Semester 6 - Secure Computing Midterm

• confidentiality
• integrity
• availability

information about system or its users cannot be learned by an attacker

• when you ask for data, you get the "right " data
• system reaching states that would occur if there was no attacker

actions by an attacker do not prevent users from having access to use of the system

• honest user
• dishonest attacker
• how the attacks disrupts and learns info

intercepts and controls network communication

• Hacks websites
• sets up malicious sites
• no control of network

controls malicious files and applications

the ability of a system to consistently perform its intended function on demand without failure

is the property that ensures that the actions of an entity can be traced

• the ability to prove that an event has taken place
• a system must be able to prove that certain messages were sent and recieved

the process of determining whether someone or something is who or what it is declared to be

• informational self-determination
• you get to control information about you

• Personal Information Protection and Electronic Documents Act
• Canada's private-sector privacy legislation

• things we want to protect
• hardware
• software
• data

• bugs
• defects
• weaknesses

a potential cause of an incident, that may result in harm of systems

• intentional - individual cracker
• accidental - application bug

• Interception
• Interruption
• Modification
• Fabrication

standards or lack of standards, application exploits

• unsecured accounts
• no anti-virus

• lack of a written security policy
• software and hardware changes do not follow policy

• accident
• ignorance

• a view of the application and its environment through security glasses
• "whom do we want to stop from doing what?"

tool that an attacker uses vulnerability to cause damage to the target system.

where the threat and vulnerability overlap

an action which exploits a vulnerability

• black - bad intentions without invitation
• white - good intentions with invitation
• grey - good intention without invitation

removing a vulnerability

• Prevent it
• Deter it
• Deflect it
• Detect it
• Recover from it

• Dynamic HTML
• DOM
• Scripting
• Presentation
• Markup

• Extensible Stylesheet Language
• styles XML
• XSLT
• XPath
• XSL-FO

newline

space

• retrieves resources
• can be used to send parameter in the URL query string

• perform actions
• parameters can be sent in the query string of the URL or message body

• used to check whether a resource is present before making a GET request
• shouldn't contain anything in the message body

• Multi-purpose Internet Mail Extension
• a set of rules that allow multimedia documents to be exchanged among different computer systems.