Database Architecture and Models
Uses attributes (columns) and tuples (rows) to organize data
Relational Model
Boot record infectors, gain the most privileged access and can be the most damaging
Boot sector
Browser site trust is exploited by trying to submit authenticated requests forcefully to third-party sites.
Cross-site request forgery (CSRF / XSRF)
A process of identifying and determining the true nature if system vulnerabilities
Penetration Testing
What is TCB
The set of all hardware, firmware, and/or software components that are critical to its security. Any compromises here are critical to system security.
Parent child structure. An object can have one child, multiple children or no children.
Hierarchical Model
Any modifications to files or boot sector are hidden by the virus
Stealth
Uses inputs to pretend a user’s browser to execute untrusted code from a trusted site
Cross-site scripting (XSS)
System with published APIs - third parties can use system
Open system
May need to interact with higher rings of protection - such communications must be monitored
Input/output operations
Similar to hierarchical model but objects can have multiple parents
Network Model
The virus modifies the "garble" pattern as it spreads
Polymorphic
Attempts to obtain previously authenticated sessions without forcing browser requests submission
Session Hijacking
Proprietary system - no third-party involvement
Closed system
imaginary boundary that separates the TCB from the rest of the system
security perimeter
Has the capability to handle a variety of data types and is more dynamic than a relational database.
Object-Oriented Model
Infects the bootable section of the system
Master boot record / sector (MBR)
Directly attacks a database through a web app
SQL Injection
Source code can be viewed, edited and distributed free or with attribution or fees
Open-source
The part of the TCB that validates access to every resource prior to granting access requests
reference monitor
Combination of object oriented and relational models.
Object-Relational Model
Loads as and when a program loads to the memory
Resident
An attacker hijacks a session between a trusted client and network server
Man in the middle
A set of functions and procedures allowing the creation of applications that access the features or data of an operating system, application, or other service.
API application programming interface
Monitoring of memory references to verify confidentiality and integrity in storage
Memory protection