Mind map

Domain 3 Security Engineering

Marcos Alvarado English

Map content

Trusted path
- Information flows. Boundaries between these areas.
- subjects objects access
- Segmentation
- Insolation
- Abstraction
- Black box
- Data hiding
- Layering
- Encapsulation
- Sandboxing
Information systems architecture
- Mainframes Initial Program Load Thin client = node with no local processing no local storage, monitor , keyboard and NIC. Inexpensive. Personal Computers with local processing and storage. Client / Server Systems =  Mobile Device Management. =NAC= Network Access  Control to quarantine and remediate.
- MDM minimize sensitive data enterprise management NAC to quarantinte Harden MFA Encryption. Whitelist application regular backups camera audio recording storage, cellular internet Install remote wipe, locator and scream admin tools Teach end user risk Report immediately if lost of stolen. Attach only to guest WIFI
- Peer to peer PWP Computing
  - Collection of client systems connected in a sharing network.  Systems perform as both client and server. Increased risk. Ad HOc wireless, kazaa, workgroups , bittorrent.
- Distributed Systems
  - Centralized
    - All administration, data and processing reside in a single location
  - Distributed
    - Administritation, data and processing reside in multiple cooperating and coordinatinating locations..  Communication and control between locations.
  - Decentralized
    - Administration, data and processing reside in multiple independent locations.. There is little or no communication between location.
  - Colocation / Parallel processing
    - Redundancy and fault tolerance should be transparent to users:  performance, protability , Interoperability Introcuces security issues / consistency of: Integrity of data policy , monitoring, detection, enforcement and remediation Physical security
- Cloud Computing
  - Terms to consider / Require - Verify provider security meet client policy Monitor , audit , inspect weekly reports verify report able to pull regular data backups immediate notification of violations and breaches participation with incident response.
  - Non disclosure agreement NDA Service level agreement ownership agreement Termination of services agreement
  - GRID Computing
    - Collections of cloud computing environments. coordinated manner. BOINC - Berkeley Open source Infrastructure.
- IoT
- Industrial Control Systems
  - Supervisory Control and Data Acquisition SCADA gathers data and executes commands
  - DNP3 Distributed network protocol V3 DNP3 = communicate remote automation systemspower grid.
- Application Architecture
  - Client
    - browser , java app, client app, java appliet
    - Presentation
      - web server, java servlet, java server pages
      - Application
        web application, j2ee, server app, enterprise java beans
        Middleware
        ODBC/JDBC, CML, SAML, ORB/CORBA, COM/DCOM, SOA
        Data
        Database, flatiles, other data repositories, database
        Databases
        Hirearchical= one parent multiple child  Net/ Mesh= each parent can have multiple child, each chid can have multiple parents relational= data in tables, rows(tuples) by a primary key value. tables link together using primary / foreign key.  object oriented. DBMS
        Integrity consistency = record locking - first user get RW ohters get >RO Rollback= complete the transaction timely or rollback -- commit or rollback Two phase commit = uses a moderator Checkmarks= in case processing is interrupted to pickup.
        Integrity Semantic integrity = schema defined. Entity Integrity = row is a record or tuple. related to primary key. must exist not to be null Referenctial Integrity= Primary key value must exist for every foreigbn key used in a foreign table.
        object oriented.
        Issues
        Redundancy= Shadow database = a copy of DB on a remote system = real time. Transaction journaling = journal each transaction to a second database = real time Backups = batch process (consider RPO) Clustered DB servers = redundant server HW supports multiple instances of the DB application
        aggregation and inference attachk= people will often aggregate information they are authorized to know. and in Polyinstation= support multiple instances of the truth in separate records. PN120077
        Middleware
        Schema= structure of the database. Open DB Connectivity (ODBC) driver - code to identify and corect formatting conflicts between databases. XML= human and machine redable data format for web based applications. JDBC= ODBC for java.
        Microsoft
        Component Object Model (COM) Microsoft technology to share resources on a single computer. DCOM=COM over the network between multiple computers. Object request brokers ()RB) open platform technology to share resources over the network. (programming language) Common ORB Architecture (CORBA) ORB for multiple platforms and programming languages.
