Domain 3 Flashcards
(181 cards)
1
Q
Shared Responsibility Model
On-Prem
(How Responsibility is delegated)
A
You 100%
- Apps
- Data
- Runtime
- Middleware
- OS
- Virtualization
- Servers
- Storage
- Networking
2
Q
Shared Responsibility Model
IaaS
(How Responsibility is delegated)
A
You 50%
- Apps
- Data
- Runtime
- Middleware
- OS
Cloud Service Provider 50%
- Virtualization
- Servers
- Storage
- Networking
3
Q
Shared Responsibility Model
PaaS
(How Responsibility is delegated)
A
You 25%
- Apps
- Data
Cloud Service Provider 75%
- Runtime
- Middleware
- OS
- Virtualization
- Servers
- Storage
- Networking
4
Q
Shared Responsibility Model
SaaS
(How Responsibility is delegated)
A
Cloud Service Provider 100%
- Apps
- Data
- Runtime
- Middleware
- OS
- Virtualization
- Servers
- Storage
- Networking
5
Q
Public Cloud
(Name the Pros)
A
Everything runs on CSP hardware
Scalable, Agile, pay-as-you-go, no maintenance, low skill
6
Q
Private Cloud
(Name the Pros)
A
A cloud env in your own data center
legacy support, control, compliance
7
Q
Hybrid Cloud
(Name the Pros)
A
Combines both Public / Private, allows you to run your apps in the right location
flexibility in legacy / compliance / scalability
8
Q
Cloud Access Security Broker (CASB)
A
Security policy enforcement solution that may be install On-prem or in the cloud
Shadow IT Prevention
9
Q
Post-Quantum Cryptography
A
Developing new cryptographic approaches developed by normal computers to be resilient to Quantum computers
How well do current encryption hold up to Quant?
10
Q
Post-Quantum Cryptography
Symmetric Encryption
A
- Does better
-
Grovers Algorithm: Shows Quant computer halve key length
- 256 bit key is as strong as a 128 bit to a normal computer
11
Q
Post-Quantum Cryptography
Asymmetric Encryption
A
- Does worse
-
Shor’s Algorithm: can easily break public key algos
- RSA & Elliptic Curve is vulnerable
- Lattice offers resilience
12
Q
Post-Quantum Cryptography
Lattice Algorithms
A
Based on shortest vector problem and closest vector problem
- potential to replace all current endangered schemes
- Lattice based schemes make up most publications on post-quant crypto
TIP: If a ?’s ask ab a “asymmetric encryption” that is “quant resilient”, answer is Lattice
13
Q
Cryptography
Code
A
Crypto system of symbols that operate on words or phrases and are sometimes secret but do NOT ensure confidentiality
14
Q
Cryptography
Cypher
A
Always meant to hide true meaning
15
Q
Types of Cyphers
Stream
A
Symmetric key, plaintext combined with cypher digit stream ( key stream ) . Each plaintext digit is encrypted one at a time with the corresponding digit on keystream to produce cipher text stream
16
Q
Types of Cyphers
Block
A
encrypts plain text in blocks at a time, like 64- bits
17
Q
Types of Cyphers
Substitution
A
replace each character with a different one. Ex ceasar cipher
18
Q
Types of Cyphers
Transposition
A
Shuffle each digit
19
Q
Initialization Vector (IV)
A
( Random Number ) a random string ( nonce ) that is XORed with message
used by ceasar, Vigenere, One time Pad
- main diff bt them is key length
- 1 char > word / sentence > one time pad
20
Q
One Time Pad
A
Type of substitution cypher where key stream is at least as long as the message.
Success needs:
- generated randomly
- at least as long as message
- protected from disclosure
- Pad used once then deleted
21
Q
Zero Knowledge Proof
A
specific info is exchanged but no real data transferred, only with digital signatures and certs
Prove knowledge of a fact without revealing the fact
22
Q
Split knowledge
A
The privilege required to do operation is divided among multiple users
- no single person can comprimise security
23
Q
Work Function (Work Factor)
A
Way to measure strength of crypto function by cost / time to decrypt message
24
Q
Nonrepudiation
A
provide undeniable proof that sender actually authored it.
