CISSP: Security Architecture and Design

Computer Architecture:
Certification
Accreditation
Assurance
Protection Mechanisms
Trusted Computer Base
Security Modes (MAC)

Reference Monitor: Kernel mediates all access between subjects and objects
Layering: Modular tiers
Abstraction: Hidden details from the user
Domain:
Security Domain: Group of subjects and objects with similar security requirements

Covert Channel: Any communication that violates security policy.
Covert Storage Channel
Covert Timing channel
Race COnditions (TOCTOU)


Models:
MATRIX:
Take Grant: Direct graphs. State transitions.
Bell-LaPadula: Confidentiality. First Mathematical model.
BIBA: Integrity. Lattice based.
Clark Wilson: Integrity. Access to object throught programs.
Information Flow Model:
Brewer and Nash: Chinese Wall model.


Evaluation Criteria
TCSEC (Orange Book): Trusted Computer System Evaluation Criteria

TCSEC Requirements:
D: Minimal protection
C: Discretionary Protection
C1: Discretionary Security Protection
C2: Controlled Access Protection
B: Mandatory Protection
B1: Labeled Security Protection
B2: Structured protection
B3: Security Domains
A: Verified Protection
A1: Verified Design



ITSEC: Information Technology Security Evaluation Criteria

Common Criteria (ISO 15408):

EAL1: Functionally Tested
EAL2: Structurally tested
EAL3: Methodically tested
EAL4: Methodically designed, tested and reviewed
EAL5: Semi-formally designed and tested
EAL6: Semi-formally verified, designed and tested
EAL7: Formally verified, designed and tested

ST: Security Target
TOE: Target Of Evaluation
PP: Protection Profile

CISSP: Telecommunications and Network Security

Circuit-switched: Dedicated
Packet-switched:
Layered design
Private IP range:

OSI Model

Application Layer
Presentation Layer
Session Layer: (SOCKS)
Transport Layer
Network Layer: Packets
Data Link layer: Frames
Physical Layer: Electrical signals

TCP/IP Model
Application: data
Transport: segment
Internet: Packet
Network Access:

Encapsulation vs demultiplexing(de-encapsulation)
48bits MAC address vs EUI64 MAC address
IPv4 (32 bits address)
IPv6 (128 bits address)

ATM: Uses fixed length cells
HDLC vs SDLC
Frame Relay: No error recovery


Firewalls:
Packet filter:
Stateful
Proxy
Application-layer
Circuit-level

Firewall Design:
Bastion Host
Dual Homed host
Screened host
DMZ Network:
Classic DMZ: screened subnet dual firewall. Two firewalls
Three-legged DMZ: One firewall

Network Attacks:

TCP SYN Flood
LAND Attack
Smurf Attack
Fragle Attack
Teardrop Attack

Secure Communications:

Authentication Protocols:
PAP / CHAP:
801.1X / EAP

VPN:
PPTP / L2TP
IPSec
SSL / TLS

Wireless
WPA2: Robust Security Network
WPA2: AES + CCMP
WPA: RC4 + TKIP

CISSP: Access Control

Flow of information between subject (active entity) and object (passive entity)
Subjects: Clearance, capability
Object: Clasiffication, ACL

Principles:
Least privilege:
Separation of duties:


Identification:
Authentication
Authorization:
Accountability:

Controls types:
Administrative
Technical (logical)
Physical

Controls categories:
Directive:
Preventive:
Detective:
Corrective:
Recovery:
Deterrent:

Types:

Mandatory Access Control (MAC): Use labels
Discretionary Access Control (DAC)
Non-discretionary Access Control

Type I: Something you Know
Type II: Something you Have
Type III: Something you Are

Biometric:
Retina: Change over time, Invasion privacy
Iris: Remains (comparatively), not invasive
Minutiae:
Type I Error: FRR (False Reject Rate)
Type II Error: FAR (False Acceptance Rate)
CER (Crossover Error Rate) or Equal Error rate

Single Sign On (SSO)
Pro:
Cons:

Kerberos:
Symetric crypto
KDC
AS
TGT
TGS

SESAME:

KRYPTONIGHT

Directory Services:

Access Control Methodologies:

Centralized:
RADIUS:
DIAMETER:
CALLBACK:
CHAP
TACACS+

Smart Cards:
Contact
Contactless
Combi card

Identity Management:
Directory based
Web access management
Password management
Account management

Provisioning
Profile update

Threats:
Computing: DDOS, Unauthorized software, Software defects
Physical: Unauthorized access, electronic emanations
Personal: Social engineering

CISSP: Information Security Governance and Risk Management

Information Security Governance

(human) safety is always the priority

Confidentiality: Keeping secrets secret. Protect from unauthorized access.
Integrity: Complete, consistent and accurate. Integrity protection (Disallowing unauthorized alteration). Integrity Verification (Verifying accurate, complete and consistent)

• Data Integrity: Protect information (data)
• System Integrity: Protect a system

Availability: Access to information when is needed
CIA vs DAD (Disclosure, Alteration, Destruction)
Balance CIA with organization security needs.

Information classification:
Criteria: Bussiness value, retention policy
Level: depends (goverment, private sector)

Security awareness: Change user behavior
Security training: Provide skill

Policies: High-level. Mandatory (compulsory)
Procedures: Step-by-step
Standars: Specific use of technology
Guidelines: Recommendations
Baselines:

Security Planning:
Operational Goals: Daily goals and objectives.
Tactical Goals: Mid-term goals
Strategic Goals: Long term goals

Roles and Responsibilities:
Senior management: Responsible
Information Security Officer:
Security Analyst
Owner:
Custodian:
User:
Auditor:

Due Care:
Due diligence:
"Prudent man rule"

Certification: Detailed inspection
Accreditation: Data owner acceptance

Risk Management:
Assets: Valuable resources. People are the most valuable asset.
Threat agent:
Threat: Potentially harmfull ocurrence
Vulnerability: A weakness that allows a threat to cause harm
Impact (Consequences): Severity of the damage (in $).
Risk: Threat x Vulnerability
Control (countermeasure):

Qualitative Analysis: Values

Quantitative Analysis: Expert Opinion (subjective)

AV: Asset Value

EF: Exposure Factor

SLE: Single Loss Expectancy (AV x EF)
ARO: Annual Rate of Occurrence
ALE: Annualized Loss Expectancy (SLE x ARO)
ROI: Amount of money saved by implementing a safeguard

Risk Choices:
Accept
Mitigate
Transfer
Avoid