Fichas
Unit 1.1 / Security Controls / Study Notes
Fichas del conjunto (64)
- 1Cybercrimecommitting a crime using a computer system
- 2AssetA thing of economic value.
- 3Usual Classifications of Assets1. Tangible
2. Intangible
3. People - 4Tangible assetsPhysical items, i.e. buildings, furniture, computer equipment, software licenses, machinery, inventory (stock)
- 5Intangible AssetsMostly information resources, including Intellectual Property (IP), accounting information, plans and designs. Also includes company's reputation and image or brand
- 6EmployeesOrganization's most valuable asset
- 7Business continuityAn organization's ability to recover from incidents
- 8IncidentAny malicious or accidental breach of security
- 9CIA TriadThree properties of Secure Information.
1. Confidentiality
2. Integrity
3. Availability - 10ConfidentialityCertain information should only be known to certain people.
- 11IntegrityData is stored and transferred as intended and that any modification is authorized.
- 12AvailabilityInformation is accessible to those authorized to view or modify it.
- 13Non-repudiationA subject cannot deny doing something, such as creating, modifying, or sending a resource.
- 14Security PolicyA document that states in writing how a company plans to protect it's physical and information technology (IT) assets.
- 15Steps for Creating a Security Policy1. Obtain genuine support and commitment throughout the organization.
2. Analyse risks within the organization.
3. Implement controls that detect and prevent losses and procedures that enable the organization to recover from losses.
4. Review, test, and update procedures continually. - 16What are Risks?Components, processes, situations, or events that could cause the loss, damage, destruction, or theft of data or materials.
- 17National Institute of Standards and Technology (NIST)Responsible for issuing the Federal Information Processing Standards (FIPS) plus advisory guides called Special Publications.
- 18Security Control (or countermeasure)Designed to make a particular asset or information system secure (that is, give it the properties of confidentiality, integrity, availability, and non-repudiation).
- 19FIPS 200 and NIST Special Publication 800-53Documents that identify security controls as belonging to 3 classes and 18 families.
- 20Security Control Classes1. Technical
2. Operational / administrative
3. Management - 21Technical ControlControl is implemented as a system (hardware, software, or firmware). e.g.firewalls, anti-virus software, and OS access control models
- 22Operational / administrative ControlControl is implemented primarily by people rather than systems. e.g.security guards and training programs
- 23Management ControlControl gives oversight of the information system. e.g. risk identification or a tool allowing the evaluation and selection of other security controls.
- 24Physical Security Control Types1. Administrative - determine the way people act, including policies, procedures, and guidance.
2. Technical - implemented in operating systems, software, and hardware devices. - 25Other Classifications of Controls1. Preventive - physically or logically restricts unauthorized access.
2. Deterrent - psychologically discourages an attacker from attempting an intrusion.
3. Detective - identifies and records any attempted or successful intrusion.
4. Corrective - responds to and fixes an incident and may also prevent its re-occurrence.
5. Compensating - restores the function of the system through some other means, such as using data backup or an alternative site. - 26SubjectsUsers or software processes or anything else that can request and be granted access to a resource.
- 27ObjectsThe resources; these could be networks, servers, databases, files, etc.
- 28Access Control List (ACL).A list of subjects and the rights or permissions they have been granted on the object.
- 29Four Main Processes that defines an Access Control System1. Identification
2. Authentication
3. Authorization
4. Accounting - 30IdentificationCreating an account or ID that identifies the user or process on the computer system.
- 31AuthenticationProving that a subject is who or what it claims to be when it attempts to access the resource.
- 32AuthorizationDetermining what rights subjects should have on each resource and enforcing those rights.
- 33AccountingTracking authorized and unauthorized usage of a resource.
- 34AccountIdentifies a subject on a computer system. It consists of an Identifier, credentials and a profile.
- 35Identifier (SID)Unique number assigned to an account when created on a computer system
- 36CredentialsInformation used to authenticate a subject when it tries to access the user account. i.e. username and password or smart card and PIN code.
- 37Profileinformation stored about the subject. This could include name and contact details and also group memberships.