- prevents sender from denying it
25
*DES Modes*
Electronic Codebook Mode (ECB)
**Least Secure**, encrypts 64 bit blocks with the same key.
- if same block in plaintext, same ciphertext generated
26
*DES Modes*
Cipher Block Chaining (CBC)
Plaintext XORed with Cipher text **immediately preceding**
27
*DES Modes*
Cipher Feedback (CFB)
Streaming version of CBC, Works on data in real time, used memory buffers of same block size. When buffer fills, data is encrypted and transmitted. Uses **chaining**, so **errors propagate**.
28
*DES Modes*
Output Feedback (OFB)
Similar to CFB, XORs plaintext with seed value. **No chaining** so less propagated errors
29
*DES Modes*
Counter (CTR)
Uses **incrementing counter** rather than a seed
30
Key Clustering
**Weakness** where same ciphertext is generated from 2 different keys
31
*Asymmetric Key Types*
Hash Function Requirements
1. Inputs of any length
2. **Fixed length** outputs
3. Relatively easy to **compute hash** for **any input**
4. Provide **1 way** functionality
5. **Collision Free**
32
*Asymmetric Key Types*
Rainbow Tables
Pre-computed values to ID common passwords
33
*Asymmetric Key Types*
Salt
**Random data** added to hash input.
- *salts reduce effectiveness of rainbow tables*
34
*Asymmetric Key Types*
Digital Signature Standard (DSS)
Uses SHA-1, SHA-2, SHA-3, **message digest** functions.
*Works in conjunction with 1 of 3:*
1. Digital Signature Algorithm (DSA)
2. Rivest, Shamir, Alderman (RSA)
3. Elliptic Curve DSA (ECDSA)
35
*Public Key Infrastructure (PKI)*
Certificate Authorities (CA)
Body's that generate **Digital Certificates** containing public keys of systems' Users
- Users distribute certs to who they want to talk to
- Cert recipient **verify a cert** using **CA's public key**
36
*Securing Web Traffic*
Email (Protocols)
- S/MIME
- Pretty Good Privacy (PGP)
37
*Securing Web Traffic*
Web (Protocols)
- HTTP over Transport Layer Security (TLS)
*replacing SSL*
38
*Securing Web Traffic*
Network
IPsec
39
*Securing Web Traffic*
IPsec
Architecture framework that supports **secure communications** over **IP**
- Establishes a secure channel in either **transport** mode or **tunnel** mode
- Can be used to establish direct comms between computers over **VPN**
- Uses 2 Protocols
1. Authentication Header (AH)
2. Encapsulating Security Payload (ESP)
40
Digital Rights Management (DRM)
Allow conent owners to enforce restriction on use of their content by others
- Common in entertainment industry
- Sometime protects sensitive info stored in docs
41
*Top 3 Public Key Cryptosystems*
RSA
Factoring product of prime numbers
42
*Top 3 Public Key Cryptosystems*
El Gamal
Modular arithmetic
43
*Top 3 Public Key Cryptosystems*
Elliptic Curve
Elliptic curve discrete logarithm problem and provides **more security** than the other 2
44
Digital Signature
Rely on public key crypto / hashing
**MUST use SHA-2+ hashing**
Currently approved:
- DSA
- RSA
- Elliptic Curve DSA
45
Security Model
Used to determine how security is implemented
- Formalize security Policy
- enforce CIA triad
- models lay out broad guidelines
- up to devs to decide how its functionally implemented
*Top --> Down*
- Security Policy
- Security Model
- Program Code
- OS
46
State Machine Model (SMM)
System is always secure, no matter what state it is in
- Based on FSM
- **State** - snapshot of a system
- if each state transition results in another secure state = SMM
47
Information Flow Model (IFM)
Based on SMM, focused on flow of information
- **Biba** = Flow from low to hight security level
- **Bell - LaPadula = prevent info from high to low
48
Non-Interference Model
How actions f high level affect system state of action at a low level
- ensures actions dont interfere with each other
49
Lattice Based Models
Interactions between
- **objects** - resources, computers, apps
- **subjects** - users, groups, orgs
*Used to ID levels of security for obj / subj*
50
3 Properties for Models
1. **Simple** - Rules for read
2. **Star** - Rules for write
3, **Invocation** - Rules for calls to subjects
