Flashcards in Midterm # 2 Deck (145)
The process of determining whether a user should be allowed access to a system.
are you who you say you are?
are you allowed to do that?
The three authentication methods?
Something you know
Something you have
Something you are
How to prevent forward search attack
To prevent a forward search attack on a public key encryption we append random bits to the message before encrypting it
Appending a non secret random value known as salt to each password before hashing it.
What is a salt?
a non secret value that causes identical password to hash to different values
What is a two factor authentication?
any authentication method that requires two out of the three "somethings" is known as a two factor authentication
what is the common criteria?
EAL1 through EAL7
what is EAL1
what is EAL2
What is EAL3
Methodically Tested and Checked
What is EAL4
Methodically Designed, Tested, and Reviewed
What is EAL5
Semiformally Designed and Tested
What is EAL6
Semiformally Verified Design and Tested
What is EAL7
Formally Verified Design and Tested
What are ACL's?
Access control lists, columns
What is C-lists?
Capabilities, rows, subject trying to perform an operation
What are the advantages of capabilities?
with capabilities the association between users and files is built into the system. Capabilities are more complex to implement, and have higher overhead
what are the advantages of ACL
ACL based system, which is a separate method for associating users to files is required.
what is the confused deputy?
the confused deputy is a classic security problem. fooled by some other party into misusing its authority. the compiler is acting on Alice's behalf.
Classification applies to...
Clearances apply to...
Classification and Clearances order?
what is BLP
What is Bella-LaPadula
is to capture the minimal requirements with respect to confidentiality, that any MLS system must satisfy
BLP consists of two statments
Simple Security Condition,
What is Simple Security Condition
Subject S can read object O if and only if L(O) <= L(S)
What is Property
Star property, Subject S can write objects O if and only if L(S) <= L(O)