#securitydictionary

similarity matching - when people look for similar situations that happened to them in the past that they are familiar with and applying it to the current situation.

Frequency gambling - If many patterns match, you pick the one which you have the most experience with

Satisficing - only doing good enough, rather than doing perfect

Bounded rationality - how we have a limited amount of information, meaning our ability to make decisions is bounded by that information

Group-think syndrome - How people think when they’re in groups rather than as individuals. We prefer to keep the peace in a group rather than fight against collective ideas. The result is groups become homogeneous

Confirmation bias - We prefer the evidence that confirms what we believe. Is an example of cognitive bias and describes that people gather and recall information selectively/interpret in a selective manner

Just Culture - Don’t just punish the person who made an error, or the last person who touched it. It’s about learning and stopping these situations in the future

Cassandra Syndrome - knowing the truth but no-one believes you. Occurs when valid warnings or concerns are dismissed.

Chekhov’s Gun - anything on-screen in a movie is there for a purpose. A gun is on a wall because it will be used. A person coughs because they have Everything Disease, etc

Reflection

Krak Des Chevaliers - Crusades era castle held by the Knights Templar, had an outer ring and inner ring. Eventually fell when the Ottomans or whoever forged a letter from the head of the Templars telling them to surrender, and never fell due to weak defence. Also an example of defence in depth

Vulnerabilities - a potential weakness in something

Software Bug - sometimes a vulnerability

Exploits - attacks a vulnerability to compromise a system

Memory Corruption Attacks - the attacker changes what is in memory so that the program behaves differently, the most common type is a buffer overflow:

Buffer overflow - Attack on the stack, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.

NOP sled - a technique used to circumvent stack randomisation in buffer overflow attacks. As stack randomisation and other runtime differences change where the program will jump, the attacker places a NOP sled in a big range of memory. This will slide the code execution down into the payload code, right next to the sled. No-operation is available in most architectures and it does nothing other than occupying memory and runtime.

Canary - buffer overflow protection modifies the organization of data in the stackframe of a function call to include a "canary" value that, when destroyed, shows that a buffer preceding it in memory has been overflowed. With the canary it is not going to prevent a malicious buffer overflow. You can find where the canary is in the stack and just fill an array with the canary so that it does not get triggered and alert the computer that a buffer overflow has happened.

Reflection

I had one missed Security Dictionary in week 3 so I am posting my notes from my onedrive now.

Is/ought = fact / should be that way. Ought is often a moral/ethical question

Centralisation – Systems with a single point of failure often have very high-level security, but if it goes down it has a huge impact.

Space-time tradeoff – is the case when an algorithm/program can increase space usage to decrease time spent or vice versa. Exploiting space-time tradeoff, an attacker can roughly halve the effective number of bits.

Work factor – work factor is defined as the amount of effort required to break down a cryptosystem

Low-probability high-impact event - e.g. asteroids. We tend to obsess about such events or ignore it.

Risk matrix – 2D graph. Impact vs likelihood. Helpful for allocation of resources. High impact and high likelihood (focus). Low impact and low likelihood (ignore). The other ones are trickier.

Risk registers – tool for documenting risks and actions to manage each risk

Compliance – with processes. E.g. checklist for the car. Stops dumb things from happening.

Measure info in bits - 1 bit of info distinguishes between two cases

Reflection:

Richard was a bit vague with his discussion about managing risk. So I have reflected, done my own research and added more content for my own self study. 1. PreventionTry to prevent an event from happening by removing the vulnerabilities which allow the event to occur. I.e. if a fire is likely to occur in a building because people smoke in the building, then implement rules to prevent people from smoking inside the building.

2. LimitationIf the event cannot be prevented, then try and minimise it by limiting how bad the situation can get. I.e. if a fire does happen to occur inside a building, a method of limitation would be the installation of fire separation walls beforehand, so that the effect of the fire is limited to certain areas. Another method of limitation is by lowering the probability of the event occurring if the event cannot be fully prevented.

3. Passing the risk to a 3rd PartySimilar to Limitation, we try and limit the effects of the risk by shifting the responsibility off to another party. I.e. we can limit the losses occurred from the fire by having insurance, which can help with the recovery from the fire, through financial aid.  

AES (Advanced Encryption Standard) - Uses substitution-permutation network

Block Modes - Allow block ciphers to work with large data streams without the risk of compromising the provided security

Initialization Vector - Used to ensure distinct ciphertexts are produced even when the same plaintext is encrypted multiple times independently with the same key

CBC (Cipher Block Chaining) Each plaintext block is XOR’d with the previous ciphertext block that was produced.  The first plaintext block is XOR’d with a random initialization vector which is the same size as the plaintext block

Reflection:

I didn’t fully comprehend the nuances of CBC and so I did some online research on the concept to strengthen my understanding.