51
*Security Models*
Biba
*Based on Integrity*
No Read down, no write up
- **Lattice Based**
- **Simple** integrity = "no read down"
- **Star** integrity = "no write up
52
*Security Models*
Bell-LaPeluda
*Based on Confidentiality*
No read up, no write down
- SMM enforces Confidentiality
- Uses Mandatory Access Controls
- **Simple** security policy "no read up"
- **Star** property "no write down"
- **Lattice Based**
53
*Security Models*
Clark - Wilson
*Integrity*
Access Control Triple, uses security **labels** to access objects
54
*Security Models*
Goguen- Meseguer
*Integrity*
Non-interference
55
*Security Models*
Sutherland
*Integrity*
Prevent interference, info flow / SMM
56
*Security Models*
Brewer + Nash
*Confidentiality*
"Chinese Wall"
Prevents conflict of interest
57
*Security Models*
Take Grant
*Confidentiality*
uses "direct graph"
Supports 4 operations:
1. Take
2. Grant
3. Create
4. Revoke
58
*Security Model: Clark - Wilson*
Constrained Data Item (CDI)
data item who integrity is **protected** by the **security model**
59
*Security Model: Clark - Wilson*
Unconstrained Data Item (UDI)
data item that is `NOT` controlled by security model
60
*Security Model: Clark - Wilson*
Integrity Verification Procedure (IVP)
a procedure that **scans** data items and **confirms** their **integrity**
61
*Security Model: Clark - Wilson*
Transformation Procedure (TP)
Only process allowed to modify a CDI
62
*Security Model: Clark - Wilson*
Access Control Triplet
1. Authenticated Principal (User / Subjects)
2. Programs (TPs)
3. Data Items (UDIs + CDIs) (objects)
63
*Security Models*
Graham - Denning Model
Protection rules where each object has an owner and controller
- focus on secure creation and deletion of both subject and object
- 8 primary protection rules:
1. Securely **create object**
2. Securely **create subject**
3. Securely **delete object**
4. Securely **delete subject**
5. Securely provide the **read** access
6. Securely provide the **grant** access
7. Securely provide the **delete** access
8. Securely provide the **transfer** access
64
Symmetric Cryptography Algorithms Table
65
Hash Algorithms Table
66
Asymmetric Cryptography Algorithms Table
67
*Security Modes*
Dedicated Mode
Security clearance that permits **access** to `ALL` info processed by system, **approval** for `ALL` info processed by system, and **valid need-to-know** for `ALL` info processed by system
68
*Security Modes*
Multilevel Mode
Can process info at *different levels* even when all system users *do not have the required security clearance* to access all info processed by the system
69
*Security Modes*
System High Mode
Each user must have valid security clearance, **access approval for** `ALL` info processed by system, and valid *need-to-know* for at least `SOME` info on the system. Offers most granular control over resources and users of thew modes
70
*Security Modes*
Compartmented Mode
*Goes one step further than system high mode*
Each user must have a valid security clearance access approval for `ALL INFO` processed by system, but requires valie need-to-know for `ALL INFO` they will have access to on the system
71
Trusted Computing Base
A **combination of hardware, software and controls** that work together to form a "trusted" base" to enforce your security policy.
- Is a subset of the complete information system.
- is the only portion that can be trusted to adhere to and enforce your security policy
- TCB must create secure channels ( *trusted paths* ) to communicate withthe rest of the system
- Protects subject from comprimise as a result of TCB interchange
72
*Trusted Computing Base*
Security Perimeter
An **imaginary boundary** that separates TCB from the rest of the system.
73
*Trusted Computing Base*
Reference Monitor
the logical part of the TCB that confirms whether a subject has the **right to use a resource** prior to granting access
`Enforces access control`
74
*Trusted Computing Base*
Security Kernel
The collection of the TCB components that implement the functionality of the reference monitor.
