Overview
A loss of what is the unauthorized disclosure of info
Confidentiality
This is a wide used defense against intruders
Passwords or password system
what is the granting of a right or permission to a system entity to access a system resource.
Authorization
this is also referred to as single key encryption
symmetric
Incorrect handling of program _____ is one of the most common failings in software security
Input
An example of what threat action is in which sensitive data are directly released to an unauthorized entity?
Exposure
This is the data structure that authorivately binds an indentity & attributes to a token
Credential
Why is the policy DAC, termed as discretionary?
an entity may have access rights that enable another entity to access some resource
The purpose of this is to produce a fingerprint of a file message or block of data
Hash Function
This refers to a wide variety of attacks based on the invalid handling of input data
Injection attacks
A what is a threat that if carried out and successful leads leads to an undesirable violation of security, or threat consequence
attack
what are the 4 means of authenticating?
knows, possess, is, does
The analogy of “who you are” + “what you’re doing” + “where/when you’re doing it” + “when you want to access it” is in reference to which access control that we learned about?
Attribute Based
Encryption protects against what kind of attacks?
Passive or eavesdropping
This is when multiple processes and threads compete to gain uncontrolled access to some resource.
race conditions
Usurpation
An organization can choose between a range of user authentication technologies based on a degree of what in the identity proofing and authentication processes.
confidence
The purpose of access control is to implement a security policy that limits access to who? given their ?
Authorized Users & Access Type
The Hash Property, Given only x, it must be hard to find y such that H(x) = H(y). This is known as?
second Preimage resistant
What are the categories of software security issues?
Insecure Interaction between components, Risky Resource Management, Porous Defenses
Name 3 security principles
Economy of mech, fail safe defaults, complete mediation, open design, separation of privacy, least common mech, psychological acceptability Isolation, Encapsulation, Modularity, Layering, least astonishment
one of the simplest hardware tokens is a what device?
One time password
In RBAC what are the constraints?
Mutually exclusive roles, cardinality, prerequisites roles
protection against active attacks such as falsification is known as what?
Message Authentication
Explain one of the security issues we learned about
must be from the chapter