GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Authoriation & Cryptography

HRYN red Uni Second Level Uni English 53 cards

Cards in this deck (53)

  1. 1AuthroizationAuthorization – validating that an authenticated user has been granted permission to access the granted resource(s). Based on user identities and access rules.
    Anonymous users – not been authenticated.
  2. 2Authorization process 21. Definition phase – defining set of authroisaion rules (authroisation policy0 that state what access rights users have and under what circumstances. User access rights/ Privileges/permissions
    2. Enforcement Phase – ensuring access rights are followed according to authrisation policy.
  3. 3Difficulties of implementing aurthroization 4- Huge numbers of users
    - Users not having same access rights
    - Multiple job roles with different privileges – lead to aurthrisation conflicts
    - Production and security becomes a trade off
  4. 4Authroisation policy – authroisation rules are defined and collected: 5- All organisations should have an authorization policy (a.k.a information security policy, access policy)
    - Authrisation rules may be part of a wider security policy
    - Rules are designed by security experts, business leaders, industry guidance, law…
    - Rules tend to be high-level and lack detail in practice
    - Can be left to programming team to interpret and implement authroisation rules at code leve why authorization not always perfect
  5. 5Reference monitorReference monitor – user access is controlled by a system wide module.
    Verifies a user request against a table of permitted access types for each system resource. If access request complies with authroisation policy, it is permitted or denied otherwise.
  6. 6Reference monitor should be NEAT: (what does NEAT stand for)- Non-bypassible: rules cannot be broken
    - Evaluable: rules can be analysed for correctness
    - Always-invoked: rules always enforced
    - Tamperproof: rules cannot be changed by an unaurthroised user
  7. 7What is access control What is a session?Access control – enforcing authroisation rules in practice
    Session – set of requests and responses between an application and a specific client (IP address)
    application uses sessions (session IDs) to distinguish which requests come from which clients and which response should go back to which clients
  8. 8Authorisation decisions can be based (as well as users identity) on: 3- Users job role
    - Enviromental attributes (ie time, location)
    - Users authentication state (authenticated or not)
  9. 9noteDevelopers underestimate difficulty of implementing reliable authorisation mechanism: not designed but evolve along with application – authroisation rules are inserted in various locations all over code – ad hoc collection of rules become so unwieldy that almost impossible to understand and evaluate for correctness.
  10. 10Flawed authorisation schemes – hackers can discover and exploit: 3- Hackers can test and find what requests for accessing sensitive functions or data are granted in error
    - Able to change or delete data, perform unauthroised actions, or take over side administration
    - Consequences devastating
  11. 11If haven’t implemented any authroisation rules: 7• All users can access any webpage via links in the main menu.
    • All users can access any webpage by entering or changing URLs in the browser bar (path traversal).
    • All users can access blog functionality including creating posts, viewing all posts, editing and deleting any posts.
    • All users can access the Database Administration page, create, view and edit database content.
    • All users can access the Security Administration page (content yet to implement but will include security logs).
    • Authenticated users can try registering an account and logging in after they have already completed these actions.
    • Anonymous users can try to logout
  12. 12Web document root or CGI root (Common Gateway Interface root) directoryWeb document root or CGI root (Common Gateway Interface root) directory – most web applications restrict user access so they can only access a specific portion of the file-system.
    These directories contain files intended for users to access and the executables necessary to drive the web application functionality.
  13. 13Path Traversal attack techniquePath Traversal attack technique – allows an attacker access to files, directories and commands that c=potentially reside outside the web document root directory. An attacker can manipulate a URL entered in a browser in such a way tthat a web application will reveal the contents of arbitrary files anywhere on web server. Any device that exposes an HTTP-based interface is potentially vulnerable to path traversal.
  14. 14Pth Traversal attackPath Traversal Attack: hacker sends a path for the file/directory wants to server. Server tries to include path-requested by hacker instead of normal one. Server retursn file or directory requested.
  15. 15Directory traversal attackDirectory Traversal Attack: Hacker identifies web application with insufficient filtering or validation of browser input from users. Valid GET request is used to retrieve and return an expected frile from web server. Hacker modifies URL string using directive ../ in attempt to retrieve desired file from higher directory. GET request performed and hacker granted access to file containing sensitive info without proper validation. ../ (go up one directory) dot dot slash attack (path traversal)
  16. 16RBACRole-based access Control (RBAC) – enforcing authroisation rules based on the job roles of users.
  17. 17system based resSystem-based roles – collection of predefied privileges or permissions. Assigned role dertermines permissions individual granted.
  18. 18Prinviple of Least PrivilegePrinciple of Least Privilege – RBAC can help ensure users with lower-level roles can’t access sensitive info or perform high-level tasks.