        Mining Databases
        data warehouse= repository of databases. requires normalization. standardize data, schemas Data mart= smaller subset of a data warehouse. much more manageable and refine able.
        Data aggregation= tremendous volumes of raw data being aggregated Data mining= applying various levels of artificial intelligence to bulk data and increase value. Data+ information+knowledge+wisdom
  - Web application
    - boom in web applications written for serving to anycllient with a browser OS on client system is not important SSO authentication, authorization and accountability.
    - Mobile code
      - distribute from web server to client browsers. executed on client system carrying serious risk to client Cookies Scripts Java applets ActiveX control
      - Cookies= ASCII text files. written by web server and stored on client. sensitive information or malware Information in cookies can be harvested by websites. Each browser maintains its own cookie store. Session cookies= deleted when the browser is exited. Persistent cookies = stored on the computer indefinitely.
      - XSS attacks in web site. Non persistent = Malicious script in url. persistent= malicious script is uploaded to poorly administered comment DOM Document Object model = malicious script is sent to computer usually as a cookie.
      - Java applets - Oracle Sun java executed in any Java VM. java applets is writen ones play many platform. does Translate. malicious java applet infect any platform. byte code java native. form java to byte code to sandbox .  can be digitally signed. some indication of source. Edge does not allow java to run.
      - ActiveX Microsoft Object oriented programming Extension OLE, COM, DCOM Authenticode for digital signature Not used in widows 10.
    - Issues
      - browser compromised or malicious website Session hijacking - DNS poisoining, click jacking and redirection Email= Phishing ' dirty hyperlinks, social engineerings
      - web application issues
        Input validation = application developer does not test and filter user input allowing buffer overflow.
        OWASP -
        Open web application security project. OWASP top 10 application security risks. development guide code review guide test guide ZAP project (Zed Attack Proxy) OWASP web Goat - willfully vulnerable web app.
Cryptography
- Cryptology= all things crypto Cryptography= hiding of the meanng of a message. Cryptanalysis= cracking of the cryptosystems to reveal messages.
- 1. Confidentiality 2. Authentication=verify the sender 3. Integrity= trustworhiness 4. Non repudiation= Authentication cannot deny 5. secure key distribution. 6. Confidentiality= authorization and integrity 7. Integrity Protection = Encrypt 8. Integrity verification (at time of use) crypto+hashing
- Crypto terms Cipher/algorithm= formula process to encrypt or decrypt. Cryptosystem= collection of processes and algorithms. Key= a variable used with algorithm to randomize.
- ALGORITHMS
  - sYMMETRIC =SAME KEY USED TO DECRYPT TO DECRYPT ASYMMETRIC KEY aLGORITHMS/PUBLIC KEY ALGORITHMS.= two keys = public and private. Ok to share the public key never share the private key. what one key encrypts only the other key can decrypt.
  - hashing algorithms/message digest
    - does not perform encryption- no key used used to verify the integrity of data produces a fingerprint of the message a hash value. cannot retrieve the original data from the hash value. can provide authentication, integrity and non repudiation uses MAC digital signatures and message authentication code.
    - Authentication + Integrity = non repudiation
      - digital signatures = non repudiation hash + symetric key = weak form of integrity and authentication. MAC no provide non reprudiation.
      - one way funtion.
      - 1 bit = parity 32 bits = Cyclic Redundancy Check CRC - look for corruption 128 bits = MD5  RSA 160 bits = Secure Hash Algorith  v1 SHA1 - NIST 160 bits RIPEMD 160 256 bits = SHA 256 384 bits = SHA 384 512 bits = SHA 512  sha256 recommended up.
    - Good hashing algorithms
      - High number of bits in the hash value output High Avalanche effect = small change produce huge change in hash value. Low frequency of collisions
    - hashing+asymmetric
      - Digital signature provides Authentication = strong non repudiation strong Integrity strong.
  - Cryptographic keys
    - key length= # of bits in cryptographic key. Directly related to strength of the key. 4 bits = 16 keyspace = 8 different numbers. key space = range of decimal numbers keys are chosen from directly related the key lenght. key clustering= two or more different keys that can decrypt the same message. bad strong keys= highly randomized and long keys with a low frequency of key clustering.
