The Full Shabang Flashcards
This is literally everything, all in one place, with as many details as you can possibly cram in. Let's go (19 cards)
What is the definition of Confidentiality?
Ensures that data is only accessible to those authorised to see it/prevents unauthorised access to private data.
How is Confidentiality implemented?
Achieved through:
- Encryption of the data
- Access Controls
- User Authentication
What is an example of how Confidentiality is implemented?
TLS encrypts HTTP data to protect it from eavesdropping
What is the definition of Integrity?
Ensures that data has not been tampered with/prevents unauthorised modification of data.
How is Integrity implemented?
Often implemented using:
- Hashing of data
- Digital Signatures used in connections
What is an example of Integrity being implemented?
A file download might use SHA-256 checksums to verify that the file hasn’t been modified
What is the definition of Availability?
Ensures that systems, services and data are accessible when needed.
What affects Availability?
- Denial of Service attacks
- Server failures
- Overloads
What is an example of Availability being compromised?
A bank service being taken offline by a DoS attack
What is non-repudiation?
It ensures that a user cannot deny having performed an action
How is non-repudiation implemented?
Implemented using:
- Digital Signatures
- Secure logging
What is an example of non-repudiation being implemented?
Signing an email with a private key ensures that only the key holder could have sent it
What is the definition of Accountability?
Links user actions to specific identities and ensures they can be traced and audited
What is the difference between non-repudiation and accountability?
Non-repudiation - Prevents a party from denying their involvement
Accountability - Involves tracking and linking actions to identities within a system
What are three principles in secure system design?
Least Privilege
Fail-safe defaults
Complete Mediation
What is the definition of Least Privilege?
Ensures that a user or process has only the minimal permissions necessary to complete their task, reducing the attack surface.
What is the definition of fail-safe default?
Ensures that access is denied by default, and must be explicitly granted
What does Open Design mean in the context of Security?
The system should remain secure even if its internal workings are public, relying on secrecy of keys rather than secrecy of design.
