Cybersecurity Quiz1

System Resource (Asset)

A major application, general support system, high impact program, physical plant, mission critical system, personnel, equipment, or a logically related group of systems.

hardware

A major threat to computer system hardware is the threat to availability. Hardware is the most vulnerable to attack and the least susceptible to automated controls. Threats include accidental and deliberate damage to equipment as well as theft. The proliferation of personal computers and workstations and the widespread use of LANs increase the potential for losses in this area. Theft of USB drives can lead to loss of confidentiality. Physical and administrative security measures are needed to deal with these threats.

Risk

A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of 1) the adverse impacts that would arise if the circumstance or event occurs; and 2) the likelihood of occurrence.

ISO

The International Organization for Standardization (ISO) is a worldwide federation of national standards bodies from more than 140 countries. ISO is a nongovernmental organization that promotes the development of standardization and related activities with a view to facilitating the international exchange of goods and services, and to developing cooperation in the spheres of intellectual, scientific, technological, and economic activity. ISO's work results in international agreements that are published as International Standards.

ITU-T

The International Telecommunication Union (ITU) is a United Nations agency in which governments and the private sector coordinate global telecom networks and services. The ITU Telecommunication Standardization Sector (ITU-T) is one of the three sectors of the ITU. ITU-T's mission is the production of standards covering all fields of telecommunications. ITU-T standards are referred to as Recommendations

Systems and Services Acquisition

(i) Allocate sufficient resources to adequately protect organizational information systems; (ii) employ system development life cycle processes that incorporate information security considerations; (iii) employ software usage and installation restrictions; and (iv) ensure that third-party providers employ adequate security measures to protect information, applications, and/or services outsourced from the organization.

Countermeasure

A device or techniques that has as its objective the impairment of the operational effectiveness of undesirable or adversarial activity, or the prevention of espionage, sabotage, theft, or unauthorized access to or use of sensitive information or information systems.

Access Control

A security measure that defines who can access a computer, device, or network, when they can access it, and what actions they can take while accessing it.

Security Policy

A set of criteria for the provision of security services. It defines and constrains the activities of a data processing facility in order to maintain a condition of security for systems and data.

Attacks (treats carried out) - active

An attempt to alter system resources or affect their operation. involve some modification of the data stream or the creation of a false stream and can be subdivided into four categories: replay, masquerade, modification of messages, and denial of service

Attacks (treats carried out) - passive

An attempt to learn or make use of information from the system that does not affect system resources. the nature of eavesdropping on, or monitoring of, transmissions. The goal of the attacker is to obtain information that is being transmitted. Two types of passive attacks are release of message contents and traffic analysis

unauthorized disclosure - interference

An example of inference is known as traffic analysis, in which an adversary is able to gain information from observing the pattern of traffic on a network, such as the amount of traffic between particular pairs of hosts on the network. Another example is the inference of detailed information from a database by a user who has only limited access; this is accomplished by repeated queries whose combined results enable inference.

unauthorized disclosure - intrusion

An example of intrusion is an adversary gaining unauthorized access to sensitive data by overcoming the system's access control protections.

recovery

An example of recovery is the use of backup systems, so that if data integrity is compromised, a prior, correct copy of the data can be reloaded.

prevention

An ideal security scheme is one in which no attack is successful. Although this is not practical in all cases, there is a wide range of threats in which prevention is a reasonable goal. For example, consider the transmission of encrypted data. If a secure encryption algorithm is used, and if measures are in place to prevent unauthorized access to encryption keys, then attacks on confidentiality of the transmitted data will be prevented.

Threat

Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

Attack

Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.

Computer Security Challenges

Because of Point 2, the procedures used to provide particular services are often counterintuitive. Typically, a security mechanism is complex, and it is not obvious from the statement of a particular requirement that such elaborate measures are needed. Only when the various aspects of the threat are considered do elaborate security mechanisms make sense.

Assets of computer system

Communication facilities and networks: Local and wide area network communication links, bridges, routers, and so on.

Computer Security Challenges

Computer security is essentially a battle of wits between a perpetrator who tries to find holes, and the designer or administrator who tries to close them. The great advantage that the attacker has is that he or she need only find a single weakness, while the designer must find and eliminate all weaknesses to achieve perfect security.

Computer Security Challenges

Computer security is not as simple as it might first appear to the novice. The requirements seem to be straightforward; indeed, most of the major requirements for security services can be given self-explanatory one-word labels: confidentiality, authentication, nonrepudiation, and integrity. But the mechanisms used to meet those requirements can be quite complex, and understanding them may involve rather subtle reasoning.

Essential Network and Computer Security Requirements

Confidentiality, Integrity, Authenticity, Accountability, Availability

attack surfaces

Consist of the reachable and exploitable vulnerabilities in a system

Audit and Accountability

Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

Assets of computer system

Data: Including files and databases, as well as security-related data, such as password files.

Availability

Ensuring timely and reliable access to and use of information

Integrity

Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity

data

Hardware and software security are typically concerns of computing center professionals or individual concerns of personal computer users. A much more widespread problem is data security, which involves files and other forms of data controlled by individuals, groups, and business organizations.