Wired Equivalent Privacy (WEP) - A security protocol that is designed to provide a wireless local area network (WLAN) with a level of security and privacy comparable to what is usually expected of a wired LAN

A stream of bits (A) is sent from one point to another

A random stream of bits (B) is generated using an algorithm, such as RC4 (very insecure)

The XOR function turns A into a stream of bits with the statistical properties of randomness. A (xor) B ->  C (Encrypted Stream of bits)

C (xor) B -> Gives back A again

Key Stretching - (Online) you type the password into the browser. (Offline) you steal the file containing the passwords (likely hashed) and attempt to decrypt them locally.

Salting -  Salting a hash is something that gets added to the password before it gets hashed. Salt can be a single string, or a unique string for each user. If your salt is unique for each user, each user's password is almost guaranteed to be unique before hashing. The goal is to make the amount of work to decode a hash as great as possible, to deter hackers.

Reflection

Cryptographic Hash Functions • Deterministic • Fast one way, infeasibly slow the other • Avalanche property - small change in the input will massively change the output. A good measure is having 1 bit change in the input resulting in half the other bits changing.

Clash Collision - Clash collisions occur from converting large subsets into a small subset, meaning people may have the same hash key.

Birthday attack (paradox) - Ask a small room if anybody shares a birthday. Yet most likely in the room, there is a high chance of two people sharing the same birthday. Square root of hash size, being the number of people results in about 50% collision.

Replay attack - an attack on a security protocol using replay of messages from a different context into the intended (or original and expected) context, thereby fooling the honest participants into thinking they have successfully completed the protocol run

Man-in-the-middle attack - a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other. One example of a MITM attack is active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them to make them believe they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker

Preimage attack - generate a document that has that hash i.e. go back to original thing from a hash Want hash to be preimage resistance - Given the hash, it should be hard to find the original message

2nd preimage attack - given a message M, you have a hash. You can find another message with the same hash by going back from the hash it should be hard to come up with a second message that has the same hash

Collision attack - Attacker choose any two messages where the hash is the same Want hash to be collision resistant - It should be hard to choose any two messages that result in the same hash

Reflection:

Defence in Depth - When one measure breaks, there will be multiple more measures of protection.

Single Point of Failure - When one defensive measure breaks, the system is vulnerable. 

Security By Design  - Before implementing a system, security features are planned ahead of time to prevent attacks. 

Apes vs Ants -  Ants rely on complete obedience for the colony to thrive. Apes have agency and freedom, and this individualism can work against the society’s goals. Thus, we need to ensure people’s individualism oppose each other to strike a balance. For example, police who receive renumeration and recognition, against criminals who have the chance at wealth. 

Bell-LaPadula model -  Enforcing access controls into different security levels. 

Side Channels - Every action in the virtual world leaves a physical trace. For example, increased graphics card usage for crypto mining will draw more power.

Attack on Journos - Targeting the source of information by attacking journalists. 

Vigenere Cipher -  Method of encrypting alphabetic text by using a series of interwoven Caesar ciphers based on letters of a keyword. 

Kasiski Examination - Method of attacking the Vienere Cipher where it allows the cryptanalyst to deduce the length of the keyword. Afterwards, the cryptanalyst lines up the ciphertext in n columns, and each column will be treated as a monoalphabetic substitution cipher that can be attacked using regular frequency analysis. 

Engima Machine - An encryption device that converts plain text to ciphertext and vice versa. Relied on rotors, keyboards, etc and was used extensively by Naxi Germany during WWII.

One Time Pad -  Encryption technique that cannot be cracked, but requires the use of a one-time pre-shared key the same length as the message being sent. Essentially, a Vigenere Cipher with the password length equal to the message size.

Type 1 Error -  False positive. An outcome is percieved as correct, however the outcome is in fact false. 

Type 2 Error - False negative. An outcome is perceived as incorrect. However the outcome is in fact true. 

The index of coincidence - a measure of how similar a frequency distribution is to the uniform distribution.

Reflection:

Security Mindset - Typically, people attempting to secure something use a defender mindset where they validate themselves through listing all their defensive strengths. Meanwhile, attackers focus solely on security weaknesses. Thus, as a defender it is required to think using an attacker mindset.

ODAY - Time between a compromise has been released, and when it is discovered by manufacturers. Security through obscurity - Attempting to secure something by making it more complex. Offers very little assurance it works and can also be undone slowly but surely

Kerckhoff's principle - The strength of code should not reside on the mechanism of the code being secret. The strength of the code should reside in the key.

Complexity/obscurity - Humans have progressed through creating more and more complex tools. However, in terms of security, excessive complexity is a great source of vulnerability. The two most complex objects are most likely computers, and humans/society.

GroupThink - Abiding to norms in a group dramatically impacts the decision of an individual, inevitably causing them to copy the group. 

Reflection:

Week 1 was definitely eye-opening. Security Engineering is the first course where I see an intersection between social, historical, polical and technological issues being discussed.

Social being the impact on stakeholders.

Historical to learn from mistakes and improve upon security.

Political blunders and abuse as another form of historical lesson.