    - key management
      - key creation= crypto service provider CSP Key distribution= protect symmetric keys in transit. Key storage = protect all symmetric keys and private keys. Key Use= Every use increace risk Key expiration = change key periodically Key Revocation= If exposed or if loss of trust. Key escrow = It be able to recover data. decrypt. key recovery= from the escrow for lost keys. risky.
  - Symmetric key cryptography
    - the key that encrypts data is exactly the same key used to decrypt the ciphertext. block ciphers - fastest stream ciphers = slower but stronger substitution trasposition= mix up the characters.
    - Symmetric key cryptography provides: 1. confidentiality = strong and fast 2. authentication= weak 3. integrity= weak 4. non repudiation= no provided 5. secure key distrivution solve problem.
    - Integrity protection strong
    - Integrity verification weak
    - Symmetric key management
      - every copy must be protected each pair of users requires a unique pair of keys. required number of symmetrick keys N= number users (N*(N-1))/2 = 45 keys for 10 users. number of keys grows rapidly 499,500 keys for 1000 users.  Hieroglyphics = 3500 Atbash - 500 BC reverse the alphabet and substitute. Scytale = 400 BC trasposes key lengt of stick. Shift/ROT/Caesar  100 BC X=key=5 vigenere cipyr
      - Boolean logic
        and, or, nand, nor, xor XOR 0 0 = 0 0 1 = 1 1 0 = 1 1 1 = 0 iguales = 0 distintos = 1
      - kerchkhoffs principle
        the strenght should not come from the secrecy of the algorithm, but from secrecy of the key. security through obscurity one of the weakest forms of security.
      - Vernam Cipher or One time Pad
        highly randomize the key make the key as long as the message never reuse the key securely distribute the key pad securely store the key pad
        Stream ciphers
        Encrypt 1 bit at a time slow but strong Xor and pseudo random  Reliance on IC chip RC4 Ron Rivest, RSA Scream, snow, sober
      - Hebern rotor crypto machines
        Block ciphers use a combination of substitution and Transposition Substitution provides confusion Transposition provides difusion. One S funtion and one T function = one round of crypto.
        Block ciphers
        Data Encryption Standard (DES) Triple DES (3DES) 1997 2002. RC5, RC6  Blowfish, Twofish IDEA International data Encryption algorithm Advanced encryption standard AES
        ECB Electronic code book CBC Cipher block chaining Output feedback mode OFB Cipher Feedback Mode Counter Moder
        DES
        Triple des
        4 Modes EEE2 EEE3 3 keys EDE2 Encrypt decript with differ key EDE3 
        AES
        Rijndael algorithm for AES. Advanced encryption standard. Considered to be uncrackable = we dont know how to break. AES is approved top secrect data and secret. AES 128 bit 10 rounds 192 and 12 rounds - secret , top secredt 256 bit 14 rounds.
        OTher
        IDEA 64 block to 128  bit key rounds RC5 RC6 Ron Rivest  RSA blowfish 1993 twofish 
        ECB
        Fastest and weakest = not good for multiples of data..
        CBC
        Chains XOR 
        OFB
        Stream mode of a block cipher.
        CFB
        similar to OFB 
        CTR
        Fastest and strongest. Encrypt nonce + conunter to produce
        MAC
        combine hashing algorithm and symemetric key. weak authentication and weak integrity Message authentication code. If a bad guy intercepts message alters te message and generates a new hast.
        HMAC
        CBC MAC
        cipher block chaining - message authentication code. authentication sender - integrity message.
      - Additional Variables
        non secret number optionally used with algorithms. Seed= randomized starting number Initial Vector = same as seed Salt= randomized number added to some type of data Nonce= randomized numer that is only used once.
  - Asimetric Key
    - Asymmetric key algorithms/public key algorithms. Martin Hellman , Whitfied Diffie, ralph Merkle. complex mathematics much slower than symmetric key algorithms.
    - Crypto Services Configdentiality Authentication Integrity Non repudiation secure key distribution
    - hibrid algorithms
      - encrypt small amounts of data. Just use for a session . Symmetric session key to encrypt bult data. Hash Values = Digital signature Authentication - strong Integrity . strong Non repudiation - strong
      - Asymmetric keys are so large cannot be recreated independently Only one person could have created their private key Digital signature is based on digital certificates. Authentication is strong with digital certificates. strong authentication and integrity propides non repudiation.
