Computer Security

44 flashcards · Computer Science · by Athena Papkouf

1. when is a system secure?

   A system is “secure” if an adversary constrained by a specific threat model cannot violate the security policy

2. computer security definition

   Properties of a computer system must hold in the presence of a resourced strategic adversary

3. security properties

   Confidentiality integrity availability Authenticity Anonymity Non-repudiation

4. security policy

   a high level description of the security properties that must hold in the system in relation to assets and principals.

5. threat model

   describes the resources available to the adversary and their capabilities (observe, influence, corrupt,…)

6. Economy of mechanism

   “Keep the [security mechanism / implementation] design as simple and small as possible

7. Trusted Computing Base

   Every component of the system on which the security policy relies.

8. Fail-safe defaults

   “Base access decisions on permission rather than exclusion

9. Complete mediation

   “Every access to every object must be checked for authority

10. Open design

    The design should not be secret

11. Separation of privilege

    No single accident, deception, or breach of trust is sufficient to compromise the protected information

12. Least privilege

    “Every program and every user of the system should operate using the least set of privileges necessary to complete the job

13. Least common mechanism

    Minimize the amount of mechanism common to more than one user and depended on by all users

14. Psychological acceptability

    It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly

15. Work factor

    Compare the cost of circumventing the mechanism with the resources of a potential attacker

16. Compromise recording

    “Reliably record that a compromise of information has occurred [...] in place of more elaborate mechanisms that completely prevent loss

17. Malware taxonomy

18. Virus

    infects programs to monitor / steal / destroy cannot survive without the host same permissions as the host

19. Virus – defenses

    Antivirus Software Signature-based detection Heuristics Sandboxing

20. Worm

    Self-replicating computer program that uses a network to send copies of itself to other nodes Does not need a host program to execute

21. Worm – defenses

    Host-level Protecting software from remote exploitation Achieve diversity to increase protection Antivirus Network-level Limit the number of outgoing connections firewall

22. Trojan Horse

    Malware that appears to perform a desirable function but it also performs undisclosed malicious activities

23. Rootkit

    Adversary controlled code that takes residence deep within the trusted computing base of a system

24. botnet topologies

    Star Topology single point of failure P2P Topology Difficult management (No Command and Control) Vulnerable to attacks in which too many bots are taken over Hybrid

25. Botnets: defense

    Attack C&C infrastructure Honeypots

26. types of privacy depending on who is the adversary

    The adversary are others (Social Privacy) CONCERNS - The privacy problem is defined by Users GOALS - Do not surprise the user LIMITATIONS Only protects from other users: trusted service provider! Limited by users’ capability to understand policies The provider may be adversarial (Institutional Privacy) CONCERNS - The privacy problem is defined by Legislation GOALS – Compliance with data protection principles LIMITATIONS Never questions collection – assumes it is necessary Trusted service provid…

27. network security properties

    Naming security: The association between lower level names (eg. network addresses) and higher level names (e.g. Alice / Bob) must not be influenced by the adversary Routing security: The route over the network and the eventual delivery of messages must not be influenced by the adversary Session security: Messages within the same session, cannot be modified (keep ordering and no adding/removing messages) Content security: The content of the messages must not be readable or influenced by adversar…

28. ARP spoofing - Defenses

    Use of static, read-only entries for critical services in the ARP cache of a host Use ARP spoofing detection and prevention software

29. DNS spoofing – Attacks

    Cache poisoning: corrupt the DNS resolver with fake pairs (IP,domain) DNS Hijacking: corrupt the DNS responses (man in the middle) with fake pairs

30. DNS spoofing – Defenses

    provide origin authentication, DNS responses are digitally signed by authoritative resolvers – prevents poisoning! DNS queries over HTTPS connection

31. BGP Hijacking

    – An adversary controls or compromises a router somewhere on the Internet – Injects false low-cost routes to redirect portions of traffic to themselves – The routing information propagates to routing tables until it expires

32. BGP Spoofing - Defenses

    Filtering could alleviate (some routes should really not come from some routers). Each autonomous system is given a certificate that links its verification key to its IP blocks. Updates are only accepted if they are signed by the authority for the AS/IP Block.

33. IPSec - Internet Protocol Security

    – Key exchange based on public key cryptography or shared symmetric keys – Authentication Header (AH): authentication & integrity (HMAC), protection from replay attacks (sequence number) – Encapsulating Security Payload (ESP): confidentiality

34. modes of IPSec

    – Transport: protects IP packet payload using AH/ESP sent with the original IP headers – Tunnel: protects the whole packet

35. difference between VPN and proxy

    proxy : Encrypted traffic end-to-proxy Proxy separates two networks VPN: Encrypted traffic end to end Acts as one network

36. Firewalls - Simple packet filter

    Inspect each packet in isolation and Reject/Allow depending on certain “rules”

37. Stateful Firewalls

    can Reject/Allow depending on the state

38. DEEP PACKET INSPECTION

    evaluate the content, and allow/ reject based rules can be stateful or stateless

39. software security defenses

    • Data Execution Prevention (DEP) • Address Space Layout Randomization (ASLR) • Stack canaries • Safe exception handlers

40. types of manual testing

    Exhaustive: cover all inputs Not feasible due to massive state space Functional: cover all requirements Depends on specification Random: automate test generation Incomplete (what about that hard check?) Structural: cover all code Works for unit testing

41. types of automated testing

    Static analysis Analyze the program without executing it Imprecision by lack of runtime information, e.g. aliasing Symbolic analysis Execute the program symbolically Keeping track of branch conditions Not scalable Dynamic analysis (e.g., fuzzing) Inspect the program by executing it Challenging to cover all paths

42. Address Sanitizer

    AddressSanitizer (ASan) detects memory errors. It places red zones around objects and checks those objects on trigger events. Out-of-bounds accesses to heap, stack and globals Use-after-free Use-after-return (configurable) Use-after-scope (configurable) Double-free, invalid free Memory leaks (experimental) slowdown is 2x

43. Undefined behavior Sanitizer

    UndefinedBehaviorSanitizer (UBSan) detects undefined behavior. It instruments code to trap on typical undefined behavior in C/C++ programs. Detectable errors are: Unsigned/misaligned pointers Signed integer overflow Conversion between floating point types leading to overflow Illegal use of NULL pointers Illegal pointer arithmetic ... Slowdown depends on the amount and frequency of checks.

44. properties of mitigation

    effectiveness, efficiency, compatibility