Computer and Operating System Security Review

Comprehensive practice flashcards covering Week 4, Week 5, and Week 7 lecture modules on computer system hardening, authentication, access control models, security threats, and OS vulnerability management.

According to Verizon (2023), what percentage of breaches result from poor patching, and what was the impact of unpatched software in the 2017 Equifax breach?

Over $60\%$ of breaches result from poor patching. In the 2017 Equifax breach, failure to patch Apache Struts exposed 147 million records and cost over $\$1.4\text{ billion}$.

What is system hardening, and what are common tools used to establish hardening baselines?

System hardening reduces attack surfaces by proactively eliminating unnecessary vulnerabilities (e.g., disabling unused services, enforcing least privilege accounts). Common tools include CIS Benchmarks, Microsoft Baselines, Nessus, and OpenVAS.

According to Microsoft (2021), how effective is Multi-Factor Authentication (MFA) at blocking automated cyberattacks?

MFA alone blocks $99.9\%$ of automated attacks.

What tools and legal frameworks are identified for securing data stored locally on endpoint devices?

Tools include encryption software like BitLocker, FileVault, and VeraCrypt alongside auto-lock and secure wiping. Regulations enforcing local protection include GDPR (EU, 2018), HIPAA (US, 1996), and Oman’s Data Protection Law (2022).

What primary mechanisms and protocols are used to secure data in transit across networks?

HTTPS/TLS (encrypts web browser-server communications), VPNs (creates an encrypted tunnel), SSH (provides secure remote login), and End-to-End Encryption (ensures only sender and receiver can decrypt, e.g., WhatsApp).

In backup and recovery planning, what is the $3\text{-}2\text{-}1$ rule, and how do RPO and RTO differ?

The $3\text{-}2\text{-}1$ rule requires maintaining 3 copies of data on 2 different media types, with 1 copy stored offsite. RPO (Recovery Point Objective) defines tolerable data loss, whereas RTO (Recovery Time Objective) defines tolerable downtime.

What vulnerability did the 2017 WannaCry ransomware exploit, and what was the scale of its impact?

WannaCry exploited an unpatched Windows SMB flaw, infecting over $200{,}000$ systems across more than 150 countries and causing massive disruptions to the UK NHS.

What are the three core authentication factors utilized in Multi-Factor Authentication (MFA)?

Something you know (e.g., password, PIN), something you have (e.g., phone, hardware token), and something you are (e.g., fingerprint, facial recognition).

What four authentication systems are used in Windows environments to verify identities?

Local accounts (credentials stored on the machine), Domain accounts (centralized organizational verification), Windows Hello (biometric authentication), and Kerberos (secure network authentication protocol).

In access control architecture, what are subjects, objects, operations, and permissions?

Subjects are entities requesting access (users, processes, systems); objects are resources being protected (files, databases, printers); operations are attempted actions (read, write, execute, delete); and permissions are rules defining which operations subjects can perform on objects.

What is Discretionary Access Control (DAC), and how is it technically implemented in Windows and cloud environments?

DAC is an access model where resource owners decide who can access their resources via Access Control Lists (ACLs). It is implemented in Windows through NTFS and share permissions, and in the cloud through shared folder permissions and link sharing.

What is the Trojan Horse Vulnerability inherent to Discretionary Access Control (DAC)?

Malicious software executed by a user automatically inherits that user's full access permissions, allowing the malware to modify, overshare, or delete any files the user owns.

How does Mandatory Access Control (MAC) enforce security, and what labels does it rely upon?

A central authority defines security policies that the system enforces automatically without user override. It uses security labels comprising Subject Clearance (e.g., Secret, Top Secret), Object Classification (e.g., Confidential, Restricted), and Categories (e.g., NATO, Nuclear, Crypto).

What are the two foundational access rules governing Mandatory Access Control (MAC)?

The Simple Security Property ('no read up', preventing access to higher classification data) and the Star Property ('no write down', preventing data from being written or sent to a lower classification level).

What are the four core components of Role-Based Access Control (RBAC)?

Users (people or system accounts), Roles (job functions such as Manager or Developer), Permissions (resource access rights), and Sessions (the activation of selected roles by a user).

What are two prominent operational weaknesses of Role-Based Access Control (RBAC)?

Role explosion (creating too many specialized roles) and permission creep (users accumulating unnecessary access privileges over time as roles change).

How does Separation of Duties function as an access control best practice?

It divides critical tasks among mutually exclusive roles so that no single person can execute an entire sensitive operation alone (e.g., Requester $\neq$ Approver $\neq$ Payer).

What constitutes the core distinction between internal and external cyber threats?

Internal threats originate from authorized users (employees, contractors) who hold valid credentials and internal knowledge; external threats originate outside the organizational boundary where attackers exploit perimeter or software flaws to breach systems.

In the analysis of intentional cyber threats, what does the MICE motivation model stand for?

Money, Ideology, Coercion, and Ego.

What defines an unintentional threat, and what controls are implemented to reduce its risk?

Unintentional threats stem from human error, lack of awareness, or carelessness without malicious intent (e.g., clicking phishing links, server misconfigurations). They are controlled through awareness training, automated backups (design), and password policies.

What is the primary difference between active attacks and passive attacks?

Active attacks interact with systems to alter, disrupt, or damage data or services (compromising integrity and availability); passive attacks observe or intercept data traffic without modifying system behavior (compromising confidentiality).

What are four standard examples of active attacks and their system effects?

DoS (flooding a web server causing service disruption), MITM (altering network traffic causing data modification), SQL Injection (manipulating database queries leading to data exposure), and Spoofing (faking identity to gain unauthorized access).

What are four common examples of passive attacks, and what primary defense mitigates them?

Packet sniffing, eavesdropping on unencrypted Wi-Fi, shoulder surfing, and traffic analysis. The primary technical defense against passive attacks is encryption (e.g., TLS, VPNs).

How are security incidents classified under an integrated multidimensional threat model?

Incidents are classified across three dimensions: Origin (Internal vs. External), Intent (Intentional vs. Unintentional), and Nature (Active vs. Passive).

Why is the Operating System (OS) described as the foundation of computing security?

The OS directly manages hardware, software, and user interactions; if OS security is compromised, all applications, data, and access controls running on top of it fail completely.

What is the global average financial cost of a data breach, and what proportion of incidents exploit known OS vulnerabilities?

The average data breach costs over $\$4\text{ million}$ globally, and $90\%$ of security incidents exploit known OS vulnerabilities.

What specific OS mechanisms correspond to each pillar of the CIA Triad?

Confidentiality uses encryption, ACLs, and authentication; Integrity uses checksums, cryptographic hashing, and digital signatures; Availability uses data backups, hardware redundancy, and DDoS mitigation.

How do authenticity, accountability, and non-repudiation extend security beyond the CIA Triad?

Authenticity proves entities or data are genuine; accountability tracks who performed which action and when (e.g., audit logging); non-repudiation prevents an actor from denying an action occurred (e.g., digital signatures).

What are the three classes within the Vulnerability Classification System?

Configuration-Based Vulnerabilities (setup mistakes like default credentials or open services), Software-Based Vulnerabilities (flaws in code like buffer overflows or race conditions), and Design-Based Vulnerabilities (fundamental architectural flaws like insecure default configurations).

What are the five phases of the Vulnerability Lifecycle in order?

1. Discovery, 2. Disclosure & Patch Development, 3. Exploit Development, 4. Attack Deployment, and 5. Resolution.