      - Asymmetric key algorithms Diffie Hellman, RSA, elgamal, Elliptic ECC, Digital signature standard DSS, knapsack, LUC
      - Diffie Hellman
        1975 firs asymmetric key algorithm.   Key exchange agreement. share public keys and using a privaltly store private key.  using discrete logarithms in a finite field.
        for VPN and other private channels. only provide 1 service Secure key distribution.
      - X509
        needs PKI
      - RSA
        <All five crypto services Factoring a large number into its prime factors. one of the prime factor is private key. Trapdoor function.
      - elgamal
        Extention of <Diffie Helman  provides 5 cryptographic services.
        ECC
        Extension de Diffie Hellman 5 cryptogrtaphic services uses gian number calculates discrete logarithms in finite field. uses short key . small amout of data. for small devicess. battery operated devices.
      - DSS
        Digital signature standard no confidentiality service strong authentication stron integrity validation non repudiation NIST recoment.
        Algorith is called Digital signature Algorithm DSA, variants, RSADSA; ECDSA, ElGamal, FiatShamir, Schnorr along X509
    - Digital Signature
      - text and encrypt with a hash algorith = Hash value.  Encrypt the hash value with the senders private key to produce digital signature = strong authentication, integrity verification , non repudiation. Decrypt    the signature with senders public key.
    - SSL/TLS
      - SSL 3.1 = TLS 1.2 
- In Use
  - Link encryption
    - Used on point to point Satellite, dialup, t1 and t3 lines.  encryp/decryp at ends of link all data including headers. No routing or filtering devices (hops) line dedicated lines. 
    - End to end Encryption from layer 4 of the frame to the end of the payload. no encrypted Layer 2 (header mac address) Layer 3 Hearder (IP address) CRC trailer (error detection at routed networks. IPSEC, PGP, S/MIME and others.
  - End to end.
    - End to endEncryption from layer 4 of the frame to the end of the payload.no encrypted Layer 2 (header mac address)Layer 3 Hearder (IP address)CRC trailer (error detection at routed networks.IPSEC, PGP, S/MIME and others. End to endEncryption from layer 4 of the frame to the end of the payload.no encrypted Layer 2 (header mac address)Layer 3 Hearder (IP address)CRC trailer (error detection at routed networks.IPSEC, PGP, S/MIME and others.
  - PKI
    - Public key infrastructure Define by X.509v3 or v4 protocol Hierarchical systems. can provide all five crypto services strongly. basis of forma leggal liability.
    - the subject goes to Registration Authority and prove his identity to the RA, the RA on behalf of the subject request a digital certificate.produce from CA the CA request a Public Key from the subject. the CA takes the identity information with PK and binds them in to X509.v3. CA digitaly signs the documents. trust the CA, and verify certificate has not be alter.
    - verified certificate. include. Trusted CS Subjects Name Revocation status Expiration data Intended use other details on Cert. Certificate Revocation = Publis Certificate Revocation list = Online Certificate Status Protocol. (OCSP)
    - X509v3
      - Recipe, define. Telecomunication union. extension X500 Directory services. X.509 add trust to funcitionality of asymmetrci key pairs. HTTPS, SSL, smartcards, application, authentication CAC cards.
  - PGP
    - Commercial asymetric Phil Zimmerman PGP used 128 minimum.  based on a web of trust. (less predictable, less manageable, transitive) OpenPGP - open system , free use. Symantec purchased PGP.
  - Secure Mimi S7MIME
  - SET
    - Secure Electronic Transaction X509 Digital Certificates. Developed 1998 to protect ecommerce payment card transaction. Encrypts card data at client system Decrypts at the vendors bank Payment card companies tried to charge vendors for use. Led to PCI DSS
  - VPN
    - Secure content over a network between two endpoits. SSH linux evolving PPTP Microsoft Cisco Point to point tunneling protocol. IPsec = standard VPN SSTP Secure Socket Tunneling Protocol = Newer VPN based on X509 digital certificates.