`Implements access control`
75
*TCSEC, ITSEC, and CC*
Common Criteria (CC, ISO-IEC 15408)
Enables and **objective evaluation** to validate that a particular product or system satisfies a defined set of security requirements
`Has replaced TCSEC and ITSEC`
76
*TCSEC, ITSEC, and CC*
Tusted Computer System Evaluation Criteria ( TCSEC )
A structured set of criteria for evaluating computer security within products and systems
77
*TCSEC, ITSEC, and CC*
Infomation Technology Security Evaluation Criteria (ITSEC)
Initial attempt to create a security eval criteria in **Europe**. Uses 2 scales to rate functionality and assurance
78
*TCSEC, ITSEC, and CC*
Common Criteria (ISO-IEC 15408)
*Cycle*
**Assumptions & Security Policies**
1. Description of Assets
2. ID of Threats
**Safety Risk Analysis**
3. Analysis & Rating of Threats
**System & Environment Objectives**
4. Determination of Security Objectives
5. Selection of Security Functional Requirements
6. Repeat
`Two Flavors`
1. community Protection Profile (cPP) = **black box**
2. Evaluation Assurance Level (EAL) = **white box**
79
*TCSEC, ITSEC, and CC*
Comparison of security eval standards Table
Video 3:05:28
80
Covert Channels
A method used to pass info over a path that is **not normally used** for comms.
- It **may not be protected** by the system's normal security controls
`Two Types`
1. Covert Timing - based on time it takes to access components: paging rate, transaction time
2. Covert Storage - Out of band storage used to convey a message: ICMP protocol uses extra storage in Ping packet to relay info
81
Trusted Platform Module
A **Chip** that is on the motherboard of a device
- Multi-purpose, like storage and mnmgt of keys used for full disk encryption (FDE) solutions
- Provides OS with **access to keys**, but prevent drive removal and data access
82
*Types of Access Control*
Mandatory Access Control (MAC)
Enforces an access policy that is `determined by the system`, not the object owner.
- Relies on **classification labels** that are representative of security domains and realms
`KEY POINT`
- Every object and subject has *one or more labels*. These labels are predefined, and the system determines access based on assigned labels
- Refered to as **lattice-based** model
83
*Types of Access Control*
Discretionary Access Control
Permits the **owner or creator** of an object to *control and define* its accessibility, because the owner has full control by default
`determined by owner`
84
*Types of Access Control*
Non-discretionary Access Control
*Enables* the enforcement of system-wide restrictions that override **object-specific** access control.
`System wide`
85
*Types of Access Control*
Rule-based Access Control
Defines **specific functions** for access to requested objects. Commonly found in firewall systems
Applies **global rules** that apply to **all subjects**. (restrictions or filters)
86
*Types of Access Control*
Role-Based Access Control
Uses a well-defined collection of `named job roles` to endow each one with *specific permissions*, thereby seeking to ensure that users who occupy such roles can access what they need to get their jobs done.
87
*MAC Model Classifications*
Hierarchical Environment
Various classification labels are assigned ina `ordered structure` from *low to medium to high security*
88
*MAC Model Classifications*
Compartmentalized environment
Requires specific **security clearances** over *compartments or domains* instead of objects
89
*MAC Model Classifications*
Hybrid environment
Contains level with compartments that are isolated from the rest of the security domain.
- *Combines* **hierarchical and compartmentalized** environments so that security levels have submcompartments
90
*Security Models, Design, and Capabilities*
Certification
**Technical Evaluation** of each part of a computer system to assess is in **agreement** with security standards
91
*Security Models, Design, and Capabilities*
Accreditation
The **process of formal acceptance** of a certified config from a designated authority.
92
*Security Models, Design, and Capabilities*
Open System
Are designed using industry standards and are usually **easy to integrate** with other open systems
93
*Security Models, Design, and Capabilities*
Closed Systems
Are generally **proprietary hardware** and / or software.
