Please enable JavaScript.

Coggle requires JavaScript to display documents.

CISSP ALL - Risk Management (Protection Mechanisms (Layering or Defense in…

- - - - Sensitivity
      - Criticality
      - Discretion
        Discretion is an act of decision where an operator can influence or control disclosure in order to minimize harm or damage
      - Concealment
        Concealment is the act of hiding or preventing disclosure. Often concealment is viewed as a means of cover, obfuscation, or distraction.
      - Secrecy
      - Privacy
      - Seclusion
        Seclusion involves storing something in an out-of-the-way location. This location can also provide strict access controls. Seclusion can help enforcement confi dentiality protections
      - Isolation
        Isolation is the act of keeping something separated from others. Isolation can be used to prevent commingling of information or disclosure of information.
    - - Other Aspects
        
        Accuracy
        
        Truthfulness
        
        Authenticity
        
        validity
        
        nonrepudiation
        
        accountability
        
        responsiblity
        
        completeness
        
        comprehensiveness
      - Preventing unauthorized subjects from making modifications
      - Preventing authorized subjects from making unauthorized modifications, such as mistakes
      - Maintaining the internal and external consistency of objects so that their data is a correct and true reflection of the real world and any relationship with any child, peer, or parent object is valid, consistent, and verifiable
    - - Other Aspects
        
        Usability
        
        Accessiblity
        
        Timeliness
- - - - The transmission must be initiated by a person other than the provider.
      - The transmission, routing, provision of connections, or copying must be carried out by an automated technical process without selection of material by the service provider
      - Any intermediate copies must not ordinarily be accessible to anyone other than anticipated recipients, and must not be retained for longer than reasonably necessary.
      - The material must be transmitted with no modification to its content.
    - - service providers system caching
        
        storage of information on a network by individual users
        
        duplication of software for testing, maintenance
- - - - SSP - Simple Security Property
        
        a subject may not read information at a higher sensitivity level (no read up).
      - * star Security Policy or Confinement Property
        
        a subject may not write information to an object at a lower sensitivity level (no write down).
      - Discretionary Security Property
        the system uses an access matrix to enforce discretionary access control.
      - :warning: Trusted Subject
        
        An exception in the Bell-LaPadula model states that a “trusted subject” is not constrained by the Security Property. A trusted subject is defined as “a subject that is guaranteed not to consummate a security-breaching information transfer even if it is possible.” This means that a trusted subject is allowed to violate the Security Property and perform a writedown, which is necessary when performing valid object declassification or reclassification.
    - - :warning: drawbacks
        ■ It addresses only integrity, not confidentiality or availability.
        ■ It focuses on protecting objects from external threats; it assumes that internal threats are handled programmatically.
        ■ It does not address access control management, and it doesn’t provide a way to assign or change an object’s or subject’s classification level.
        ■ It does not prevent covert channels.
- - - - Brainstorming
      - Delphi technique
        
        an anonymous feedback- and-response process used to enable a group to reach an anonymous consensus
        
        The results are compiled and presented to the group for evaluation. The process is repeated until a consensus is reached.
      - Storyboarding
      - Focus groups
      - Surveys
      - Questionnaires
      - Checklists
      - One-on-one meetings
      - Interviews
- - - - actions
        
        disinfect the affected files and restore the machine to a safe condidtion
        
        quarantine the files until the user or an administrator can examine them manually
        
        depending on threshold, delete the infected files in an attempt to preserve system integrity
    - - worms
      - Trojan horses
      - logic bombs
      - rootkits
      - spyware
      - email or web-borne code
- - - - The client sends its TGT back to the KDC with a request for access to the resource.
      - KDC verifies TGT is valid and check access control matrix
      - KDC generates a service ticket and send to the client
      - The client sends the ticket to the server or service hosting the resource
      - The server or service hosting the resource verifies the validity of the ticket with the KDC
      - Once identity and authorization is verified, Kerberos activity is complete. The server or service host then opens a session with the client and begins communications or data transmission.
- - - - RBAC - rule-based access control
- - - - ITSEC
        
        B2 / B3 / A1
  - - - Usefulness
      - Timeliness
      - Value or cost
      - Maturity or age
      - Lifetime
      - Association with Personnel
      - Data Disclosure Damage Assessment
      - Data Modification Damage Assessment
      - National Security Iimplication
      - Authorized Access to data
      - Restriction from data
      - Maintenance and monitoring of the data
      - Storage of the data
    - - Government Classification
        
        Top Secret
        :lock: highest level
        :fire: grave national security damage
        
