Scribd
Upload
4 views

A

AI

Uploaded by

yoniman1352
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
4 views

A

AI

Uploaded by

yoniman1352
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 4

1.

Countermeasures

 Definition: Strategies or technologies designed to mitigate or eliminate security threats.


 Examples:
o Preventive Measures: Firewalls, antivirus software, secure coding practices.
o Detective Measures: Intrusion Detection Systems (IDS), monitoring logs.
o Responsive Measures: Incident response plans, patches, and updates.
 Approaches:
o Proactive: Identifying vulnerabilities before exploitation (penetration testing).
o Reactive: Responding after detecting a security event (incident response).

2. Security Services

 Definition: High-level objectives to secure systems as per ISO/OSI standards.


 Primary Services:
1. Authentication: Verifies user identity.
2. Confidentiality: Protects data from unauthorized access.
3. Integrity: Ensures data remains unchanged.
4. Nonrepudiation: Prevents denial of actions.
5. Access Control: Regulates user permissions.
6. Availability: Guarantees system uptime.

3. Authentication

 Purpose: Ensures that users or systems are who they claim to be.
 Methods:
o Something You Know: Passwords, PINs.
o Something You Have: Tokens, smart cards.
o Something You Are: Biometrics (fingerprint, retina scans).
 Protocols:
o Kerberos: Ticket-based authentication.
o OAuth: Delegated authorization framework.
4. Data Confidentiality

 Purpose: Ensures information is not accessible by unauthorized parties.


 Implementation:
o Encryption:
 Symmetric (e.g., AES): Same key for encryption and decryption.
 Asymmetric (e.g., RSA): Public-private key pairs.
o Secure Channels: SSL/TLS for secure communication.
o Access Controls: Ensuring data is visible only to authorized users.

5. Access Control

 Purpose: Restricts access to systems or resources.


 Models:
o Role-Based Access Control (RBAC): Access based on roles.
o Discretionary Access Control (DAC): Owner grants permissions.
o Mandatory Access Control (MAC): Central authority defines rules.
 Techniques:
o Multi-factor Authentication (MFA).
o Attribute-Based Access Control (ABAC).

6. Data Integrity

 Purpose: Ensures that data remains unaltered and accurate.


 Techniques:
o Hashing: Creates a unique digest (e.g., SHA-256, MD5).
o Checksums: Verifies data using algorithms like CRC.
o Digital Signatures: Ensures data authenticity and integrity.
7. Nonrepudiation

 Purpose: Prevents denial of performed actions or communications.


 Techniques:
o Digital Signatures: Tied to a specific user via cryptographic keys.
o Audit Trails: Detailed logs of activities for accountability.
 Applications:
o Online transactions.
o Email integrity using protocols like S/MIME.

8. Availability Service

 Purpose: Ensures systems and data are available when needed.


 Challenges: Denial of Service (DoS) attacks, hardware failures.
 Solutions:
o Redundancy: Using backup systems or data replication.
o Load Balancing: Distributing traffic to multiple servers.
o Disaster Recovery: Plans for catastrophic failure.

9. Security Mechanisms (X.800)

 Definition: Techniques to enforce security services as per X.800 standards.


 Examples:
o Encapsulation: Using VPNs for secure communication.
o Cryptography: Ensuring confidentiality, integrity, and authenticity.
o Security Protocols: HTTPS, IPSec.

10. Relationship Between Security Services and Mechanisms

 Services: Define goals (e.g., data confidentiality).


 Mechanisms: Provide tools to achieve those goals (e.g., encryption).
 Example:
o Service: Data Integrity.
o Mechanism: Hashing algorithms to detect unauthorized changes.
11. Techniques

 Definition: Methods used to implement security.


 Categories:
o Cryptographic Techniques:
 Encryption (Symmetric and Asymmetric).
 Hashing (MD5, SHA-256).
o Network Techniques:
 Firewalls: Filters network traffic.
 Intrusion Prevention Systems (IPS): Blocks malicious activities.
o Software Techniques:
 Secure Coding: Avoiding vulnerabilities like SQL injection.
 Patching: Updating software to fix vulnerabilities.

12. Steganography

 Definition: Hiding data within non-obvious carriers like images, audio, or video.
 Techniques:
o Least Significant Bit (LSB) Method: Embedding data in the least significant bits
of an image’s pixels.
o Frequency Domain Techniques: Embedding data in imperceptible areas of
sound or images.
 Applications:
o Covert communication.
o Watermarking for digital copyright protection.

You might also like