- The specifications are `NOT` **normally published** and they are usually **harder to integrate** with other systems
94
*Ensuring CIA Triad*
Confinement
Restricts a process to reading from and writing to certain memory **location**
95
*Ensuring CIA Triad*
Bounds
The **limits** of memory a process cannot exceed when reading or writing
96
*Ensuring CIA Triad*
Isolation
The mode a process runs in when it is confined through the use of **memory bounds**
97
Factors of Authentication
Something you:
- Know (pin / password)
- Have (trusted device)
- Are (biometric)
98
Authentication (AuthN)
The process of **proving** that you are who you say you are
`Identity control`
99
Authorization (AuthZ)
The act of **granting** an authenticated part permission to do something
`Access control`
100
Multitasking
Simultaneous execution of *more that one app* on a computer and is managed byt the OS
101
Multithreading
Permits *multiple concurrent tasks* to be performed within a single process.
102
Multiprocessing
The use of *more than one processor* to increase computing power
103
Multiprogramming
Similar to multi**tasking**, but takes place on *mainframe systems* and requires *specific programming*
104
*Processor Operating Modes*
User
Applications operate in a **limited instruction set** environment known as **user mode**
105
*Processor Operating Modes*
Privileged
Controlled operation are performed in privileged mode, also known as **system** mode, **kernel** mode, and **supervisory** mode.
106
*Memory Types*
Read-only Memory (ROM)
Read-only. Contents **burned in at factory**
107
*Memory Types*
RAM
Static RAM (SRAM) uses *flip flops*, dynamic RAM (DRAM) uses *capacitors*
108
*Memory Types*
PROM
Programmable chip similar to ROM, with several sub-types
109
*Memory Types*
EPROM
**Erasing, Clearing** (overwriting with unclassified data)
`Two Types:`
1. Ultraviolet EPROM (UVEPROM): Chip have a small window tha4t, when illuminated with a **special UV light, erases contents**
2. Electronically Erasable PROM (EEPROM) Uses electric voltages delivered to the pins of the chip to force erasure. *more flexible alternative to UVEPROM)
110
*Memory Types*
Flash Memory
Derivative concept from EEPROM. **Nonvolatile** can be *electronically erased and rewritten*
111
*Security Issues With Storage*
Primary Storage
same as **memory**
112
*Security Issues With Storage*
Secondary Storage
Consists of magnetic, flash, and optical media that mus be first **read into primary memory** before the CPU can use the data
113
*Security Issues With Storage*
Random Access Storage Devices
can be read at **any point***Security Issues With Storage*
114
*Security Issues With Storage*
Sequential Access Storage Devices
**require scanning** through all the data physically stored before the desired location
115
*Security Issues With Storage*
3 Main Issues
1. **Removable media** can be used to *steal data*
2. **Access controls and encryption** must be applied to protect data
3. Data can **remain on the media** even after file deletion or media formatting
116
Security Risks of Input / Output Devices
- Subject to **eavesdropping and tapping**
- Used to smuggle data out of an org
- Used to create unauthorized / insecure points of entry to a orgs system and networks
117
Firmware
Software stored on a ROM chip, containing basic **instructions** needed to start a computer. Also used to provide operating instructions in peripheral devices such as printers
118
*Vulnerabilities, Threats, & Countermeasures*
Process Isolation
ensures that individual processes can access **only their own data**
119
*Vulnerabilities, Threats, & Countermeasures*
Layering
Creates different realms of security within a process and **limits communication** between them
120
*Vulnerabilities, Threats, & Countermeasures*
Abstraction
Creates **black-box* interfaces for programmers to use without requiring knowledge of an algorithms or device inner workings
121
*Vulnerabilities, Threats, & Countermeasures*
Data Hiding
Prevents information **from being read** from a different security level. Hardware segmentation enforces process isolation with physical controls.
122
The Role of Security Policy
To inform and guide the **design, development, implementation, testing, and maintenance** of some particular system
123
Hypervisor
Also known as Virtual Machine Monitor (VMM) is the component of virtualization that **creates, manages, and operates** the VMs
`Two Types`
1. Type I hypervisor: A native or bare-metal hypervisor. In this config, there is no host OS; instead the hypervisor installs **directly** onto the hardware where the host OS would normally reside
2. Type II hypervisor: A **hosted** hypervisor. in this config a standard regular OS is present on the hardware, and the hypervisor is then installed as another software application.
