Documents
Public key certificate standard
What is X.509
defining security relations w/respect to the container, ex. security attributes in metadata
What is declarative security?
CIA
What is Confidentiality, Integrity, Availability - basic functions of any security system
SQL, OS, LDAP variants
What is injection attacks
process where user enters token to demonstrate who are
What is Authentication
EU Data protection regulation
security implementation in code itself - best for business rules
what is imperative (programmatic) security
AAA
What is Authentication, Authorization, Accounting (Auditing)
MitM attack, hijack attack
What are types of session attacks?
owner of object decides which other subjects have what access. Linux default
What is DAC (Discretionary access control)
financial modernization, protect consumers PFI
What is Gramm-Leach-Bliley
defends against locality attacks
What is ASLR - Address space layout randomization
SMART
What is Specific, Measurable, Attainable, Realistic, Time bound - for software development
treat crypto algorithm as parameter data so it can be quickly changed
What is cryptographic agility?
subject's access to object is predetermined property of system rule. Secret, top secret etc. Based on sensitivity of data.
What is MAC (Mandatory access control)
Systems used for financial accounting must have some security control over integrity for confidence of numbers
What is Sarbanes-Oxley
security model, confidentiality, no-read-up, no-write down
What is Bell-LaPadula
DREAD
What is Threat modeling and bug classification: impact times probability - Damage potential, Reproducability, Exploitability, Affected users, Discoverability
reusable solutions to problems that happen regularly. support secure design principles.
What are security design patterns
Each user assigned roles, roles have permissions for tasks associated with role.
What is RBAC (Role-based access control)
Guidance for establishing quality software
What is ISO 9216
integrity, no-write-up (low-water-mark) and no-read-down (simple integrity)
Biba Security model
STRIDE
Threat modelling: Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of Privilege
attack against cryptosystem, take advantage of a byproduct
What is side-channel attack
Based on attributes associated with object and subject. Like medical records access for staff giving care.