Assets of computer system

Hardware: Including computer systems and other data processing, data storage, and data communications devices

Computer Security Challenges

Having designed various security mechanisms, it is necessary to decide where to use them. This is true both in terms of physical placement (e.g., at what points in a network are certain security mechanisms needed) and in a logical sense [e.g., at what layer or layers of an architecture such as TCP/IP (Transmission Control Protocol/Internet Protocol) should mechanisms be placed].

internet society

ISOC is a professional membership society with worldwide organizational and individual membership. It provides leadership in addressing issues that confront the future of the Internet, and is the organization home for the groups responsible for Internet infrastructure standards, including the Internet Engineering Task Force (IETF) and the Internet Architecture Board (IAB). These organizations develop Internet standards and related specifications, all of which are published as Requests for Comments (RFCs).

response

If security mechanisms detect an ongoing attack, such as a denial of service attack, the system may be able to respond in such a way as to halt the attack and prevent further damage.

detection

In a number of cases, absolute protection is not feasible, but it is practical to detect security attacks. For example, there are intrusion detection systems designed to detect the presence of unauthorized individuals logged onto a system. Another example is detection of a denial of service attack, in which communications or processing resources are consumed so that they are unavailable to legitimate users.

Computer Security Challenges

In developing a particular security mechanism or algorithm, one must always consider potential attacks on those security features. In many cases, successful attacks are designed by looking at the problem in a completely different way, therefore exploiting an unexpected weakness in the mechanism.

deception - repudiation

In this case, a user either denies sending data or a user denies receiving or possessing the data.

Adversary (threat agent)

Individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.

Attacks (treats carried out) - inside

Initiated by an entity inside the security perimeter (an "insider"). The insider is authorized to access system resources but uses them in a way not approved by those who granted the authorization

Attacks (treats carried out) - outside

Initiated from outside the perimeter, by an unauthorized or illegitimate user of the system (an "outsider"). On the Internet, potential outside attackers range from amateur pranksters to organized criminals, international terrorists, and hostile governments

unauthorized disclosure - interception

Interception is a common attack in the context of communications. On a shared local area network (LAN), such as a wireless LAN or a broadcast Ethernet, any device attached to the LAN can receive a copy of packets intended for another device. On the Internet, a determined hacker can gain access to e-mail traffic and other data transfers. All of these situations create the potential for unauthorized access to data.

security implementation

Involves four complementary courses of action: - Prevention - Detection - Response - Recovery

Computer Security Challenges

Many users and even security administrators view strong security as an impediment to efficient and user-friendly operation of an information system or use of information.

usurpation - misuse

Misuse can occur by means of either malicious logic or a hacker that has gained unauthorized access to a system. In either case, security functions can be disabled or thwarted.

System and Communications Protection

Monitor, control and protect organizational communications at the external boundaries and key internal boundaries of the information systems

National Institute of Standards and Technology

NIST is a U.S. federal agency that deals with measurement science, standards, and technology related to U.S. government use and to the promotion of U.S. private sector innovation. Despite its national scope, NIST Federal Information Processing Standards (FIPS) and Special Publications (SP) have a worldwide impact.

deception - masquerade

One example of masquerade is an attempt by an unauthorized user to gain access to a system by posing as an authorized user; this could happen if the unauthorized user has learned another user's logon ID and password. Another example is malicious logic, such as a Trojan horse, that appears to perform a useful or desirable function but actually gains unauthorized access to system resources or tricks a user into executing other malicious logic.

disruption - obstruction

One way to obstruct system operation is to interfere with communications by disabling communication links or altering communication control information. Another way is to overload the system by placing excess burden on communication traffic or processing resources.

Confidentiality

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information

Certification and Accreditation

Process for implementing information Security

Computer Security Challenges

Security is still too often an afterthought to be incorporated into a system after the design is complete, rather than being an integral part of the design process.

Computer Security Challenges

Security mechanisms typically involve more than a particular algorithm or protocol. They also require that participants be in possession of some secret information (e.g., an encryption key), which raises questions about the creation, distribution, and protection of that secret information. There may also be a reliance on communications protocols whose behavior may complicate the task of developing the security mechanism. For example, if the proper functioning of the security mechanism requires setting time limits on the transit time of a message from sender to receiver, then any protocol or network that introduces variable, unpredictable delays may render such time limits meaningless.

Computer Security Challenges

Security requires regular, even constant monitoring, and this is difficult in today's short-term, overloaded environment.

software

Software includes the operating system, utilities, and application programs. A key threat to software is an attack on availability. Software, especially application software, is often easy to delete. Software can also be altered or damaged to render it useless. Careful software configuration management, which includes making backups of the most recent version of software, can maintain high availability. A more difficult problem to deal with is software modification that results in a program that still functions but that behaves differently than before, which is a threat to integrity/authenticity. Computer viruses and related attacks fall into this category. A final problem is protection against software piracy. Although certain countermeasures are available, by and large the problem of unauthorized copying of software has not been solved.

Low level of impact

The loss could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals

Moderate level of impact

The loss could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals

High level of impact

The loss could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals

Configuration Management

The process of ensuring that only authorized changes are made to a system.

