Please enable JavaScript.

Coggle requires JavaScript to display documents.

CT 201 Wk1 Ch1 (Review Questions (What is the difference between a threat…

- - - - 1968 - Maurice Wilkes discusses password security in Time-Sharing Computer Systems.
      - 1970 - Willis H. Ware authors the report Security Controls for Computer Systems: Report of Defense Science Board Task Force on Computer Security-RAND Report R-609, which was not declassified until 1979. It became known as the seminal work identifying the need for computer security.
      - 1973 -Schell, Downey, and Popek examine the need for additional security in military systems in Preliminary Notes on the Design of Secure Military Computer Systems.
      - 1975 - The Federal Information Processing Standards (FIPS) examines DES (Digital Encryption Standard) in the Federal Register.
      - 1978 - Bisbey and Hollingworth publish their study “Protection Analysis: Final Report,” which discussed the Protection Analysis project created by ARPA to better understand the vulnerabilities of operating system security and examine the possibility of automated vulnerability detection techniques in existing system software.7
      - 1979 - Morris and Thompson author “Password Security: A Case History,” published in the Communications of the Association for Computing Machinery (ACM). The paper examined the design history of a password security scheme on a remotely accessed, time-sharing system.
      - 1979 - Dennis Ritchie publishes “On the Security of UNIX” and “Protection of Data File Contents,” which discussed secure user IDs, secure group IDs, and the problems inherent in the systems.
      - 1982 - The U.S. Department of Defense Computer Security Evaluation Center publishes the first version of the Trusted Computer Security (TCSEC) documents, which came to be known as the Rainbow Series.
      - 1984 - Grampp and Morris write “The UNIX System: UNIX Operating System Security.” In this report, the authors examined four “important handles to computer security”: physical control of premises and computer facilities, management commitment to security objectives, education of employees, and administrative procedures aimed at increased security.8
      - 1984 - Reeds and Weinberger publish “File Security and the UNIX System Crypt Command.” Their premise was: “No technique can be secure against wiretapping or its equivalent on the computer. Therefore no technique can be secure against the system administrator or other privileged users...the naive user has no chance.”9
      - 1992 - Researchers for the Internet Engineering Task Force, working at the Naval Research Laboratory, develop the Simple Internet Protocol Plus (SIPP) Security protocols, creating what is now known as IPSEC security.
  - - - Control, safeguard, or countermeasure: Security mechanisms, policies, or procedures that can successfully counter attacks, reduce risk, resolve vulnerabilities, and otherwise improve security within an organization. The various levels and types of controls are discussed more fully in the following chapters.
      - • Exploit: A technique used to compromise a system. This term can be a verb or a noun. Threat agents may attempt to exploit a system or other information asset by using it illegally for their personal gain. Or, an exploit can be a documented process to take advantage of a vulnerability or exposure, usually in software, that is either inherent in the software or created by the attacker. Exploits make use of existing software tools or custom-made software components.
      - • Exposure: A condition or state of being exposed; in information security, exposure exists when a vulnerability is known to an attacker.
      - • Loss: A single instance of an information asset suffering damage or destruction, unin- tended or unauthorized modification or disclosure, or denial of use. When an organi- zation’s information is stolen, it has suffered a loss.
      - • Protection profile or security posture: The entire set of controls and safeguards, includ- ing policy, education, training and awareness, and technology, that the organization implements to protect the asset. The terms are sometimes used interchangeably with the term security program, although a security program often comprises managerial aspects of security, including planning, personnel, and subordinate programs.
      - • Risk: The probability of an unwanted occurrence, such as an adverse event or loss. Organizations must minimize risk to match their risk appetite—the quantity and nature of risk they are willing to accept.
      - • Subjects and objects of attack: A computer can be either the subject of an attack—an agent entity used to conduct the attack—or the object of an attack: the target entity, as shown in Figure 1-8. A computer can also be both the subject and object of an attack. For example, it can be compromised by an attack (object) and then used to attack other systems (subject).
      - • Threat: Any event or circumstance that has the potential to adversely affect operations and assets. The term threat source is commonly used interchangeably with the more generic term threat. While the two terms are technically distinct, in order to simplify discussion, the text will continue to use the term threat to describe threat sources.
      - • Threat agent: The specific instance or a component of a threat. For example, the threat source of “trespass or espionage” is a category of potential danger to information assets, while “external professional hacker” (like Kevin Mitnick, who was convicted of hacking into phone systems) is a specific threat agent. A lightning strike, hailstorm, or tornado is a threat agent that is part of the threat source known as “acts of God/acts of nature.”
      - • Threat event: An occurrence of an event caused by a threat agent. An example of a threat event might be damage caused by a storm. This term is commonly used inter- changeably with the term attack.