  - SSL TLS
    - Netscape currently SSL v3.1 TLS v 1.2. X509 strong authentication.  Performs secure Key distribution Produces an encrypted channed.
    - http shttp = many algorithms supproted sftp= ftp through ssh ftps= ftp over ssl
- Attacks
  - Social Engineering
  - Cracking crypto
    - crack a key basic substitution ciphers = frequency analysis Transposition ciphers = reorder characters Hashing algorithsm = birthday attack Key exchange = replay attack
    - Brute force attack = try every possible combination. Dictionary attack= word list - faster no garanty Hibrid attack = start with dictionary attack, then add caracter to begining to end and perform sustitution 0=o s=5 n=&&
    - Rainbow attack = fast lookup to reveal password. based on rainbow tables. Rainbow tables= created by brute forcing every password and recording the resulting hash value, very large tables. To protect passwords, OS store passwords as their hash values. Attacker compromises a system, steals password hashes. Performs reverse lookup from hash to password in the rainbow table. break computer compromise this credential.
  - Ciphertext only attack
    - see ciphertext. bad guy can only monitor the communications channel, record and identify patterns. only good at reveling symmetric keys ciphers only.
  - Known plaintext attack
    - he knows the plaintext message and has access to resulting ciphertext.  can compare plaintext with cipertext.  stronger position bad guy.
  - chosen plain text attack
    - attacker chooses plaintext with patterns hopint to produce patterns in the ciphertext. get in to the computer. type text message and observe prduce ciphertex.  compare chosen text to reveal the key more directly.
  - chosen ciphertext attack
    - attacker has access to system but needs the keys. attacker send patterns of ciphertext to target for decryption. analyzes the resulting plaintext. decrypted ciphertext is more revealing of patterns. may be successful at revealing asymemtric private key.
Physical security
- Safety = priority. Natural Supply system= heating , aircondition, gas , water Man-made= sabotage, riot Technical = disk failure.
- Litigation
  - due diligence, due care, prudent person , liability, avoid negligence, proximate causation
- Security goals
  - Prevent=avoid the breach Deter=convince not to attack Delay= If they attack, slow them down Detect= Recognize the breach Assess= Identifiy the level of severity Respond= Introduce a calibrated response. corrective= initial response to mitigate losses recovery = longer term. Repair and return to normal state.
  - Facility High crime, fortifiying the environment Visibility= attract customers or avoid nosey Construction= fire rating , forcible entry resistance Crime Prevention Through Enviornmental desigh Hardened exterior Territorial reinforcement Natural access control Natural srveillance.
- perimeter defense
  - 3-4 feet = 1-1.5 deters the casual trepasser 6-7 fet/2-2.5 Determined intruder 8+ feet 2.5 meters = serious trheat PIDAS= Perimeter Intrusion Detection and Assessment System Detective Electrified fence 0 Deterrent and preventive.
- Access Control
  - Security guards, Id badges proximity cards Mantrap Turnstile smoking areas Loggin needs Emergencyu exits and drills Fire code
- sSecurity zones
  - Controlled and audited access visitor areas/restricted areas data center media storage areas high value assets
- physical environment
  - Suitable for human occupation heating venilation protect intakes filtered positive pressure water positive drains temp 70 74 21-23 C Humidity 40 -60
  - 21-23 C Humidity 40 60%
  - Electricity constant stable supply redundant power line fuel powered generator uninterruptable Electro Magnetic interference EMI RFI , EMI, transient spurious noise, no pattern no consistency.
  - Electrical Issues
    - Spike= instant high voltage Surge= prolonged high voltage Sag= Momentary low voltage Brownout=prolonged low voltage Fault= localied power loss Blackout=prolonged power loss Transient= momentary electrical static noise.
- Fire Safety
  - A=Ash=Common combustible=Water B=Boil=Flamble liquieds (oil)=GasCo2, FM200, Dry powder C= Current=Electrical=Gas, Co2, FM200 , Non conductive Foam D=Dent= Flamable metals=magnesium, sodious, patassum,= dry powders no water.
