basic security flashcards

threat

circumstance/event that can adversely affect an organisation

threat model

collection of threats deemed important for a certain environment

asset

valued resource

risk

extent to which an asset is threatened

adversary/threat agent/attacker

entity trying to circumvent security infrastructure

vulnerability

system artefact that exposes the system to a threat

outcomes of vulnerabilities

system becomes corrupted, leaky, or unavailable

types of vulnerability (basic)

technological, security policy, configuration

countermeasure

security control to reduce likelihood of a threat, or consequences of a realised one

security policy

set of criteria to provide security services

participants

expected system entities

trust

degree to which an entity is expected to behave

trust model

model of who is trusted to do what for a particular environment

trust boundary

point in a system where the level of trust changes

attack

process to realise a threat

passive vs active attack

passive - learn/make use of info without affecting system resources
active - alter system resources/affect operation

attack surface

set of reachable/exploitable vulnerabilities of a system

attack/threat vector

the specific means by which an attack is enacted

types of threat consequence (basic)

unauthorised disclosure, deception, disruption, usurpation

how does differential privacy work

adds statistical noise to the output. for a function f we output f(x) + Y

Advanced Persistent Threat

attack that infiltrates a system and is long-term and cautious

Confidentiality

data conf - private info not disclosed to unauthorised parties
privacy - people control the info collected about them and who it’s disclosed to

Integrity

data - info only changed in an authorised fashion
system - system does its intended purpose without unauthorised manipulation

Availability

service responds reliably and not denied to authorised individuals

Non-Repudiation

assurance that an individual can’t deny a previous commitment

why is non-repudiation sometimes considered separately from integrity?

mechanisms to ensure it are different from those for data integrity

Authenticity

that a message is genuine and can be validated/trusted

Accountability

makes sure actions can be uniquely traced to the actor