Chapter 1

Definitions
Vulnerability - weakness in system/algorithm/protocol, etc., which can allow harm to
occur
Threat - condition that can exercise a vulnerability
Incident - a threat exploits a vulnerability, causing harm
Harm - negative consequence of an actualized threat
Control/Countermeasure - prevent, diagnose, respond to threats

Computer security
Protection of assets

hardware
software
data
people
processes, etc.

Asset value

1. Off-the-shelf (replaceable)
2. Unique (irreplaceable)

A threat is blocked by control of a vulnerability.

C-I-A triad / Security triad

Confidentiality: the ability of a system to ensure that an asset is viewed only by
authorized parties
Integrity: the ability of a system to ensure that an asset is modified only by authorized
parties
Availability: the ability of a system to ensure that an asset can be used by any
authorized parties

ISO 7498-2 extends this with

Authentication: the ability of a system to confirm the identity of a sender
Accountability/Nonrepudiation: the ability of a system to confirm that a sender cannot
convincingly deny having sent something

U.S. Department of Defense adds

 auditability: the ability of a system to trace all actions related to a given asset

Important aspects of access control - Policy component

1. Subject - who
2. Object - what
3. Access mode - how

Integrity
Preserved integrity can mean the item is:

precise
accurate
unmodified
modified only in acceptable ways
modified only by authorized people/processes
consistent
internally consistent
meaningful and usable

Availability
Object/Service is available if:

It is present in a usable form.

It has enough capacity to meet the service’s needs.
It is making clear progress, and, if in wait mode, it has a bounded waiting time.
The service is completed in an acceptable period of time.

Criteria to define availability:

There is a timely response to our request.
Resources are allocated fairly so that some requesters are not favored over others.
Concurrency is controlled; that is, simultaneous access, deadlock management, and
exclusive access are supported as required.
The service or system involved follows a philosophy of fault tolerance, whereby
hardware or software faults lead to graceful cessation of service or to work- arounds
rather than to crashes and abrupt loss of information. (Cessation does mean end;
whether it is graceful or not, ultimately the system is unavailable. However, with fair
warning of the system’s stopping, the user may be able to move to another system and
continue work.)
The service or system can be used easily and in the way it was intended to be used.
(This is a characteristic of usability, but an unusable system may also cause an
availability failure.)
Threats
Threat types
nonhuman vs human
benign (nonmalicious) vs malicious
random vs directed
advanced persistent threat - directed, well-organized attacks (possibly in groups)

Characterization

1. Impact - potential harm - amount of damage a threat can cause

2. Likelihood - Probability of occurence - determined largely by feasability

Harm
Characterization of harm

1. Interception - confidentiality suffers

2. Interruption - availability fails
3. Modification - integrity compromised
4. Fabrication - integrity compromised

Risk management

choosing the threats which are to be mitigated

weighing the seriousness of threat
weigh our ability to protect against the threat
deciding what resources to devote to protection

Residual risk - risk that remains uncontrolled

Problems

Value of asset hard to determine

threats must be evaluated over time, not just at a single instance
a breach could also have minimal long-term economic impact (e.g. at a firm)

Method-Opportunity-Motive
All 3 are necessary for an attack to succeed

Method
Skills, knowledge, tools, and other things with which to perpetrate the attack.

Script kiddie - Person who downloads an complete attack code package and only needs to
enter a few details to identify the target and let the script perform the attack

Opportunity
When to execute an attack

Motive
money, fame, self-esteem, politics, terror, etc.

Vulnerability
attack surface - the full set of vulnerabilities of a system

Controls
Dealing with harm:

Prevent - block the attack or close the vulnerability

Deter - make the attack harder but not impossible
Deflect - make another target more attractive (or this one less so)
Mitigate - reduce the severity of the impact
Detect - as it happens or afterwards
Recover - with help of incident-response procedures

Grouping controls
1. Physical - locks, walls, fences, guards, sprinklers, etc.
2. Procedural/Administrative - laws, procedures, guidelines, copyrights, contracts, etc.
3. Technical - passwords, OS access controls, network protocols, encryption, etc.