  - 4 legs heat, oxygen, fuel, chemical reaction. take away one or more of these to extinguish the fire. cool the temperature remove oxygen and fuel disrupt chemical reaction
- Fire Detectors
  - Ionizing detector = radioctive material to generate ions. Smoke . Photoelectric detector.= Let as light source, photo dectors at 90 degrees smoke reflects photons. Infrared dtectro= fires sees. infrared heat signature Thermal detector= fixed, rate rise. Detector Placement
- Fire Extinguishers and Sprinklers
  - Rating= Match extinger Placement 50 feet. Inspection. visual = quarterly Tested= annually Training = part of annual security
- Gas Suppressants and fire trainning
  - wet pipe= most common, cheap. Dry pipe= solves frozen pipe problem. Pre action= Usually dry pipe Deluge=fire is extremely dangerous.
  - Gas suppressants= Halon = banned ozone FM200 bad for hummans CO2 more dangerous to people. used with countdown timer to evacuate local Ofent installed below floor in data center. Shut off HVAC before use plan physical environtment
  - Fire plan and drill plan procedures, evacuation routes, roles Assign roles and provide additional training
Security Models
- Models / Standards/ Protocols = Ink and paper Computer hardware and software.
- State Machine
  - Computer is secure in any state of operation
- Information flow
  - one user accessing objects will not alter the access level of another user.
- Non Interference
- Bell - Lapuda
  - Confidentiality Model Mandatory Access Coontrol Mac  Govertment, strong , expensive, slow, lattice, labels, clearance, classification, need to know No read up  No write down No read or write up or down .. strong.
- Biba
  - Integrity Model MAC Goverment, strong , expensive, slow, lattice, labels, clearance, classification, need to know, category No read down, no wirte up related to plyinstatiation.
- Clark wilson
  - Integrity model commercial separation of duties 1.Authorized users are not allowed to make unauthorized changes 2.Unautorized users are not allowed to make any changes 3. very internal and external cosistency.
  - Active agent - subject or user pursuing access Transformation Procedures TP programatic data Constrainded data Items CDI UDI Uncstraided data items Integrity Cerification Procedures IVP
- BREWER nASH
  - defend against conflicts of interes commercial = chinese wall context oriented control No information can flow beteween  subjects and objects in a way that would create a conflict of interest.
- The trusted computing based
  - some level of trust for the computer that it will not be the source of breach of the confidentiality , integrity or availability. Hardware, firmware and software . Perimeter  tested and certified components. TCB blue screen= if the kernel is violated. kill himself.
  - Requirements: Isolate subjects form objects reference monitor to verify access protected memory system kernel self protection user model/kernel mode/ring architecture  Blue screen trusted recovery
  - TCSEC
    - The trusted computing security evaluation criteria NCSC National computer security center minimal D - max Aorange bookdfinition of tcbbased on bell - lapadula/confidentialityred book . trusted network interpretationthe rainbow series.
    - TCSEC Requirements Certification = tested and meets standard functionality  = can it do it even once Assurance = it can do it every time under the stated condition Accreditation = acceptance by management trusted. Levels of certification A1 Formally verified B1, b2, B3 MAC b3 stronger C1, C2 Discretionary Access control D= minimal security
  - ITSEC
    - France, Germany, Netherland, UK Extension of the TCSEC based on bell - Lapadula confidentiality Criteria E0 = ITESEC in TCSEC =D E1+F1  C1 D2+F2 =C2 E6+F5=A1 TCSEC
  - The Common Criteria
    - replaces tcsec and itsec. Adopted by ISO: ISO/IEC 15408-1 overview ISO/IEC 15408-2 functionality+ISO/IEC 154803-3 Assurance
    - EAL1 funtional tested EAL7 Formally verified design and tested. Funtionally tested structurally tested methodically tested semy formally formally verified design and tested
- Computer Hardware
  - CPU Control unit = Registers = Aritmetic Logic Unit -> Address bus, data bus Cache memory, SRAM CLose to cpu DRAM = Ramdom access memory BIOS=read only memory
  - CPU
    - CPU Capabilities Scalar processor = single core that can execute one instruction aat a time Superscalar processor = single core thaat can execute more than one instruction at a time Pipelining = output of one process in the input of the next process allowing overlap of multiple instruction.
