" "

Physical and Environmental Security

  • System architecture is a formal tool used to design computer systems in a manner that ensures each of the stakeholders’ concerns is addressed.

  • A system’s architecture is made up of different views, which are representations of system components and their relationships. Each view addresses a different aspect of the system (functionality, performance, interoperability, security).

  • ISO/IEC 42010:2007 is an international standard that outlines how system architecture frameworks and their description languages are to be used.

  • A CPU contains a control unit, which controls the timing of the execution of instructions and data, and an ALU, which performs mathematical functions and logical operations.

  • Memory managers use various memory protection mechanisms, as in base (beginning) and limit (ending) addressing, address space layout randomization, and data execution prevention.

  • Operating systems use absolute (hardware addresses), logical (indexed addresses), and relative address (indexed addresses, including offsets) memory schemes.

  • Buffer overflow vulnerabilities are best addressed by implementing bounds checking.

  • A garbage collector is a software tool that releases unused memory segments to help prevent “memory starvation.”

  • Different processor families work within different microarchitectures to execute specific instruction sets.

  • Early operating systems were considered “monolithic” because all of the code worked within one layer and ran in kernel mode, and components communicated in an ad hoc manner.

  • Operating systems can work within the following architectures: monolithic kernel, microkernel, or hybrid kernel.

  • Mode transition is when a CPU has to switch from executing one process’s instructions running in user mode to another process’s instructions running in kernel mode.

  • CPUs provide a ringed architecture, which operating systems run within. The more trusted processes run in the lower-numbered rings and have access to all or most of the system resources. Nontrusted processes run in higher- numbered rings and have access to a smaller amount of resources.
  • Operating system processes are executed in privileged or supervisor mode, and applications are executed in user mode, also known as “problem state.”

  • Virtual storage combines RAM and secondary storage so the system seems to have a larger bank of memory.

  • The more complex a security mechanism is, the less amount of assurance it can usually provide.

  • The trusted computing base (TCB) is a collection of system components that enforce the security policy directly and protect the system. These components are within the security perimeter.

  • Components that make up the TCB are hardware, software, and firmware that provide some type of security protection.

  • A security perimeter is an imaginary boundary that has trusted components within it (those that make up the TCB) and untrusted components outside it.

  • The reference monitor concept is an abstract machine that ensures all subjects have the necessary access rights before accessing objects. Therefore, it mediates all access to objects by subjects.

  • The security kernel is the mechanism that actually enforces the rules of the reference monitor concept.

  • The security kernel must isolate processes carrying out the reference monitor concept, must be tamperproof, must be invoked for each access attempt, and must be small enough to be properly tested.

  • Processes need to be isolated, which can be done through segmented memory addressing, encapsulation of objects, time multiplexing of shared resources, naming distinctions, and virtual mapping.

  • The level of security a system provides depends upon how well it enforces its security policy.

  • A multilevel security system processes data at different classifications (security levels), and users with different clearances (security levels) can use the system.

  • Data hiding occurs when processes work at different layers and have layers of access control between them. Processes need to know how to communicate only with each other’s interfaces.

  • A security model maps the abstract goals of a security policy to computer system terms and concepts. It gives the security policy structure and provides a framework for the system.

  • A closed system is often proprietary to the manufacturer or vendor, whereas the open system allows for more interoperability.

  • The Bell-LaPadula model deals only with confidentiality, while the Biba and Clark-Wilson models deal only with integrity.

  • A state machine model deals with the different states a system can enter. If
    a system starts in a secure state, all state transitions take place securely, the system shuts down and fails securely, and the system will never end up in an insecure state.

  • A lattice model provides an upper bound and a lower bound of authorized access for subjects.

  • An information flow security model does not permit data to flow to an object in an insecure manner.

  • The Bell-LaPadula model has a simple security rule, which means a subject cannot read data from a higher level (no read up). The *-property rule means a subject cannot write to an object at a lower level (no write down). The strong star property rule dictates that a subject can read and write to objects at its own security level.

  • The Biba model does not let subjects write to objects at a higher integrity level (no write up), and it does not let subjects read data at a lower integrity level (no read down). This is done to protect the integrity of the data.

  • The Bell-LaPadula model is used mainly in military and government-oriented systems. The Biba and Clark-Wilson models are used in the commercial sector.

  • The Clark-Wilson model dictates that subjects can only access objects through applications. This model also illustrates how to provide functionality for separation of duties and requires auditing tasks within software.

  • If a system is working in a dedicated security mode, it only deals with one level of data classification, and all users must have this level of clearance to be able to use the system.

  • Trust means that a system uses all of its protection mechanisms properly
    to process sensitive data for many types of users. Assurance is the level of confidence you have in this trust and that the protection mechanisms behave properly in all circumstances predictably.

  • The Orange Book, also called Trusted Computer System Evaluation Criteria (TCSEC), was developed to evaluate systems built to be used mainly by the government. Its use was expanded to evaluate other types of products.

  • The Orange Book deals mainly with stand-alone systems, so a range of books were written to cover many other topics in security. These books are called the Rainbow Series.

  • ITSEC evaluates the assurance and functionality of a system’s protection mechanisms separately, whereas TCSEC combines the two into one rating.

  • The Common Criteria was developed to provide globally recognized evaluation criteria and is in use today. It combines sections of TCSEC, ITSEC, CTCPEC, and the Federal Criteria. 

  • The Common Criteria uses protection profiles, security targets, and ratings (EAL1 to EAL7) to provide assurance ratings for targets of evaluations (TOE).

  • Certification is the technical evaluation of a system or product and its security components. Accreditation is management’s formal approval and acceptance of the security provided by a system.

  • ISO/IEC15408 is the international standard that is used as the basis for the evaluation of security properties of products under the CC framework.

  • A covert channel is an unintended communication path that transfers data in a way that violates the security policy. There are two types: timing and storage covert channels.

  • A covert timing channel enables a process to relay information to another process by modulating its use of system resources.

  • A covert storage channel enables a process to write data to a storage medium so another process can read it.

  • A maintenance hook is developed to let a programmer into the application quickly for maintenance. This should be removed before the application goes into production, or it can cause a serious security risk.

  • Process isolation ensures that multiple processes can run concurrently and the processes will not interfere with each other or affect each other’s memory segments.

  • TOC/TOU stands for time-of-check/time-of-use. This is a class of asynchronous attacks.

  • The Biba model addresses the first goal of integrity, which is to prevent unauthorized users from making modifications.

  • The Clark-Wilson model addresses all three integrity goals: prevent unauthorized users from making modifications, prevent authorized users from making improper modifications, and maintain internal and external consistency 


We hope that Mister Exam has been useful for your exam preparation. If you would like to leave us a note, please write to us here.