and trusted insiders.
network attack surface
This category refers to vulnerabilities over an enterprise network, wide-area network, or the Internet. Included in this category are network protocol vulnerabilities, such as those used for a denial-of-service attack, disruption of communications links, and various forms of intruder attacks.
disruption - incapacitation
This is an attack on system availability. This could occur as a result of physical destruction of or damage to system hardware. More typically, malicious software, such as Trojan horses, viruses, or worms, could operate in such a way as to disable a system or some of its services.
disruption - corruption
This is an attack on system integrity. Malicious software in this context could operate in such a way that system resources or services function in an unintended manner. Or a user could gain unauthorized access to a system and modify some of its functions. An example of the latter is a user placing backdoor logic in the system to provide subsequent access to a system and its resources by other than the usual procedure.
deception - falsification
This refers to the altering or replacing of valid data or the introduction of false data into a file or database. For example, a student may alter his or her grades on a school database.
software attack surface
This refers to vulnerabilities in application, utility, or operating system code. A particular focus in this category is Web server software.
Vulnerability
Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
security policy
a business decision, possibly influenced by legal requirements
contigency plan
a plan that outlines alternative courses of action that may be taken if an organization's other plans are disrupted or become ineffective
Threats
capable of exploiting those vulnerabilities. A threat represents a potential security harm to an asset
Low impact example
cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced
High impact example
cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions
Moderate impact example
cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced
Categories if vulnerabilities
corrupted (loss of integrity), so it does the wrong thing or gives wrong answers. For example, stored data values may differ from what they should be because they have been improperly modified.
middle left
countermeasures
awareness and training
ensure users know risks and regulations. users can carry out security related duties
large attack surface and shallow layering
high security risk
assurance
is an attribute of an information system that provides grounds for having confidence that the system operates such that the system's security policy is enforced. This encompasses both system design and system implementation. Thus, assurance deals with the questions, "Does the security system design meet its requirements?" and "Does the security system implementation meet its specifications?" Assurance is expressed as a degree of confidence, not in terms of a formal proof that a design or implementation is correct. The state of the art in proving designs and implementations is such that it is not possible to provide absolute proof. Much work has been done in developing formal models that define requirements and characterize designs and implementations, together with logical and mathematical techniques for addressing these issues. But assurance is still a matter of degree.
evaluation
is the process of examining a computer product or system with respect to certain criteria. Evaluation involves testing and may also involve formal analytic or mathematical techniques. The central thrust of work in this area is the development of evaluation criteria that can be applied to any security system (encompassing security services and mechanisms) and that are broadly supported for making product comparisons.
system and information integrity
keep accurate in timely manner, security alerts
Categories of vulnerabilities
leaky (loss of confidentiality). For example, someone who should not have access to some or all of the information available through the network obtains such access.
physical and environmental protection
limit access to physical elements, protect and provide support
small attack surface and deep layering
low security risk
large attack surface and deep layering
medium security risk
small attack surface and shallow layering
medium security risk
top left
owner
Countermeasures
prevent, detect, recover
media protection
protect digital and paper data
High impact example
result in major damage to organizational assets
Low impact example
result in minor damage to organizational assets
Low impact example
result in minor financial loss
High impact example
result in severe or catastrophic harm to individuals involving loss of life or serious life-threatening injuries
Moderate impact example
result in significant damage to organizational assets
Moderate impact example
result in significant harm to individuals that does not involve loss of life or serious, life-threatening injuries
maintenance
the work that is done to keep something in good condition
Categories of vulnerabilities
unavailable or very slow (loss of availability). That is, using the system or network becomes impossible or impractical.
Assets of computer system
• Software: Including the operating system, system utilities, and applications.