124
Security-aaS
A cloud provider concept in which security is provided to an org through or by an online entity
125
Smart Devices
Mobile devices that offer customization options, typically thru **installing apps** and may use on-device or in-the-cloud AI processing
126
*Mobile Device / App Security*
Mobile Device Security
The range of potential security options or features that may be available for a mobile device. security features include full **device encryption, remote wiping, lockout, screen loicks, GPS, app control etc**
127
*Embedded Systems & Static Environments*
Embedded System
Typically designed around a limited set of **specific functions** in relation to the larger product of which its a *component*
**needs security management**
128
*Embedded Systems & Static Environments*
Static Environment
applications, OSs, hardware sets, or networks that are configured for a specific need, capability, or function and then set to remain unaltered
**needs security management**
129
*Privilege & Accountability*
Principle of least privilege
Ensures that only a minimum number of processes are authorized to run in supervisory mode.
130
*Privilege & Accountability*
Separation of privilege
Increases the granularity of secure operations
131
*Privilege & Accountability*
Accountability
Ensures that an *audit trail* exists to trace operations back to their source
132
*Common Flaws & Vulnerabilities*
Buffer Overflow
Occurs when the programmer fails to **check the size of input data** prior to writing the data in a specific memory location.
133
*Common Flaws & Vulnerabilities*
(List 3 more)
- leaving **back doors**
- leaving **privileged programs** on a system after it is deployed.
- **Time-of-check-to-time-of-use (TOCTTOU)** attacks: any state change presents an opportunity for an attacker to compromise a system
134
Functional Order of Security Controls
1. Deterrence - discourage any malicious actions
2. Denial - Deny malicious action
3. Detection - Detect and track activity
4. Delay - Delay the progress
5. Determine - the cause of the incident and figure out what is happening
6. Decide - decide on the response to implement
*If one fails move to next*
135
*Physical Security Controls*
Administrative
Include policies and procedures like
- site management
- personnell controls
- awareness training
- emergency response
136
*Physical Security Controls*
Logical / Technical
Implemented through technology like
- access controls
- intrusion detection
- alarms
- CCTV
- monitoring
- HVAC
- power supplies
- Fire detection / suppression
137
*Physical Security Controls*
Physical
- Fencing
- Lighting
- Locks
- Construction materials
- Mantraps
- Dogs
- Guards
138
*Physical Security Controls*
Fence Types
3-4 Feet: deters casual trespasser
6-7 ft: to hard to climb easy
8 ft (w/barbed wire) - will deter intruders
139
*Physical Security Controls*
Temperature
Humidity: 40-60% ideal
Temps: for computers 60-75degF. Damage at 175degF. Manage storage devices damaged at 100F
140
*Physical Security Controls*
Electrical impacts - Blackout
Prolonged loss of power
141
*Physical Security Controls*
Electrical impacts - Brownout
Prolonged low voltage
142
*Physical Security Controls*
Electrical impacts - Fault
short loss of power
143
*Physical Security Controls*
Electrical impacts - Surge
Prolonged high voltage
144
*Physical Security Controls*
Electrical impacts - Spike
Temporary high voltage
145
146
*Physical Security Controls*
Electrical impacts - Sag
Temporary low voltage
147
*Physical Security Controls*
Lights
8 feet hight with 2 feet candle power
148
*Physical Security Controls*
Humidity + Static Electricity
Too much humidity can cause **corrosion**. Too litte causes **static electricity** even on non-static carpet, low humidity can generate 20,000-volt static discharge!
