Computer Security EXAM2

DACL (Discretionary ACL)

grants/denies access to resources in Windows such as files, shared memory, etc.

ACE (access control entries) for Windows

a single rule inside an ACL that identifies the user/groups and granted/denied permissions

Local account

an account that works on a single host machine

Domain account

an account that works on across machines on a network

WinLogon

• manages local logons

• passes creds to LSA and checks them against local SAM

Netlogon

• manages logons across a network/domain

• LSA passes credentials to network protocols

LSA

component responsible for enforcing local security policies in Windows

SAM (security account manager)

a database that stores user accounts and relevent security information about local users & groups

IaaS

provides and manages foundational cloud components including servers, storage, networking, etc. (ex. Amazon EC2)

PaaS

provides ready-to-use cloud environments containing development and testing tools (ex. Salesforce)

SaaS

provides clients with software that runs and is accessible in the cloud (ex. Microsoft Office 365 products)

CASB (Cloud Security Access Broker)

software that provides security controls related to visibility, access control, security intelligence, and data protection for cloud-based resources and user

API mode (CASB)

• Connects directly to cloud apps via API key

• Does not inspect traffic in transit

Proxy mode (CASB)

• traffic is redirected to proxy before reaching cloud app

• data is inspected at the proxy

forward proxy

used by client to act as an intermediary between client and server/external

reverse proxy

used by server to act as an intermediary between client/external and server

hypervisor

a software that sits between hardware and VMs to manage them

fog computing

decentralized data processing architecture to connect IoT devices to the cloud

cloud computing

centralized data processing/services that are done on remote data servers

race condition

when a software executes multiple tasks at the same time but the result depends on which of these tasks finishes first

SACL (System ACL)

used for auditing Windows, allowing administrators to log attempts to access resources

Active Directory

manages users across an entire domain/network along with devices and GPOs

access mask

defines the exact permissions (read, write, modify, etc) inside an ACE (rule within ACL)

Explain the difference between SAM and AD

• SAM manages LOCAL USERS on a single host

• AD manages users across an entire domain

buffer overrun

when a program allows inputs to write beyond the end of the program’s allocated memory buffer (intentionally or not)

Review 19 deadly sins

SAML

used for SSO and Cloud app identity provider; user logs in once and has access without re-entering creds

Encryption (CASB data protection)

• encrypts data in cloud storage

• encrypts data in transit and decrypts it when being received

Tokenization (CASB data protection)

replaces sensitive data fields with random data, such that no real value (SPII) is stolen in breach

native virtualization

Runs directly on the physical hardware of the host without any underlying operating system

hosted virtualization

Runs as a software application on top of an existing, conventional operating system

container

self-contained software package that bundles an application with all its code, dependencies, and libraries included

DAC (discretionary access control)

controls access based on the identity of the requester and rules defining what they can and can’t access

MAC (mandatory access control)

grants access based on comparing resource security labels with user security clearance

RBAC (role-based access control)

controls access based on the roles of the user in a system (those roles have defined access rules)

ABAC (attribute-based access control)

control access based on the attributes of the user, resource being accessed, and environmental conditions (subject attr, object attr, environment attr)

OS hardening steps

• Install patches

• remove unnecessary apps and services

• configure users, groups, and perms

• configuring security controls

• enforcing system baselines

Look at access control matrices

Look at access control matrices