- 38Issuance (or enrollment)Processes by which a subject's credentials are recorded and issued and linked to the correct account and by which the account profile is created and maintained.
- 39Identity ProofingVerifying that subjects are who they say they are at the time the account is created.
- 40Identity ManagementIssues and problems that must be overcome in implementing the identification and authentication system across different networks and applications.
- 41AuthenticationCredentials provided by account holder are compared to credentials stored on the system.
- 42Factors Defining Credentials1. Something you know.
2. Something you have.
3. Something you are. - 43Techniques to Manage Digital Identities1. Password reset
2. Single Sign On - 44Password ResetAutomating the password reset process reduces the administration costs associated with users forgetting passwords, but making the reset process secure can be problematic.
- 45Single Sign-OnAll network resources and applications accept the same set of credentials, so the subject only needs to authenticate once per session. This requires application compatibility and is difficult to make secure or practical across third-party networks.
- 46Something You Know Authenticationi.e. username and a password, passphrase, PIN (Personal Identification Number), PII ( Personally Identifiable Information) etc.
- 47Something You Have Authenticationsmart card, USB token, or key fob that contains a chip with authentication data, such as a digital certificate, hardware token that generates a one-time password.
- 48Something You Are Authenticationbiometric recognition system.
- 49Single factor authentication systemsUses one of the authentication methods;
1. Something You Know
2. Something You Have
3. Something You Are - 50Two-factor authenticationCombines two of the methods i.e.
1. Something you have - smart card
2. Something you know - PIN - 51Three-factor authenticationCombines all three methods. i.e.
smart card with integrated thumb- or fingerprint reader.
Smart Card+Finger Print+PIN - 52AuthorizationProcess by which users (typically authenticated users) are granted rights to access and modify resources.
- 53Important functions in authorization1. Ensuring that only authorized rights are exercised (policy enforcement).
2. Determining rights (policy definition) - 54Formal Access Control Models1. Discretionary Access Control (DAC).
2. Role-based Access Control (RBAC).
3. Mandatory Access Control (MAC). - 55Discretionary Access Control (DAC)Access control model where each resource is protected by an Access Control List (ACL) managed by the resource's owner (or owners).
- 56Role-based Access Control (RBAC).Resources are protected by ACLs. However, management of ACLs is reserved to administrators rather than owners and users are assigned permissions according to job function rather than personally.
- 57Mandatory Access Control (MAC).Resources are protected by inflexible, system defined rules. Resources (objects) and users (subjects) are allocated a clearance level (or label). There are a number of privilege models, such as Bell-LaPadula, Biba, and Clark-Wilson providing either confidentiality or integrity.
- 58Rule-based Access ControlAny access control model that follows system-enforced rules that cannot be countermanded can be described as "rule-based". A firewall is a good example of rule-based access control but the MAC and role-based models can also be described as rule-based. DAC is not rule-based as decisions are made by the resource owner.
- 59Basic Authorization Policies1. Implicit Deny
2. Least Privilege - 60Implicit DenyImplicit deny is a basic principle of security stating that unless something has explicitly been granted access it should be denied access. An example of this is firewall rule processing, where the last (default) rule is to deny all connections not allowed by a previous rule.
- 61Least PrivilegeLeast privilege is a basic principle of security stating that something should be allocated the minimum necessary rights, privileges, or information to perform its role.
- 62LogsOS and applications software can be configured to log events automatically. This provides an audit trail of actions performed on the system as well as warning of suspicious activity. It is important that log configuration and files be made tamper-proof.
- 63SurveillanceMeans of accounting for physical access to a system (though electronic surveillance can also detect when a user accesses a computer system). Surveillance is also a type of access control, as it acts as a deterrent to those who would otherwise attempt to penetrate the system.
- 64Incident ReportingInforming the relevant person that there has been a security breach. Auditing software might do this automatically (for example, by emailing the administrator).
Información
- Descripción
- Fichas sobre Unit 1.1 / Security Controls / Study Notes, creado por avernef el 04/06/2015.
- Creado por
- avernef
- Visitas
- 1
- Valoración