Security & Threat Models Flashcards
Bell-LaPadula
Focus is on Data Confidentiality
state machine model = military
Data Access Controls
- MAC - mandatory access control
- ACM - access control matrix
- DAC - discretionary access control
- Non-discretionary access control
- MAC = permissions that are determined by org policy and need to know.
- ACM = rule based access control, is an example of non-discretionary. ACM is an ACL in the form of a table and columns.
- DAC = permissions set by the Data Owner (not org policy / need to know)
- Non-discretionary = permissions that are primarily set by the Administrator (not org policy / need to know).
SD3+C
Secure by Design
Secure by Default
Secure in Development & Communication
How to apply Threat Modeling
- Choose a threat modeling concept (STRIDE, VAST, etc.)
- Diagram potential attacks
Determine the potential attacks via a diagram of the elements involved: who each component + boundaries + data flow
How to apply Threat Modeling
- Choose a threat modeling concept (STRIDE, VAST, etc.)
- Diagram potential attacks
Determine the potential attacks via a diagram of the elements involved: who each component + boundaries + data flow
- Perform Reduction Analysis
AKA decomposing the app.
Reduction Analysis = IDENTIFY 5 key concepts:1. Trust Boundaries 2. Data flow paths 3. Input points 4. Privileged Operations = requires elevated permissions 5. Security stance / approach =
- Prioritize how to Respond = establish a threat prioritization chart
- Document the threats ascertained from the above
- Rank or rate each threat using:
- Probability X Damage Potential
- DREAD
- high/medium/low
Access Control Categories
Preventative = drug test, least privilege, IPS, firewalls, encryption
Detective = IDS, CCTV, alarms, anti-virus
Corrective = anti-virus, patches, IPS
Recovery = disaster recovery, backups, high availability
Deterrent = fences, dogs, lights, signs
Compensating = used when other controls (above) are too costly to implement
TCB / TCSEC
trusted computing base / trusted computer system evaluation criteria
US DoD standard
aka Orange Book
a combination of hardware, software and controls that work together to form a TCB for a security policy.
Components:
- Hardware & software elements
- Security Perimeter
- Reference Monitor & kernels
Composition theories
follows how data flows between systems rather than within an individual system.
Cascading = input for one system comes from another
Feedback = one system provides input to another, which reciprocates by reversing roles
Hookup = one system sends input to another but also sends to external
Protection Rings
oldie but a goodie, goes back to 1963
organizes code & components in an O/S into concentric rights within a runtime environment
0 = highest level of privilege, access anything = kernel / memory 1 = parts of O/S, apps that interact with kernel 2 = I/O drivers and system utilities - access peripheral devices 3 = user level programs / apps
Rings 0 - 2 == supervisory mode aka privilege mode aka system mode
Ring 3 == user mode
Accidental or intentional exploitations of vulnerabilities?
Threat Events
Biba Model
data integrity and lattice based
a common choice for commercial orgs (not military)
state machine model
Clark-Wilson Model
1987
data integrity
Subject - Program (or Interface) - Object
Brewer and Nash (aka Chinese Wall)
data isolation
prevents conflicts of interest.
State Machine Model
a system that is always secure no matter what state it’s in.
bela-lapadule
biba
Information Flow Model
Firewalls
Static Packet Filtering
Circtuit-Level Gateway
Application-Level Gateway
Stateful Inspection -
Deep Packet -
Next Gen -
Static Packet Filtering –> First Gen –> Layer 3
Circtuit-Level Gateway –> Layer 5 –> used to connect trusted partners
Application-Level Gateway (Proxy) –> Layer 7 –>
Stateful Inspection (Dynamic) - Layer 3 / 4
Deep Packet –> Layer 7
Next Gen - multifunction device (IDS, IPS, QoS, etc)
Authentication Factors (1-3)
Type I = something you know
Type II = something you have
Type III = something you are.
What would an organization do to identify weaknesses? A. Asset valuation B. Threat modeling C. Vulnerability analysis D. Access review
A vulnerability analysis identifies weaknesses and can include periodic vulnerability scans and penetration tests.
Asset valuation determines the value of assets, not weaknesses.
Threat modeling attempts to identify threats, but threat modeling doesn’t identify weaknesses.
An access review audits account management and object access practices.
Authentication Factor(s)
Type I = something you know (passwords / pins)
Type II = something you have
Type III = something you are
Computer Security Incident Response
Detection Response Mitigation Reporting Recovery Remediation Lessons Learned
DRMRRRL
Dogs Run Miles Round Round Round Loop
IPSec Protocols
AH = protects data from tampering = nonrepdutiaion
ESP = encrypts payload
IKE = handles key exchange for ESP
ISAKMP = provides background security support services for IPsec, including managing security associations.
Security planning documentation should ________________.
A. Define work for individuals
B. Assign blame for faults
C. Prescribe tasks to roles
D. Be posted for public access
As a general rule of thumb, security policies (as well as standards, guidelines, and procedures) should not address specific individuals. Instead of assigning tasks and responsibilities to a person, they should be defined for a role. Then these defined roles are assigned to individuals as a job description or an assigned work task. The assignment of a role to a person is not part of the security policy documentation. Rather, that activity is a function of administrative control or personnel management. Thus, a security policy does not define who is to do what but rather what must be done by the various roles within the security infrastructure.
The ____________ model is focused on the secure creation and deletion of both subjects and objects. Ultimately, this model is a collection of eight primary protection rules or actions that define the boundaries of certain secure actions.
A. Biba
B. Sutherland
C. Graham–Denning
D. Brewer–Nash
The Graham–Denning model is focused on the secure creation and deletion of both subjects and objects.
The following eight primary protection rules or actions define the boundaries of what security model?
Securely create an object. Securely create a subject. Securely delete an object. Securely delete a subject. Securely provide the read access right. Securely provide the grant access right. Securely provide the delete access right. Securely provide the transfer access right.
A. Graham-Denning
B. Bell-LaPadula
C. Take-Grant
D. Sutherland
The Graham-Denning model is focused on the secure creation and deletion of both subjects and objects. Ultimately, Graham-Denning is a collection of eight primary protection rules or actions (listed in the question) that define the boundaries of certain secure actions.
Which of the following algorithms/protocols provides inherent support for nonrepudiation?
A. HMAC
B. DSA
C. MD5
D. SHA-1
The Digital Signature Algorithm (as specified in FIPS 186-2) is the only one of the algorithms listed here that supports true digital signatures, providing integrity verification and nonrepudiation. HMAC allows for the authentication of message digests but supports only integrity verification. MD5 and SHA-1 are message digest creation algorithms and can be used in the generation of digital signatures but provide no guarantees of integrity or nonrepudiation in and of themselves.