Incident Response

The process of responding to a security incident. Organizations often create an incident response plan that outlines the procedures to be used when responding to an incident.

identification and authentication

The process of verifying an identity that is bound to the person that asserts it.

Authenticity

The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator. This means verifying that users are who they say they are and that each input arriving at the system came from a trusted source.

Accountability

The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity. This supports nonrepudiation, deterrence, fault isolation, intrusion detection and prevention, and after-action recovery and legal action. Because truly secure systems aren't yet an achievable goal, we must be able to trace a security breach to a responsible party. Systems must keep records of their activities to permit later forensic analysis to trace security breaches or to aid in transaction disputes.

Computer Security Challenges

There is a natural tendency on the part of users and system managers to perceive little benefit from security investment until a security failure occurs.

unauthorized disclosure - exposure

This can be deliberate, as when an insider intentionally releases sensitive information, such as credit card numbers, to an outsider. It can also be the result of a human, hardware, or software error, which results in an entity gaining unauthorized knowledge of sensitive data. There have been numerous instances of this, such as universities accidentally posting student confidential information on the Web.

usurpation - misappropriation

This can include theft of service. An example is a distributed denial of service attack, when malicious software is installed on a number of hosts to be used as platforms to launch traffic at a target host. In this case, the malicious software makes unauthorized use of processor and operating system resources.

human attack surface

This category refers to vulnerabilities created by personnel or outsiders, such as social engineering, human error, and trusted insiders.

network attack surface

This category refers to vulnerabilities over an enterprise network, wide-area network, or the Internet. Included in this category are network protocol vulnerabilities, such as those used for a denial-of-service attack, disruption of communications links, and various forms of intruder attacks.

disruption - incapacitation

This is an attack on system availability. This could occur as a result of physical destruction of or damage to system hardware. More typically, malicious software, such as Trojan horses, viruses, or worms, could operate in such a way as to disable a system or some of its services.

disruption - corruption

This is an attack on system integrity. Malicious software in this context could operate in such a way that system resources or services function in an unintended manner. Or a user could gain unauthorized access to a system and modify some of its functions. An example of the latter is a user placing backdoor logic in the system to provide subsequent access to a system and its resources by other than the usual procedure.

deception - falsification

This refers to the altering or replacing of valid data or the introduction of false data into a file or database. For example, a student may alter his or her grades on a school database.

software attack surface

This refers to vulnerabilities in application, utility, or operating system code. A particular focus in this category is Web server software.

Vulnerability

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

security policy

a business decision, possibly influenced by legal requirements

contigency plan

a plan that outlines alternative courses of action that may be taken if an organization's other plans are disrupted or become ineffective

Threats

capable of exploiting those vulnerabilities. A threat represents a potential security harm to an asset

Low impact example

cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced

High impact example

cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions

Moderate impact example

cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced

Categories if vulnerabilities

corrupted (loss of integrity), so it does the wrong thing or gives wrong answers. For example, stored data values may differ from what they should be because they have been improperly modified.

middle left

countermeasures

awareness and training

ensure users know risks and regulations. users can carry out security related duties

large attack surface and shallow layering

high security risk

assurance

is an attribute of an information system that provides grounds for having confidence that the system operates such that the system's security policy is enforced. This encompasses both system design and system implementation. Thus, assurance deals with the questions, "Does the security system design meet its requirements?" and "Does the security system implementation meet its specifications?" Assurance is expressed as a degree of confidence, not in terms of a formal proof that a design or implementation is correct. The state of the art in proving designs and implementations is such that it is not possible to provide absolute proof. Much work has been done in developing formal models that define requirements and characterize designs and implementations, together with logical and mathematical techniques for addressing these issues. But assurance is still a matter of degree.

evaluation

is the process of examining a computer product or system with respect to certain criteria. Evaluation involves testing and may also involve formal analytic or mathematical techniques. The central thrust of work in this area is the development of evaluation criteria that can be applied to any security system (encompassing security services and mechanisms) and that are broadly supported for making product comparisons.

system and information integrity

keep accurate in timely manner, security alerts

Categories of vulnerabilities

leaky (loss of confidentiality). For example, someone who should not have access to some or all of the information available through the network obtains such access.

physical and environmental protection

limit access to physical elements, protect and provide support

small attack surface and deep layering

low security risk

large attack surface and deep layering

medium security risk

small attack surface and shallow layering

medium security risk

top left

owner

Countermeasures

prevent, detect, recover

media protection

protect digital and paper data

High impact example

result in major damage to organizational assets

Low impact example

result in minor damage to organizational assets

Low impact example

result in minor financial loss

High impact example

result in severe or catastrophic harm to individuals involving loss of life or serious life-threatening injuries

Moderate impact example

result in significant damage to organizational assets

Moderate impact example

result in significant harm to individuals that does not involve loss of life or serious, life-threatening injuries

maintenance

the work that is done to keep something in good condition

Categories of vulnerabilities

unavailable or very slow (loss of availability). That is, using the system or network becomes impossible or impractical.

Assets of computer system

• Software: Including the operating system, system utilities, and applications.