  19. 19Requriments of users evaluated to implement RBAC: 4Requirements of users evaluated to implement RBAC: Authroisation, responsibility, job compentency and recources require to perform. Complex. RBAC can cause conflicts and usability issues especially when have more than one role.
  20. 20RBAC Benefits 5- Improved operational efficiency
    - Enhanced compliance
    - Adminstrators increased visibility
    - Reduces costs in terms of resources used
    - Decreased risk of breaches and data leakage
  21. 21RBAC implementaiton processRBAC implementation process: understand bus needs, planning scope of implementation, defining roles, implementation.
    IT roles: end_user, db_admin, sec_admin (security adminstors)
  22. 22CRUDCRUD: Create, Read, Update and Delete: set of operations used to manage data in databases and other storage systems.
  23. 23Challenges with RBAC 4- Role explosion: when level of granularity needed for access control is too detailed – many many roles – hard to manage
    - Somewhat rigid – once deployed – hard to react to changing security threats and risks
    - Scalability and Dynamism – rush to onbraord new people organisation charts and job def have not been updated or clearly defined – require costly redesign to get back on track
    - Expensive and Difficult Implementation – duplication of servers and other infrastructures with support RBAC may be hound to be prohibitive in terms of cost and complexity
  24. 24Security event Monitoring logsSecurity event – every activity on a system from logins to sending an email. All should be logged to monitor behaviro especially user behaviour in a system.
    Monitoring logs – look for signs of unauthroised activities. Suspicious data activities may also be stored centrally for further analysis of long-term trends. Only work when part of an effective data collection and analysis process.
  25. 25If security logs too bigSecurity logs too big: often be missed security incidents, false flags and duplicate information. Key to being effective is ability to filter out unnecessary info and focus solely on criticial events that could compromise integrity and/or availability of confidential information. Should incorporate tools to quickly and easily review audit logs for evidence of crticial events
  26. 26Critical events 5- Reconnaissance: where adversaires perform research on computing envrionments that could be their next target
    - Weaponsiation: an intrusion within a computing environment where adversaries have decided to take action against a network and IT systems
    - Exploit delivery: manifestation of an exploit against a vulnerability within a netowork or IT systems
    - Installation of malware: observed when an adversary has modified native functionality in a computing environment to maintain persistence
    - Command and Control: when criminal hackers gain access to server and systems and effectively take control of a computing environment
  27. 27Benefits of security logging and montiring for detection of security breaches: 2- Most organisations affected by differeitn types of security events. Can help guard against malicious external threats while also guarding against internal misuses of information.
    - Threats can be detected in real-time to facilitate fast intervention
  28. 28Benefits of security logging and montiring for event reconstruction: 2- If breach should occur, audit trails can facilitate a reconstion of events leading up to incursion
    - Security personnel will have clear idea of how breach occurred, how to rectify vulnerabilities and what steps are need to prevent from happening again.
  29. 29For faster recover: 3- Downtime of systems is extremely costly to organisations
    - Audit logs can create a fast and effective recover process
    - Can help to reconstruct data files which were lsot or corrupted by reverse engineering from changes recorded in logs.
  30. 30CryptographyCryptography – scrambling/encoding data so it cannot be read/ Process of hiding or coding information so that it can only be read by the person(s) authroised to do so.
  31. 31Plaintext CiphertextPlaintext – data in human readable form
    Ciphertext – data in unreadable or encrypted form
  32. 32Encyrption DecryptionEncryption – act of scrambling plaintext into unreadable ciphertext
    Decryption – act of unscrambling unreadbale ciphertext iinto plaintext
  33. 33HashingHashing – act of converting plain text into a unique, irreversible value
    Hashing – transform data into a random fixed-length value. Doesn’t use keys. Transformation process is encapsulated within a hash function. Resulting is a hash value. Hashing is a one-way process that cannot be directly reversed – makes data confidential even if exposed or breached.
    Generally used for data integrity and verification.
    Hashing preserves file integrity during file sharing, downloading or copying processes – ensures files intact and not been tampered with.
  34. 34Digital signatureDigital signatures almost always require calculation of a cryptographic hash.
    Digital signature – electronic, encrypted, stamp of authentication on digital information such as email messages or electronic documents. Hashing guarantees efficiency and security of digital signature schemes.
  35. 35NoteCryptocurrency systems use hashing to protect them from DDoS attachs and other abuses.
    Password verification commonly uses cryptographic hashes. Hash digests prevent passwords from being compromised. During user authentication process, system will compare user-entered passwords hashes with own stored values.
  36. 36Hashing processgenerate a hash value for each data input. Hash algorithm a, one unique input string s should have one unique hash value v. v should always be generated each time input string s is hashed by algorithm a.