149
*Fire / Suppression Agents*
Class A (ASH)
**Common combustibles** such as wood, paper, etc. Shjould be extinguised with water or soda acid
150
*Fire / Suppression Agents*
Class B (BOIL)
**Buring alcohol, oil, other petroleum products** such as gasoline. Extinguished with **gas or soda acid**
151
*Fire / Suppression Agents*
Class C (CONDUCTIVE)
**Electrical fires**. Must be extinguished with non-conductive agaent like **any type of gas**
152
*Fire / Suppression Agents*
Class D (DILYTHIUM)
**Burning metals**. Extinguished by **dry powder**
153
*Fire / Suppression Agents*
Class K (KITCHEN)
**Kitchen fires**. Extinguished by **wet chemicals**
154
*Fire / Suppression Agents*
3 Categories of Fire Detection
1. Smoke sensing
2. Flame sensing
3. Heat sensing
155
*Voltage and Noise*
Electromagnetic Interference - Common mode noise
Generated by the difference in power between the **hot and ground** wires of a power source.
156
*Voltage and Noise*
Electromagnetic Interference - Traverse mode noise
Generated by a difference in power in the **hot and neutral** wires of a power source
157
*Voltage and Noise*
Radio Frequency Interference (RFI)
The source of interference that is generated by electrical appliances, light sources, electrical cables and circuits etc
158
*Damage from Fire and Fire Suppression - What do these things damage?*
Smoke
Storage devices
159
*Damage from Fire and Fire Suppression - What do these things damage?*
Heat
Any electronic or computer component
160
*Damage from Fire and Fire Suppression - What do these things damage?*
Suppression mediums
Cause short circuits, initiate corrosion, or otherwise render equipment useless
161
*Water Suppression Systems*
Preaction Systems
**Good for areas with people and computers**
**Use closed sprinkler heads** and the pipe is charged with compressed air instead of water. The water is held in check by an electrically operated sprinkler valve and the compressed air
162
*Water Suppression Systems*
Wet Pipe Systems
**Filled with water**.
163
*Water Suppression Systems*
Dry pipe systems
have **closed sprinkler heads**. filled with **compressed air**. The water us held back by a valve that remains closed as long as sufficient air pressure remains in the pipes
*used where water is likely to freeze*
164
*Water Suppression Systems*
Deluge Systems
Similar to dry pipes, except the **sprinkler heads are open** and larger than dry pipe heads. The pipes empty at normal air pressure, the water is held back by a deluge valve
165
Gas Discharge Systems
**More effective than water discharge systems** but should not be used where people are because it removes oxygen from the air
**Halon** effective but bad for the environment (ozone-depleting), **turns to toxic gas at 900F**.
166
*Lock Types*
Electronic Combination Locks
(Cipher lock) Something you **Know**
167
*Lock Types*
Key Card Systems
Something you **have**
168
*Lock Types*
Biometric Systems
Something you **are**
169
*Lock Types*
Conventional Locks
Easily picked / bumped and keys easily duplicated
170
*Lock Types*
Pick and bump resistant Locks
Expensive, harder to pick, & Keys not easily duplicated
171
Site Selection
(Important considerations)
- Visibility
- Composition of the surrounding area,
- area accessibility
- effects of **natural disasters**
172
Facility Design
(Important considerations)
- Understanding level of **security needed** by your orgs and planning for it before construction begins
173
How to design / configure secure work areas
- should `NOT` be **equal access** to all locations
- **Valuable and confidential assets** should be located in the center of protection
- Centralized server / computer rooms do not need to be human compatible
174
*Threats to Physical Access Controls*
Abuses
Propping open secured doors and bypassing locks or access controls
175
*Threats to Physical Access Controls*
Masquerading
Using someone elses ID badge to get in
176
*Threats to Physical Access Controls*
Piggybacking
Following someone through a secured door without swiping your badge
177
Security concerns of a wiring closet
- prevent physical unauthorized access
178
How to handle visitors in a secure facility
- escort assigned to visitor
- Tracking actions
179
Protections for evidence storage
- locked cabinets / safes
- dedicated / isolated storage facilities
- offline storage
- access restrictions / activity tracking
- hash management and encryption
180
Uninteruptable Power Supply (UPS)
Type of self charging battery that can be used to :
- supply consisten and clean power
- supply power in the event of a power failure
181
*Access Control Models*
Attribute Based Access Control
Uses rules that can include **multiple attributes**.
- Allows it to be **more flexible** than rule based model that applies rules to all subjects equally
- Often used by Software Defined Networks (SDNs)