        Secret
        
        :lock: restricted nature
        
        :fire: critical damage
        
        Confidential
        :lock: private, sensitive, proprietary, or highly valuable nature
        :fire: noticeable effect or serious national security damage
        
        Unclassified
        
        ok
      - business/private sector classification
        
        Confidential or Private or Proprietary
        :lock: highest level of classification
        :fire: drastic effect on the competitive edge
        
        Sensitive
        :lock: more classified than public
        :fire: negative impact to the company
        
        Public
        ok
        
        Ownership
- - - - Formula
        
        Risk_DREAD = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5
        
        scale : 0 = nothing ; 5 = some ; 10 = all
      - Damage Potential
        
        How severe is the damage likely to be if the threat is realized?
      - Reproducibility
        
        How complicated is it for attackers to reproduce the exploit?
      - Exploitability
        
        How hard is it to perform the attack?
      - Affected users
        
        How many users are likely to be affected by the attack (as a percent- age)?
      - Discoverability
        
        How hard is it for an attacker to discover the weakness?
- - - - Evidence gathering
        
        voluntarily surrender
        
        get a court to issue a subpoena
        
        search warrant
        
        employees sign an agreement that provides consent to search and seize any necessary evidence during an investigation
    - - ■ What is the nature of the incident, how was it initiated, and by whom?
      - ■ When did the incident occur? (Be as precise as possible with dates and times.)
      - ■ Where did the incident occur?
      - ■ If known, what tools did the attacker use?
      - ■ What was the damage resulting from the incident?
- - - - Symmetric Multi Processing (SMP)
        * for simple operation with high rates
      - Massively Parallel Processing (MPP)
        * processing very large, complex, computationally intensive tasks that lend themselves to decomposition and distribution into a number of subordinate parts.
- - - - B1 - Labeled Security
        
        suitable to house classified data
      - B2 - Structured Protection
        
        must ensure no covert channel exists
        
        sufficient for classified data
      - B3 - Security Domain
        
        sufficient to house very sensitive or secret data
- - - - Content-dependent access control
        
        Content-dependent access control is based on the contents or payload of the object being accessed. Because decisions must be made on an object-by-object basis, content-dependent control increases processing overhead.
      - cell suppression
        
        hiding individual database fields or cells or imposing more security restrictions on them
      - Context-dependent access control
        
        evaluates the big picture to make access control decisions.
        
        The key factor in context-dependent access control is how each object or packet or fi eld relates to the overall activity or communication. Any single element may look innocuous by itself, but in a larger context that element may be revealed to be benign or malign
      - Partitioning
        
        to subvert aggregation and inference vulnerabilities
      - Polyinstantiation
        
        Polyinstantiation occurs when two or more rows in the same relational database table appear to have identical primary key elements but contain different data for use at differing classification levels. It is often used as a defense against some types of inference attacks
        
        e.g. Navy patrol boat data example
      - Noise and perturbation
        
        can insert false or misleading data into a DBMS in order to redirect or thwart information confidentiality attacks
- - - - Stage 1: The Incipient Stage At this stage, there is only air ionization but no smoke.
      - Stage 2: The Smoke Stage In Stage 2, smoke is visible from the point of ignition.
      - Stage 3: The Flame Stage T his is when a fl ame can be seen with the naked eye.
      - Stage 4: The Heat Stage At Stage 4, the fi re is considerably further down the timescale to the point where there is an intense heat buildup and everything in the area burns
    - - Water suppresses the temperature
      - Soda acid and other dry powders suppress the fuel supply
      - CO 2 suppresses the oxygen supply
      - Halon substitutes and other nonflammable gases interfere with the chemistry of combustion and/or suppress the oxygen supply
  - - - ■ A wet pipe system (also known as a closed head system ) is always full of water. Water discharges immediately when suppression is triggered.
      - ■ A dry pipe system contains compressed air. Once suppression is triggered, the air escapes, opening a water valve that in turn causes the pipes to fill and discharge water into the environment.
      - ■ A deluge system is another form of dry pipe system that uses larger pipes and therefore delivers a significantly larger volume of water. Deluge systems are inappropriate for environments that contain electronics and computers.
      - ■ A preaction system is a combination dry pipe/wet pipe system. The system exists as a dry pipe until the initial stages of a fire (smoke, heat, and so on) are detected, and then the pipes are filled with water. The water is released only after the sprinkler head activation triggers are melted by sufficient heat. If the fire is quenched before sprinklers are triggered, pipes can be manually emptied and reset. This also allows manual intervention to stop the release of water before sprinkler triggering occurs.
    - - Halon
        