    in rare cases, different data inputs may have identical hash value – hash collision – potentially be exploited by hackers.
  37. 37Hacker could find user's password by 4- Select a password think user choose ie password1!
    - Calculate hash of password
    - Compare hash calculated to hash value of user’s password. If match, hacker knows plaintext value of user’s password
    - Usually repeat process with list of large number of potential candidate passwords
  38. 38Rainbow tablecommon technique to try and crack hashes. Large databases of precomputed hashes and their corresponding plain text passwords. Can be very effcective and fast as eliminate need to perform hashing calculations on the fly.
  39. 39Limitations of rinbow tables 3- Can require a lot of storage space
    - Specific to a certain hashing algorithm and character set
    - Ineffective against hashes that use slat or other alternations
  40. 40Saltingunique, randomly generated string that is added to each password as part of the hashing process. Different salts will result in different hash values even if value being hashed is the same.
    Hacker slats and crack hashes one at a time sing the respective salt rather than calculating a hash one and comparing it against every stored hash.
  41. 41PepperingPeppter can be used in addition to salting to provide an additional layer of protection. Prevents an attacker from being able to crack hashes if they gain access to hash values. Hash values are encrypted with pepper acting as encryption key. Peppers are shared between sotred hashes unlike unique salts ans so must be stored separately in secret vault.
  42. 42Encryption CipherEncryption – process of scrambling some given data so data becomes undecipherable (ciphertext)
    Uses key(s). Algorithm or process is encapsulated within an encryption function.
    is a 2 way process – every encryption function will have corresponding decrption function.
    Cipher – a specific encryption algorithm
    Encryption is used for data confidentiality and protection. Used to protect web traffic moving between clients and servers from interventions and snooping.
  43. 43VPNVPNs Virtual Private Networks use encryption to protect data transmitted over a network (and masks IP addresses).
  44. 44End to end encyrption File encryptionEnd-to-end encryption is used in instant messaging services to protect privacy of conversations
    File encryption protect file content so no one can access them even if intercept fils in transit or accesses them in storage
  45. 45Encrytpion KeyEncryption key – determine how poaintext is transformed into ciphertext and vice versa.
    Keys generated by random number generators or computer algorithms – each key specific to specific encryption function. Keys are unique and difficult to replicate or crack. Keys represented as string of bits. Longer harder to crack. Common length 128 bits for symmetric key algorithms. 2048 bits for asymmetric key algorithms.
  46. 46Encryptuion methods 2 and describe- Symmetric key encryption (private key encryption) – same key used for encryption and decryption – key must be kept secret
    - Asymmetric key encryption (public key encryption) – different keys used for encryption and decryption. Keys mathematically related but computationally not feasible to find one from another. Encryption key can be made public. Decryption key must be kept secret
  47. 47Symmetric vs asymmetricSymmetric vs asymmetric: asymmetric more advances, security advantage: private key doesn’t have to be shared but symmetric uses one key which risks interception when must be shared.
    Symmetric: faster to run – encryption keys shorter – uses one key.
  48. 48Use cases of symeetric, asymmetric, combinedUse cases: Symmetric: speed priority: banking: encrypting credit card info or other PII for transactions, data storage: when data not being transferred
    Asymmetric: Digital sig: confiming identity for someone to sign a doc, blockchain: confirming identity to authorise transations for cryptocurrency, PKI (Public Key infrastructure): governing encryption keys through issuance and management of digital certificates
    Combined: symmetric to encrypt bulk on info. Assymmetric used to encrypt symmetric encryption/decryption key.
  49. 49SSL/TLSSSL/TLS: Asymmetric encryption used to encrypt single-use symmetric envryption key – used to encrypt/decryptn internet browing session.
  50. 50Mobile chat systemsMobile chat systems: Asymmetric used to verify identify of participants at start of conversaion symmetric to encrypt ongoing connects of convo
    Breaking encryption or cryptography analysis – techniques used to defeat cryptographic systems and gain access to underlying data without the key.
  51. 51Symmetric key encryption attacks – security relies on secrecy of key: 3- Brute force attacks
    - Known plaintext attacks – derive key having access to both plaintext and ciphertext
    - Differential cryptanalysis – deducing how a key is generated by observing how differences in key generation input impacts key generation output
  52. 52Asymmetric Key encryption attacks – security relies on secrecy of secret key: 2- Mathematical attacks – exploit mathematical relationships between public and private keys
    - Side channel attacks – exploit information from physical implementation of encryption system eg timing info, power consumption, electromagnetic leaks or sound
  53. 53Strengthening encryption 4- Eliminate outdated encryption ciphers
    - Use longest possible encryption keys
    - Encrypt in a layered approach ie database: encrypt each column, table, database
    - Hold secret keys to encrypted data: key management must be secure using specific key manamgnet systems.

Information

Description
Uni Uni Second Level (Security Programming) Flashcards on Authoriation & Cryptography, created by HRYN red on 19/12/2024.
Created by
HRYN red
Views
4
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?