    - Arithmetic Logic Unit
      - performs math and binary logic functions
    - Control unit
      - staging instructions (Treads) closer to cpu
      - Process states Blocked(sleep) process does not have all required data element Ready (wait) has all required data elements and is ready to be processed. Running= control unit has staged instructions (treads) data closer to cpu.
      - Process table. the control unit and the cpu communicate by using INTERRUPTS = Like caller ID for a process.
    - Register
      - physically close to cpu. fastest memory in the computer system sub nano second access times
    - Instruction sets
  - Motherboard
    - holds cpu, ram, rom , bussess. Physical segmentation= isolating process and data. 2 of cpus, or rams. Multiprocessor system= system with more than one physical cpu and or cores. single cpu with 2 cores. phisical separated but share registers, control by control unit. vulnerabildad malware in both cores. need multi CPU chips. better multi i7 ships.
  - Memory
    - closer to the cpu , the faster. Register = on the cpu chip Volatile.
    - Memory: Real / Primary Memory = Register on the CPU the L1 and L2 Cache Memory  and Ramdom Accss memory RAM Volatile.- data is lost when is power down Secondary Memory = slower storage hard disk, flash memory optical disk non volatile. Memory sequential memory= moving drectly o the location tape Random Access Memory
    - Shared memory= early systems allowed DOS , WFW. allow unauthorized access to instructions and data. Memory protection= RAM is allocated to a process. Security kernel LSA. w95 , NT. OSwarp TPM Trusted platform module. mother board.  contains crypto code, key generator, and secure storage, securely sotres decryption key. If hard disk is removed from system, the disk cannot be decrypted and no data can be accessed.
    - Memory management = return memory to Garbage collection= overwrites entire buffer with random data.. Failure to return memory is called a memory leak.
    - Address space layout randomization (ASLR) objects in memory at randomized locations, makes predicting buffer attack more difficul. Protedted memory LSA Non executable memory (NX bit) OS flags and protects data in memory as non executable.
    - Cache memory
      - Cache = electtrically and physically close to CPU. Tipicaly 1-3ns. Static RAM SRAM Level 1 = mounted on CPU Level 2 = mounted on motherboard near CPU.
    - DRAM
      - bulk memory DRAM Dynamic 10 ns access time 1000 times per second Volatie. Protected by the local security Authority (LSA)plug in .
      - page fault data was in ram but is not in ram, page fault trigger page out. virtual memory manager.
    - Virtual Memory
      - SWAPfile or pagefile VMEM 10 ms access time 1 mill time slower than RAM
    - ROM BIOS
      - storage for bios. bootstrap OS, low level drivers, configuration program PROM Progamable EPROM Erasable EEPROM Electrically erasable PROM
  - Operating system
    - Boot, System reads the Bios EEPROM loads the bootstrap OS into RAM. Low level drivers load into RAM low level display driver loads, you get the grey on black ASCI text display. disk controler driver loads IO.sys, Boot Configuration data (BCD) lilo or GRUP
    - reference monitor
  - 4 Ring architecture
    - 0 kernel
      - kernel mode execution full authority over system malware can be installed to operate in kernel mode the attacker can own  the system, it may never be detected. Device drivers and OS updates are comoon avenues.
      - rootkits: malware full control on system. (netbus) back oriface, etcc) KERNE LMODE ROOTKIT (RARE BUT VERY DANGEROUS) uSER MODE ROOTKIT(MORE COMMON STILL DANGEROUS.
      - 1 services
        2 drivers
        3 Apps
        From 3 to 2 via API
        User
        Device
        Execute
  - Hardened server batios
    - Dedicated function - one or two services maximum Patched frequently Install anti malware (virus spyware) Install Host based Intrusion Prevention System HIPS Firewall enabled and configured Physically secured
    - Resist attack with reduced attack surface
  - Computing Systems
    - Virtualization
      - Virtual Desktop Infrastructure VDI
        VMEscaping = VM to host OS exexploits VM to VM exploits Multit tenancy issues Host and guest OS must be properly licensed Virtual network infrastructure must be managed.

Images and files in the map

Information

Description: Mind Map on Domain 3 Security Engineering, created by Marcos Alvarado on 23/11/2017.
Created by: Marcos Alvarado
Views: 7
Rating