        toxic after 900 degrees F
        
        affect ozone and banned
        
        replace halon substitutes with low-pressure water mist (not suitable for computers)
        
        approved substitute: ■ FM-200 (HFC-227ea) ■ CEA-410 or CEA-308 ■ NAF-S-III (HCFC Blend A) ■ FE-13 (HCFC-23) ■ Argon (IG55) or Argonite (IG01) ■ Inergen (IG541)
- - - - Local Alarm System
        
        must be audible up to 120 decibel & 400 feet away
        
        anti tampering or disablement
        
        guard presence to response
      - Central Station System
        
        usually silent locally, but offsite monitoring agents are notified so they can respond to the security breach
      - Auxiliary Station
        
        can be added to either local or centralized alarm systems. When the security perimeter is breached, emergency services are notified to respond to the incident and arrive at the location. This could include fire, police, and medical services.
- - - - ■ General description of the evidence
      - ■ Time and date the evidence was collected
      - ■ Exact location the evidence was collected from
      - ■ Name of the person collecting the evidence
      - ■ Relevant circumstances surrounding the collection
- - - - DNS cache poisoning
      - HOSTS poisoning
        
        changing the host file entries to map the target to malicious address
      - Authorized DNS server attacks
        
        aim at altering the primary record of a FQDN on its original host system.
      - DNS query spoofing
        
        The attacker then sends back a reply with false information. If the client accepts the false reply, they will put that information in their local DNS cache.
- - - - Data Dictionary
        
        A data dictionary is commonly used for storing critical information about data, including usage, type, sources, relationships, and formats. DBMS software reads the data dictionary to determine access rights for users attempting to access data
      - Meta data
        
        Metadata can be the important, significant, relevant, abnormal, or aberrant elements from a dataset
      - data mart
        
        meta data is stored in more secure location called data mart
- - - - Category A
        
        Verified protection. The highest level of security.
        
        sufficient to protect top level top-secret data
        
        security by design
        
        Every step is documented and verified, from the design all the way through to delivery and installation
      - Category B
        
        Mandatory protection
        
        B1 - Labeled Security
        
        suitable to house classified data
        
        B2 - Structured Protection
        
        must ensure no covert channel exists
        
        sufficient for classified data
        
        B3 - Security Domain
        
        sufficient to house very sensitive or secret data
      - Category C
        
        Discretionary protection
      - Category D
        
        Minimal protection. Reserved for systems that have been evaluated but do not meet requirements to belong to any other category.
    - - ■ Rates confidentiality and integrity
      - ■ Addresses communications integrity
      - ■ Addresses denial of service protection
      - ■ Addresses compromise (in other words, intrusion) protection and prevention
      - ■ Is restricted to a limited class of networks that are labeled as “centralized networks with a single accreditation authority”
- - - - Fail secure
        
        restrictive. failed with high level security.
        
        disable most feature and only admin can diagnose
      - Failed open
        
        permissive
        
        allows users to bypass failed security controls
  - - - Access Control
      - Confidentiality - encryption and data protection techniques
      - Audit Trail
      - Fault Tolerance
- - - - Computer Fraud and Abuse Act
      - Electronic Communications Privacy Act
      - Identity Theft and Assumption Deterrence Act
  - - - three burdens of proof for negligence
        
        must have a legally recognized obligation
        
        must have failed to comply with recognized standards
        
        there must be a causal relationship between the act of negligence and subsequent damages
    - - Define Mission-critical systems
        
        GISRA provides specific evaluation and auditing authority for mission‐critical systems to the secretary of defense and the director of central intelligence.
        
        It is defined as a national security system by other provisions of law.
        
        It is protected by procedures established for classified information.
        
        The loss, misuse, disclosure, or unauthorized access to or modification of any information it processes would have a debilitating impact on the mission of an agency.
    - - Periodic assessments of risk
      - Policies and procedures that are based on risk assessments, cost‐effectively reduce information security risks to an acceptable level, and ensure that information security is addressed throughout the life cycle of each organizational information system
      - Subordinate plans for providing adequate information security for networks, facilities, information systems, or groups of information systems, as appropriate
      - Security awareness training to inform personnel (including contractors and other users of information systems that support the operations and assets of the organization) of the information security risks associated with their activities and their responsibilities in complying with organizational policies and procedures designed to reduce these risks
      - Periodic testing and evaluation of the effectiveness of information security policies, procedures, practices, and security controls to be performed with a frequency depending on risk, but no less than annually
      - A process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, and practices of the organization
      - Procedures for detecting, reporting, and responding to security incidents
      - Plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the organization.