329

• Security triad


  A (computing) system is secure only if it exhibits these 3 properties: integrity, availability, confidentiality
• Principle of easiest penetration

  Expect attacker to use any available means of penetration, attackers will go after the weakest link, not the most obvious link nor the most convenient link to fortify
• Principle of adequate protection


  Digital assets should be protected to a degree consistent with their value, and updated when the value changes
• Spending $100,000 to protect an asset that can cause only $1,000 in losses would be rather silly, spending $100,000 to attack a system that can only yield $1,000 in rewards would also be rather silly
• PIPEDA


  Personal Information Protection and Electronic Documents Act, Canadian private-sector law related to digital privacy, applies to organizations that collect personal information
• PIPEDA principles


  • Identify purpose of data collection
  • Obtain consent
  • Limit collection
  • Limit use, disclosure and retention
  • Use appropriate safeguards
  • Give individuals access
  • Be accurate
  • Be open
  • Be accountable
  • Provide recourse
• Violations must be reported, which are then investigated
• Alberta has a similar law called the Personal Information Protection Act
• Identification


  Process of determining which principal an agent wishes to act as
• Authentication


  Proving/verifying the claimed identity of the agent
• Means of authenticating user identity

  • Something the individual knows (password, PIN, answers to pre arranged questions)
  • Something the individual has (token, barcode, smartcard, electronic keycard, physical key)
  • Something the individual is (static biometrics: fingerprint, iris, face)
  • Something the individual does (dynamic biometrics: voice pattern, handwriting, typing rhythm, gait)
• Password guessing attacks


  Brute-force attack, dictionary attack, dictionary + brute force attack, reverse brute force attack, online guessing, offline guessing
• Keystroke logging


  Hardware (USB Keylogger, electromagnetic emissions, wireless sniffing, acoustic keyloggers) and software (trojans, spyware)
• Social engineering


  Psychological manipulation of people to disclose confidential information and/or to perform some actions that are beneficial to the attacker, e.g. phishing, pretexting, quid pro quo, baiting
• NIST password guidelines (2019)

  • No complexity requirements
  • At least 8 (sometimes 6) characters
  • Support at least 64 characters
  • Allow any characters, including spaces, Unicode, and emoji
  • Blacklist frequently used passwords
  • No "password hints" or "secret questions"
  • Do NOT force users to change passwords periodically
  • Allow passwords to be copy-pasted into password fields
  • Use two- or multi-factor authentication
  • At least 10 attempts before lockout
• Password managers


  Offer a secure repository, unlocked by a single master password, various types (browser-based, cloud-based, desktop-based) depending on where password file is stored
• Graphical/visual passwords


  Recognition based, recall based, cued-recall based, potential advantages: could result in stronger passwords, harder for users to "write down" the password
• Neural passwords


  Make the user learn a password subconsciously, the user will be able to prove the knowledge of the password, but will be unable to reveal it
• Password storage


  • Clear text (plaintext)
  • Encrypted
  • Hashed
  • Salted & hashed
  • Salted, peppered, & hashed
• Cryptographic hash function


  A function H that turns any message into a "short", "unique"-ish, and "irreversible"-ish string of bits, output is called a "hash", a "digest" or a "fingerprint" of the input
• Collision resistance ("uniqueness")


  • It should be "hard" to find different x and y such that H(x)=H(y), brute-force is the only viable method
• Preimage resistance ("one-wayness")


  Given H(x), infeasible to find x, H(x) reveals nothing about x beyond the ability to confirm guesses
• Authorization


  About who is allowed to do what, typically decided by the owners of the system, expressed as authorization policy
• Access control


  Enforcing the authorization policy
• Access control models


  • Discretionary (DAC)
  • Mandatory (MAC)
  • Role-based (RBAC)
  • Attribute-based (ABAC)
  • Relationship-based (ReBAC)
  • Rule-set-based (RSBAC)
• Role-based access control (RBAC)


  Users are assigned to roles, and permissions are associated with roles
• Unix file permissions (DAC example)

  Permissions for files and directories, read, write, execute for owner, group, and others
• Examples - permissions for files

  • -rw-r--r-- (read write for owner, read for group and others)
  • -rw-r---- (read write for owner read for group no permissions for others)
• Examples - permissions for directories


  • drwxr-xr-x
  • drwxrwx---
  • drwx--x--x
  • drwxrwxrwx
• Changing permissions examples


  chown, chmod
• Root user (superuser)


  Exempt from usual access control restrictions, has system-wide access, necessary but dangerous
• Linux setuid, setgid and sticky bits


  Special bits on files, setuid bit enables regular users to access files/resources not generally accessible, setgid bit has similar effect but for groups
• chmod


  Command to change file permissions
• chmod u+rw,g+rw,u-x,g-x,o-rwx f1


  Allow read/write to owner & group, everyone else will have no access
• chmod 660 f1


  Same as above but makes you look "pro"
• chmod a+x f1


  Make file executable to everyone
• chmod og-rwx f1

  Disable all group/world access from file
• ROOT USER (SUPERUSER) is exempt from usual access control restrictions, has system-wide access, necessary but dangerous - easy to brick the system, needs good practices, e.g. Ubuntu does not let you login as root by default
• sudo su


  Command to switch to root user
• LINUX SETUID, SETGID AND STICKY BITS

  • Setuid bit - only used on executable files, runs with the privileges of the file's owner, enables regular users to access files/resources not generally accessible, e.g. /usr/bin/passwd
  • Setgid bit - if on executable files similar effect to setuid but for groups, if on directories new files/subdirectories will automatically inherit the group owner
  • Sticky bit - only used on directories, only the owner of a file or the directory can rename or delete files, usually set on /tmp and /scratch or similar directories