Module 24 - Security

difference between security and protection

security is a policy, protection is a mechanism

economy of mechanism

try to keep it simple and small

fail safe default

default to lack of access

complete mediation

security is as strong as the weakest link

open design

don’t rely on “security through obscurity”

separation of priviledges

provide mechanisms that separate the privileges used for one purpose form those used for another

least privilege

give bare minimum access rights required to complete a task

psychological acceptability

mechanism must be simple to use

physical security

involves preventing threats that require access to the equipment itself

educate the humans

computer security easily subverted by bad human practices

authentication

required to assure tags are validpas

passwords

a fundamental authentication mechanism

trojan horse

code segment that misuses its environment

trap door/back door

specific user identifier or password that circumvents normal security procedures

logic bomb

program that initiates a security incident under certain circumstances

stack and buffer overflow

exploits a bug in a program

types rootkits

applicatyion, library, kernel, hypervisor, firmware

internet worm

self replicating program that exploits errors

steganography

storing information in photographs