Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP ISC2 2023 > CISSP (Domain 6 - Security Architecture and Design) > Flashcards

CISSP (Domain 6 - Security Architecture and Design) Flashcards

1
Q

State Machine Formal Security Model

TR/DU

A
  • Trusted recovery

- Goes down and backup, no time security controls can be bypassed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Multi-level Lattice Formal Security Model

RPC/SO

A

Compares roles, their permissions, and clearance levels with the sensitivity level of the object to determine access level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Non-Interference Formal Security Model

A

Users are separated into different security domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Information Flow Formal Security Model

A

Looks at the information flows in a state machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Bell-LaPadula Security Model

pc/nru-nwd/int/exe/class/secmod

A
  • Protects confidentiality
  • *No read up, No write down
  • Dealing with internal threat
  • Any executed activity will always result in a secure state
  • Classification of subject does not change while referenced
  • Information flow security model
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Biba Security Model

pi/nrd-nwu/ext/cant/hier/so

A
  • Protects integrity
  • *No read down, No write up
  • Dealing with external threat
  • Cant depend on less trusted object
  • Based on hierarchical lattice of integrity levels
  • Subjects and objects
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Clark-Wilson Security Model

pi/wft-sod/spo/part/prog

A
  • Protects integrity
  • Requires a well-formed transaction and SoD
  • Subject->Program->Object
  • Partitions objects unlike Biba/Bell

Subject must go through a program to access and modify data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Clark-Wilson 3 Integrity Goals

um/aim/mc/db

A
  • Prevent unauthorized users from making modifications
  • Prevent authorized users from making improper modifications
  • Maintains internal and external consistency

*DB’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

4 Rules to Follow When Implementing Clark-Wilson Security Model
(prop/subp/objp/rec)

A
  • All users need to be properly ID’d and AuthN
  • Subjects can only access certain programs
  • Objects can only be accessed by certain programs
  • Record each transaction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Brewer and Nash Security Model (Chinese Wall)

prev/a!b/fraud

A
  • Prevents conflict of interest
  • Company A cant see Company B’s data
  • Tries to ensure that users do not make fraudulent modifications to objects
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Graham-Denning Security Model

soc/srp/oom

A
  • How subjects and objects are created
  • How subjects are assigned rights or privileges
  • How ownership of objects is managed.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

8 Primitive Protection Rights (Graham-Denning)

co/cs/do/ds/rar/gar/dar/tar

A
  • Create Object
  • Create Subject
  • Delete Object
  • Delete Subject
  • Read Access Right
  • Grant Access Right
  • Delete Access Right
  • Transfer Access Right
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

4 Rules to the Take Grant Security Model (Like Graham-Denning)
(sco/sdo/gao/rao)

A
  • Subject can create objects
  • Subject can delete objects
  • Grant access to owned object
  • Remove access to owned object
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Harrison Ruzzo Ullman Security Model (Like Graham-Denning)

A

More granular controls for subjects to access objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ISO/SEC 15408 Common Criteria

A

Helps reduce complexity of the ratings and eliminating the need to understand the definition and meaning of different ratings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

4 Components of ISO/SEC 15408 Common Criteria

PP/TE/ST/P

A
  • Protection Profile: Description of needed security solution (all systems should be protected by sec software)
  • Target Evaluation: Product proposed to provide needed security solution
  • Security Target: Written by vendor explaining security functionality and assurance
  • Packages - Evaluation Assurance Levels (EAL): Security requirements bundled into packages for re-use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Security Product Evaluation Ratings (1-7)

ft/st/mtc/mdtr/sfdt/sfvdt/fvdt

A
  • *EAL 1: Functionally tested (Works when on)
  • EAL 2: Structurally tested
  • EAL 3: Methodically tested and checked
  • EAL 4: Methodically designed, tested, and reviewed
  • EAL 5: Semi-formally designed and tested
  • EAL 6: Semi-formally verified, designed, and tested
  • *EAL 7: Formally verified, designed, and tested (Very Specific)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Certification

A

Works in “my” environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Accreditation

A

Validation in production

20
Q

Supervisor CPU State

km/ring/prog/both

A
  • Kernel/Protected/Privileged Mode
  • Ring 0
  • Program can access entire system
  • Both privileged and non-privileged instructions
21
Q

Problem CPU State

um/ring/non/app

A
  • User/Program Mode
  • Ring 3
  • Only non-privileged instructions are executed
  • Intended for application programs
22
Q

Multi-threading

A

Tasks don’t interfere with each other

23
Q

Multi-tasking

A

Simultaneous execution of two or more programs

24
Q

Multi-programming

A

Interleaved execution of two or more program by one CPU

25
Q

Reference Monitor

A

Abstract machine that controls the access subjects have to objects

26
Q

Security Kernel

A

Components in system that enforce the rules of the reference monitor(hardware, firmware, and software)

*Admin of reference monitor

27
Q

3 Security Requires of Security Kernel

IAM

A
  • Isolated: Protected from unauthorized access
  • Active: Active all the time
  • Monitor: Evaluate reference monitor to make sure its working properly
28
Q

Multi-processing

A

More than one CPU and they can process the request in parallel.

29
Q

Trusted Computing Base (TCB)

A

Total combination of protection mechanisms within a computer system.

Address the level of trust in a system, not a level of security

30
Q

Security Perimeter of TCB

A

The buffer between TCB and non-TCB objects

31
Q

Covert Channels

A

Sending information in an unauthorized manner using a medium in an unintended way

  • Data going over HTTP but its not web traffic
32
Q

Timing Covert Channel

A

A process relays information to another by modulating its use of system resources

33
Q

Storage Covert Channel

A

A process writes data to a storage location, and another process of lower clearance reads it.

34
Q

5 Threats to Software and Systems

B/TA/BO/I/A

A
  • Backdoors
  • Timing Attacks
  • Buffer Overflows
  • Inference
  • Aggregation
35
Q

Back Doors

A
  • Accessing a system by bypassing access controls
  • Attacker has access at any time

*Maintenance Hook

36
Q

Timing Attacks

A
  • Take advantage of the time between events in a sequence

- Time of Check/Time of Use & Race Conditions

37
Q

Time of Check/Time of Use (TOC/TOU)

A

Attack takes place after the system checks a specific file of the system before the system actually uses that file

38
Q

Race Conditions

A

Two processes race to carry out conflicting actions at the same time. Attacker must slow/speed up one process to get to work

39
Q

Data Validation

A

Process of reviewing data against a per-established set of criteria

40
Q

Code Injection

A

Input must be validated for range/type/length (SQL Injection)

41
Q

Buffer Overflow

A

If an application does not verify the amount of information being input, the data can overwrite other memory segments (Execute in privilege mode)

42
Q

Inference

A

Act or process of deriving logical conclusions from premises known or assumed to be true (Finding Apache version)

43
Q

Aggregation

A

A massive together or clustering of independent but similar units, such as data elements (Multiple data items together DOB & First and Last)

44
Q

Countermeasure Principals - Defense in Depth (3 Things)

PTO

A
  • People
  • Technology
  • Operations
45
Q

Defense in Depth - People

A

Achieving information assurance beings with a senior level management commitment (typically at the CIO level)

46
Q

Defense in Depth - Technology

A

Wide range of technologies available for providing information assurance services and for detecting intrusions

47
Q

Defense in Depth - Operations

A

Focuses on all the activities required to sustain an organizations security posture on a day to day basis

CISSP ISC2 2023 (90 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions