Dept. of Computer and Information Science, Linköpings universitet, Sweden
An ontology that describes security technologies as a taxonomy and as countermeasures to protection goals. Typical starting points for browsing should be the classes Asset, Countermeasure, Threat.
Uses three rounds of DES. Different variants exist, see subclasses.
Randomly contact hosts to find interesting hosts, may e.g. use war dialling (adapted from ODotI)
An attack on a database to which users are allowed limited access: for example, access in order to calculate information such as averages. A statistical attack uses this information to discover data that is secret. (ODotI) Is this really a passive attack? Even if it leaves data unmodified? (my)
At best AV software provides prevention, detection and recovery. At least, it provides detection.
Software which monitors a computer and its files in order to detect any virus intrusions that have occurred (or is occuring(my def)) (ODotI)
A form of fraud, often using forged e-mails or Web sites, that tries to persuade users to disclose usernames and passwords for on-line bank accounts or other valuable resources. (ODoc)
An attack on a computer network where the intruder monitors the activity of a user of the network. When the user issues a log out the intruder cancels it and then proceeds to masquerade as the user. (ODotI)
Host-based intrusion detection system. Free and open source.
Secure Sockets Layer, a protocol developed by Netscape for transmitting private documents via the Internet. SSL uses a cryptographic system that uses two keys to encrypt data ? a public key known to everyone and a private or secret key known only to the recipient of the message. (Webopedia) It is a flexible protocol that is able to use a variety of encryption schemes. (ODotI)
Secure Hash Algorithm 1, a message digest algorithm that has been developed by the US government. (ODotI)
A stack attack involves running a program, typically from a web page, which consumes huge amounts of stack memory. (ODotI)
An asymmetric key encryption algorithm for public key cryptography which is based on Diffie-Hellman key agreement. The Digital Signature Algorithm is a variant of the ElGamal SIGNATURE scheme, which should not be confused with the ElGamal algorithm. (Wikipedia)
An attack on a computer system which results in the service being offered [...] being severely degraded. (ODotI)
Secure Shell, a network protocol designed for logging into and executing commands on a networked computer, replacing the insecure ftp, telnet and rlogin protocol. (Wikipedia)
Translation of data into a secret code (Webopedia)
The coding of messages so as to render them unintelligible to other than authorized recipients. (ODoC)
void print (char *str) { printf(str); } Call: print("%n") pops 4 bytes off the stack and makes them even accessible for writing (Wil05)
Countermeasures that detect and thwart buffer overflow attacks.
A property of a representation of a Target of Evaluation such thtat it accurately reflects the stated security target for that system or product (ITSEC)
A condition in which data (or a system itself) has not been modified or corrupted without authorisation. A system protects the integrity of data if it prevents unauthorised modification, as opposed to protecting the confidentiality of data, which prevents unauthorised disclosure. (Phoha) The degree to which a system or component prevents unauthorised access to, or modification of, computer programs or data (IEEE Std 610.12)
This attack may accomplish all sorts of things, thus we do not (on this level) define any existential quantifiers.
The attacker uses the IP fragmentation option to create extremely small fragments and force the TCP header information into a separate packet fragment. This attack is designed to circumvent filtering rules that depend on TCP header information. (Stallings 06)
NP5: Circumvention of existing controls or improper acquisition of otherwise denied authority.
Protection from the unauthorised disclosure of data. Security purists use confidentiality for this and use privacy to refer to the protection of personal information; privacy legislation consists of laws requiring government and business to justify which data they keep about people, and to tell people what information those organisations are storing about them. (Phoha) The right of individuals to control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed. Note: Because this term relates to the right of individuals, it cannot be very precise and its use should be avoided except as a motivation for requiring security. (CCITT)
The property that information is not made available or disclosed to unauthorised individuals, entities or processes. (CCITT) The property of not being divulged to unauthorised parties. (Phoha) The prevention of the unauthorised disclosure of information (ITSEC)
A condition in which an individual's true identity is unknown. (www.microsoft.com/security/glossary.mspx)
One machine on the Internet masquerading as another machine by using the latter's IP address. (ISD) A packet contains a false IP address (usually sender address), often used to trick firewalls to accept the packet as coming from a trusted source, e.g. the inner network. (my def, from Stallings 06)
Trust is a particular level of the subjective probability with which an agent will perform a particular action, both before we can monitor such action (or independently of his capacity of ever to be able to monitor it) and in a context in which it affects our action. (Gambetta, 1990)
Trust is a subjective expectation an agent has about another agent’s future behavior. (L. Mui, 2003)
Permission to access a resource. (Phoha)
The property of a scheme ... in which the recipient is able to prove to a third party that data has been sent by the sender or received by the receiver. This property protects against the sender denying having sent the message and the receiver denying having received the message. The sender is provided with a proof of delivery and receiver is assured of sender's identity. (Phoha) Repudiation: Denial by one of the entities involved in a communication of having participated in all or part of the communication. (CCITT)
The property that ensures that the actions of an entity may be traced uniquely to the entity. (CCITT) The process allowing for the auditing of IS activities to be traced to a source that may then be held responsible. (Phoha)
The ﬁrm belief in the competence of an entity to act dependably, securely, and reliably within a speciﬁed context. (Grandison, 2000)
A security principle that ensures that a message is received in exactly the form in which it was sent. (Phoha)
The process of reliably determining the identify of a communicating party or source of a message. (Phoha)
Secret information used to prove one's identity or authorisation in an authentication exchange. (ISD)
A credential is a piece of data or hardware that is presented to an AuthenticationService or IntegrityValidationService.
Data that is transferred to establish the claimed identity of an entity. (CCITT)
An object that is verified when presented to the verifier in an authentication transaction. Credentials may be bound in some way to the individual to whom they were issued, or they may be bearer credentials. The former are necessary for identification, while the latter may be acceptable for some forms of authorization. (Webopedia)
Aka static code analysis Tools that statically analyse source or object code for problems, flag suspicious constructs in software (adapted from Wikipedia)
Sometimes a technology is used as a countermeasure but it was not devised to be a countermeasure and may possibly not the best suitable countermeasure against a perceived threat. Such technologies are put into this class as a caveat.
Can be an asset because even the untrusted network can add value to a host (e.g. by giving access to the Internet).
Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between authorised parties. (MOV97)
The property of being accessible and useable upon demand by an authorised entity. (CCITT) Timely, reliable access to data and information services for authorised users. (Phoha) The ability of a product to be in a state to perform a required function under given conditions at a given instant of time or over a given time interval assuming that the required external resources are provide. (Meul) The prevention of the unauthorised withholding of information or resources (ITSEC)
A cryptographic hash function is a hash function with certain additional security properties (impossible to find a (previously unseen) message that matches a given digest, impossible to find "collisions", wherein two different messages have the same message digest). A hash function takes a long string (or message) of any length as input and produces a fixed length string as output, sometimes termed a message digest or a digital fingerprint. (summarised from Wikipedia)
Guessing passwords using a dictionary (my def)
Unauthorised access to information (Shirey)
TODO: Spyware could also be used as a countermeasure to guard policy compliance, if installed by an authorised entity.
Spyware threatens the integrity (unauthorised software) and availability (software consumes resources) of the host on which it is executed. It also threatens the user's privacy.
Any software that covertly gathers user information through the user's Internet connection without his or her knowledge, usually for advertising purposes. (Webopedia)
Algorithms for creating checksums. These checksums are for error detection and possibly correction on a low level, e.g. disturbances over a noisy connection. They are not secure to use for high-level integrity as new checksums can easily be created and small changes in the data can result in the same checksum. For stronger checksum algorithms, see the class cryptographic hash function.
A. Kim, J. Luo, M. Kang. Security ontology for annotating resources. In Proceedings of the On the Move to Meaningful Internet Systems: CoopIS, DOA and ODBASE. LNCS 3761. pp. 1483-1499. Springer Verlag. October 2005.
A system that authenticates people using biometrics, i.e. that rely on the measurement of an anatomical, physiological or behavioural characteristic of the user, rather than knowledge or possession of information or a key. (Phoha)
A cryptographic system where encryption and decryption are performed using different keys. These schemes use two mathematically related keys. The decryption key is hard to determine from the encryption key. (Phoha)
Buffer overflow happens when input or intermediate results exceed the buffer size. (Phoha) A program writes data beyond the allocated end of a buffer in memory. Buffer overflows usually arise as a consequence of a bug and the use of languages such as C or C++ that are not "memory-safe". One consequence of the overflow is that valid data can be overwritten as a result. (Wikipedia) A method of overloading a predefined amount of space in a buffer, which can potentially overwrite and corrupt data in memory. (www.evestigations.com/html/glossary.html)
As opposed to ServerHost. Important in authentication.
This protocol provides security extensions to the DNS to assure data integrity or authentication. DNSSEC provides data integrity and authentication services to security-aware resolvers or applications through the use of cryptographic digital signatures. (ISD)
Any criminal attempt to access a computer system by the repeated execution of some action. (ODotI)
Eavesdropping to capture passwords, which can then be used to masquerade as a legitimate user. (ISD)
A mechanism that confines the scope of Java applet actions according to rules defined in a security model. (ISD)
A technique whereby a program executing on a computer in a network is isolated from the system around it so that it cannot do any damage or violate any security policy. (ODotI)
An algorithm for creating public and private key and exchanging the public keys.
It is easy to generate y given x in: y = g^x modulo p (with p a prime and g < p) but it is hard to do the reverse.
Used for checking the status, progress and operation of a system (inspired from ODoC)
A method of public key encryption devised by Rivest, Shamir, and Adleman. (ODoC)
A program that absorbs all of some class of resources. (Bishop)
Not so sure if this is needed. Could not find a use case yet.
A honeypot is a trap set to detect or deflect attempts at unauthorized use of information systems. Generally it consists of a computer, data or a network site that appears to be part of a network but which is actually isolated and protected, and which seems to contain information that would be of value to attackers. (Wikipedia)
Fishbowl: The area of a computer system where an intruder is sent for its behaviour to be observed. (ODotI)
A honey pot is rather a scientific tool for observing intrusions. As a security countermeasure it is probably not very effective or efficient. Should be put into TechnologyMistakenlyUsed AsCountermeasure?
TripleDES used in Encryption-Decryption-Encryption mode for compatibility with single DES: DES(k3;DES^−1(k2;DES(k1;M))) and so a single DES encryption with key k can be represented as TDES-EDE with k1 = k2 = k3 = k.
An authentication code appended to an electronic document that indicates the author of the document. (ODoC)
A digital code that can be attached to an electronically transmitted message that uniquely identifies the sender. (Webopedia)
Data appended to, or a cryptographic transformation of a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery by the recipient. (CCITT)
It is difficult to find p and q given N in the equation: N = p * q
The same key is used in encryption and decryption.
OpenPGP is not specific to e-mail in transit but can just as well encrypt data on disk. That is why the restrictions denote *data* as asset and not *data in transit*.
An open standard for encryption of messages and sender/receiver authentication. (adapted from Wikipedia) It is not specific to e-mail in transit but can just as well encrypt data on disk. (my)
Subdivisions according to Debar, Dacier, Wespi "Towards a taxonomy of IDS" An intrusion detection system (IDS) inspects all inbound and outbound network activity and identifies suspicious patterns that may indicate a network or system attack from someone attempting to break into or compromise a system. (Webopedia) Further subclasses could be developed from http://www.sans.org/resources/idfaq/aint.php
The DNS server is compromised and thus under full control of the attacker. DNS data is no longer trusted. (CM02)
Any technology that protects communication.
A type of attack that exploits the vulnerability of those operating systems that do not handle asynchronous interrupts well and leave the system unprotected during such a time. (ISD)
TO DO: Check the restrictions against a good description of Firefly.
Protocol of key distribution based on public key cryptography.
Block ciphers do typically also protect the integrity of data. It is hard to modify the cryptotext so that the recipient does not detect the change.
A cipher in which a fixed-length block of data is encrypted, or decrypted, at each iteration of the algorithm: each block is input, encrypted, and output, with no memory (to retain message-dependent information) between blocks. (ODoc)
Infrastructure that handles public keys.
A collection of software tools installed by an intruder on a compromised computer. A rootkit will normally contain tools to hide evidence of the intrusion and backdoors to allow access or remote-control in future. Rootkits often include tools to facilitate other types of misuse such as distributed denial of service attacks or distribution of spam. (ODoC)
Attacks which make use of varying power consumption by the hardware during computation. (Wikipedia)
Interruption or prevention of correct operation (Shi94)
Guessing a password or key or other credential. This threatens a credential and may lead to the classification of a credential as an asset.
Any mechanism that could lead to a breach of the security of a system in the presence of a threat. (ODoC) Asset: Building, Threat: Flood, Vulnerability: Closeness to water, meters above water level.
A small electronic device about the size of a credit card that contains electronic memory, and possibly an embedded integrated circuit (IC). (Webopedia) A smartcard can be used as an access control token that proves the autorisation of its bearer. (my def)
It is either used as human authentication or for data confidentiality, possibly both.
Confidential authentication information, usually composed of a string of characters. (CCITT) A unique character string held by each user, a copy of which is stored within the system. During login an authentication process takes place; the password entered by the intending user must correspond with the stored value before the user is accepted by the system. (ODoC) A secret series of characters that enables a user to access a file, computer, or program. On multi-user systems, each user must enter his or her password before the computer will respond to commands. The password helps ensure that unauthorized users do not access the computer. In addition, data files and programs may require a password. (Webopedia)
CodeSigning may overlap with SigningWithCertificate. CodeSigning is specific to Code, not to Signing.
A secure hashing algorithm is used on the code to be executed providing a compact code signature. This signature is encrypted using the private key of a vendor. ... (Phoha)
The process of ensuring that only authorized subjects are allowed access to a resource. (generalised from ODoC)
The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorised manner. (CCITT)
This is the enforcement part. The authentication part of access control is handled in AuthenticationService/Loginsystem. Access control does prevent bad things from happening.
The source station specifies the route that a packet should take as it crosses the Internet, in the hopes that this will bypass security measures that do not analyse the source routing information. The countermeasure is to discard all packets that use this option. (Stallings 06)
A form of secure access control in which the access rights to objects are set by system administrators and cannot be made more permissive by other users. (ODoC)
Deflection leads an intruder to believe that he has succeeded in an intrusion attempt, whereas instead he has been attracted or shunted off to where harm is minimized. (http://www.sans.org/resources/idfaq/aint.php)
A countermeasure is a piece of 'security technology' that protects assets against threats. An alternative naming is 'control'. (my def)
leads to the unrecoverable erasure of sensitive material from a system (adapted from ODoC)
Classification from ODotI, together with PassiveAttack NP6: Active misuse of resources. Misuse of (apparently) conferred authority that alters the system or its data. integrity of the asset is violated (my def)
A device that can generate a magnetic field for degaussing magnetic storage media. (www.all.net/books/standards/remnants/glo.html)
A packet-filtering router applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet. (Stallings, 2006)
Models used for hash functions and encryption.
A cipher in which a relatively small quantity of data is encrypted (or decrypted) at each iteration of the algorithm, perhaps just one character or byte, but in which the algorithm contains memory that retains message-dependent information between iterations. (ODoc)
Not all stream ciphers are guaranteed to provide the detection of integrity violations. This must be supplied for every algorithm.
The attacker masquerades as a DNS server and feeds the client wrong and/or potentially malicious information. (CM02)
Virtual private network. A connection between two computers or other endpoints in which packets sent over a shared network are automatically encrypted and decrypted by the endpoints. (ODoC)
A form of denial of service, performed by simultaneously sending large numbers of packets to the same host or network from many computers in different locations on the Internet, with the aim of flooding a network connection or other service. (ODotI)
technique to introduce arbitrary code into a running computer process (Wikipedia). Subcategories also from Wikipedia.
A small fixed-length quantity computed as a function of an arbitrary-length message. A checksum is computed by the sender of a message, recomputed and checked by the recipient of a message to detect data corruption. ... Usage has extended the definition to include more complex noncryptographic functions such as CRCs... and cryptographic functions such as message digests. (Phoha)
The DNS server is made to cache bogus information, the attacker can redirect traffic intended for a legitimate site to a site under the attacker's control. (CM02)
Digital Signature Algorithm, an algorithm which is used in the US government's digital signature standard. When applied to a message it generates two integers which need to be compared by the recipient of a message which has been signed using this technique. The algorithm can only be used for digital signatures, not for the transmission of data. (ODotI)
The process of generating and verifying a message authentication code.
Confidentiality and goals that are related to confidentiality. BEWARE: The inferred individuals are not (always) correct in Protege 3.1.1/Pellet1.3!
NP 4:Setting Up Subsequent Misuse: Planting and arming malicious software Introduction of unauthorised or unwanted software.
Role-based access control (RBAC) is an alternative to traditional access control models (eg, discretionary or non-discretionary access control policies) that permits the specification and enforcement of enterprise-specific security policies in a way that maps more naturally to an organization's structure and business activities. (www.hipaabasics.com/glossary.htm)
That part of eavesdropping concerned with the analysis of which parties are communicating and the volumes and timings of those communications, rather than the contents of the messages themselves. Some encryption systems do not protect users against traffic analysis, even though all the content my be encrypted. (ISD) Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more that can be inferred from the traffic. (Wikipedia)
This class denotes the first meaning of the definition, namely the signing part. The verification part is called DigitalSignatureValidation in this ontology.
The process of (1) signing digital data, typically before deployment, typically performed by the data owner or producer and (2) verifying the digital signature at a later stage, typically after deployment, typically performed by the data consumer.
Acronym for Internet Protocol Security. A series of Internet standards, defined in RFC2401 and others, that allow the content of IP packets to be encrypted and/or signed. (ODoC)
TODO: Find a name for the asset that is protected by traffic padding, add that asset to the asset hierarchy and introduce it as protection goal with the protects-property.
The addition of false communications or data units to conceal the amount of real data units being sent. (ISD) The generation of spurious instances of communication, spurious data units and/or spurious data within data units. (CCITT)
Abstract container for access control to files provided by operating systems.
A program is supplied with unexpected, potentially malicious, input (mu def)
A product that contains countermeasures.
Tools used for learning more about a system, host, network etc.
Any attack that affects the DNS services. (CM02)
Message Digest 5, an algorithm used to generate message digests (ODotI)
An adversary can intercept, interrupt and/or modify the routing messages. (CM02)
A dated term that is almost an equivalent to Access Control Mechansim. Used as a placeholder in case typical subclasses of a reference monitor can be found. Might also be removed.
A system component responsible for the mediation of all access to objects by subjects. All data accesses are performed through the reference monitor, which cannot be bypassed. (ISD)
A secret key encryption algorithm developed by NSA (US) using 64-bit blocks and 80-bit keys. (ISD)
Aka keystroke monitoring: recording every keystroke of the user (and usually every character of response). A form of audit trail software or a specialised device usually does this monitoring. (ISD)
Acquiring data from object residue. (ISD)
A special worm that exists as a single copy of itself at any point in time as it "jumps around" on networked hosts. (Szor)
A principle: that every user/process should have just enough, but no more privileges to enable them to carry out their jobs. (combined from ODoC, ODotI)
Worms are network viruses, primarily replicating on networks. (Szor)
Like TDES-EDE but with only two keys: DES(k1;DES^-1(k2;DES(k1;M)))
A malicious router mishandles packets, thus resulting in congestion, dos. The problem becomes intractable if the router selectively interrupts or misroutes packets resulting in triangle routing. (CM02)
The IDS detects a potential security breach, logs the information and signals an alert. (Webopedia)
The type of user that interacts with a countermeasure.
A message digest algorithm. This is a 160-bit cryptographic hash function ... intended as a secure replacement for the 128-bit hash functions MD4, MD5, and RIPEMD.
The act of capturing data which is flowing through the communications media used by a computer network. (ODotI) Often accompanied by a more active attack.
This subclass contains a collection of access control principles.
Collection of data about events which have occurred in a system. (inspired by ODotI)
A piece of data that serves as input to encryption or decryption.
A backdoor is the malicious hacker's tool of choice that allows remote connections to systems. A typical backdoor opens a network port (UDP/TCP) on the host when it is executed. Then the listening backdoor waits for a remote connection from the attacker and allows the attacker to connect to the system. (Szor)
A name used to gain access to a computer system. (Webopedia)
The username or name of your account used for identification purposes. (home.esn.net/support/glossarya.html)
A technique used to establish whether text sent over a network has been tampered with. It consists of a mathematical rule which, when applied to a piece of text, generates a relatively short number, usually between 128 and 512 bits. This number is then sent with the text to a recipient who reapplies the mathematical rule to the text and compares the result with the original number. If they are the same then there is a very high probability that the message has not been tampered with during the sending process; if it does differ it is virtually certain that the message has been tampered with. (ODotI)
A message digest, used in a security context, makes use of a cryptographic hash function.
Moved away from encryption algorithms as this does not deal with encryption but with key generation, being a support for encryption but not the same as encryption.
the activity of collecting, encoding, analyzing and presenting evidence relating to competence, honesty, security or dependability with the purpose of making assessments and decisions regarding trust relationships (Grandison, 2000)
a uniﬁed approach to specifying and interpreting security policies, credentials, and relationships which allow direct authorization of security-critical actions (M. Blaze, 1996)
Platform for Privacy Preferences is a specification that will allow users' Web browsers to automatically understand Web sites' privacy practices. (Webopedia)
A document with a digital signature. Such a certificate is used to authenticate identity. Digital certificates are often signed by a trusted third party known as a certificate authority. (ODotI)
A data structure signed with a public key digital signature stating that a specified public key belongs to someone or something with a specified identification. (ISD)
A certificate authority (CA) issues an encrypted digital certificate containing the applicant's public key and a variety of other identification information. The CA makes its own public key readily available through print publicity or perhaps on the Internet. The recipient of an encrypted message uses the CA's public key to decode the digital certificate attached to the message, verifies it as issued by the CA and then obtains the sender's public key and identification information held within the certificate. With this information, the recipient can send an encrypted reply. (Webopedia)
A DoS-attack in which many pings (ICMP echo request packets) are broadcast to the network. The source field is set to the victim's IP address. Any machines that respond will transmit to the victim, overloading its network interface. (ISD)
Unauthorised control of some part of the system (Shi94)
Classification from ODotI, together with ActiveAttack Also fits NP7: Passive misuse of resources Confidentiality of the asset is violated but nothing is modified.
A method for attacking or intercepting an established TCP/IP connection. Usually, this type of attack occurs after authentication of the users is complete and the attacker assumes the role of a legitimate user. (ISD)
HTTPS is ordinary HTTP exchanged over an SSL encrypted session.
SAML (Security Assertion Markup Language)
Security Assertion Markup Language, an XML-based framework for ensuring that transmitted communications are secure. SAML defines mechanisms to exchange authentication, authorization and nonrepudiation information, allowing single signon capabilities for Web services. (Webopedia)
An attacker gains partial or full control over a host. (my def)
Data that is transferred over a network. Notice that all other subclasses of Data can also be "in transit". A login name, password, or a copy of the heap may be transferred over the network.
NP3: Impersonation, playback, spoofing ISD: Spoofing, impersonation, masquerading are synonyms. Use of legitimate identification and authentication by an unauthorised individual to impersonate a legitimate user, i.e., to appear to have a different identity from one's own. (ISD) Spoofing: Assuming the identity of an existing user in order to discover information associated with that user or information that the user is allowed to access. (ODotI) Masquerade: The pretence by an entity to be a different entity. (CCITT)
In cryptography, a side channel attack is any attack based on information gained from the physical implementation of a cryptosystem, rather than theoretical weaknesses in the algorithms. (Wikipedia) Could be used for other algorithms as well. (my)
Using a specific programming language (subclasses may define the languages) enables e.g. buffer overflows.
Data Encryption Standard, predecessor of AES.
A US government standard for a block cipher which employs a 56-bit secret key. (ODoC)
Insertion of a large quantity of data that may result in a denial of service. (ISD)
A synonym for threat. Some publications use threat for high-level threats like "act of human error or failure" and attack for more specific threats like "virus". But the distinction is arbitrary as illustrated in Whitford, Mattord, Principles of Information Security, 2nd Edition, 2005. p. 126: Table 4.3 describes threats to information security, one threat being 'deliberate software *attacks*'.
Discipline which embodies principles, means, and methods for the transformation of data in order to hide its information content, prevent its undetected modification and/or prevent its unauthorised use. (CCITT)
Network-based intrusion detection system. GP license.
Used to sign a message digest or hash function. (my def)
The goal of a countermeasure, typically confidentialiy, integrity etc.
Considers state of higher-level connection, not only single packets of stateful protocols. (Stallings 06)
A file that configures a program, also a policy.
A form of DENIAL OF SERVICE ATTACK which relies on the fact that administering visible widgets such as WINDOWS and BUTTONS on a screen consumes a large amount of resources. A typical example of a window attack might involve the creation of a large number of windows displayed on a screen. The amount of resources required to manage such a large number of windows can easily render a computer inoperable. (ODotI)
An apparently innocent program designed to circumvent the security features of a system. (ODoC) A virus which infects a computer by masquerading as a normal system entity. (ODotI) (too strict, a modified ps-command is a Trojan but not a virus)
NP2b) active hardware misuse with side effects
The IDS responds to the suspicious activity by e.g. logging off a user or by reprogramming the firewall to block network traffic from the suspected malicious source. (Webopedia)
Secure Hypertext Transfer Protocol, developed within the Internet standards process, this protocol defines the security additions to the HTTP protocol. It is an application-level protocol and adds encryption and authentication to WWW communications. (ISD) obsoleted by HTTPS (HTTP using SSL)
Means by which two or more parties may employ subliminal or invisible communication. (ISD)
Code that recursively replicates a possibly evolved copy of itself. Viruses infect a host file or system area, or they simply modify a reference to such objects to take control and then multiply again to form new generations. (Szor)
NIDS analyses the individual packets flowing through a network. It can detect malicious packets that are designed to be overlooked by a firewall's simplistic filtering rules. (Webopedia)
Bruce Schneier. Applied Cryptography, 2nd Edition. Wiley & Sons. 1996.
A certificate based on the X.509 standard. (my def)
In misuse detection, the IDS analyzes the information it gathers and compares it to large databases of attack signatures. Essentially, the IDS looks for a specific attack that has already been documented. (Webopedia)
A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated. (Wikipedia)
A US government encryption standard that supercedes DES. AES specifies the Rijndael algorithm with key sizes of 128, 192, and 256 bits and a block size of 128 bits. (Phoha)
Systems that act as a gateway between two networks to enforce an access policy. (ISD)
A system designed to control the passage of information from one network into a second network. Typically a firewall will be used as a means of reducing the risk of unwanted access to sensitive systems, where one carefully regulated network contains the sensitive systems and is connected to a larger less-regulated network. (ODoC)
NAT solves the problem of shortage of IPv4 addresses. Only by accident, does it have security properties. The appropriate countermeasure is a firewall.
Network Address Translation, an Internet standard that enables a local-area network (LAN) to use one set of IP addresses for internal traffic and a second set of addresses for external traffic. A NAT box located where the LAN meets the Internet makes all necessary IP address translations. NAT security purpose: to provide a type of firewall by hiding internal IP addresses. (Webopedia)
Aka non-reusable password A password which is only used once and is then discarded. (ODotI)
The simplest way to make a key-dependent one-way hash function is to encrypt a message with a block algorithm in CBC or CFB modes . The hash is the last encrypted block, encrypted once more in CBC or CFB modes.
Uses three different keys: DES(k3;DES(k2;DES(k1;M))) where M is the message block to be encrypted and k1, k2, and k3 are DES keys
Not allowed to start name with number, thus the underscore in the name.
Data that allows a receiver to verify an authenticated message. The received message matches the sent message. (ISD) A version of a message digest which also includes a password. The user of a message authentication code cannot recreate the number associated with the message digest unless they also know the password. This represents an attempt to strengthen the security of basic message digest schemes. (ODotI)
A form of access control in which subjects may themselves create and alter access rights to objects, limited by any overriding constraints imposed by system administrators.
Malicious modification of routing tables. This can be achieved by maliciously modifying the routing information update packets sent by the routing protocols. (CM02)
Aka proxy server, relay of application-level traffic. If the gateway does not implement the proxy code for a specific application, the service is not supported and cannot be forwarded. Scrutinizes only a few allowable applications. (Stallings06)
An attack on a computer system whereby the attacker intercepts messages between two entities on a network, for example a SERVER and a CLIENT , and makes each one think it is communicating with the other. (ODotI)
TBD: Not all MITM attacks affect both confidentiality and integrity. For the moment the model says otherwise so that MITM is found both for integrity and confidentiality attacks.
The data files, as distinguished from the executables, of a database management system.
In anomaly detection, the system administrator defines the baseline, or normal, state of the network?s traffic load, breakdown, protocol, and typical packet size. The anomaly detector monitors network segments to compare their state to the normal baseline and look for anomalies. (Webopedia)
A program which examines incoming e-mails and rejects those which the user (or a system policy (my def)) has indicated that he or she is not interested in. (ODotI)
The transfer of file which are stored on a computer to some long-term archival medium such as a CD ROM. (ODotI)
Copies of files, data and programs made to facilitate recovery from failures of primary system. (Phoha)
A computer which stands between a secure network and the Internet. (ODotI) A firewall host which acts as an interface point to an external untrusted network. (Phoha)
[...] The same key is used to encrypt and decrypt the text that is to be sent. This means that the sender and the receiver must have exchanged this key some time before the message has been sent and that this transfer must occur over a secure channel. The key used for symmetric key encryption is often known as a SECRET KEY. (ODoC)
A security or copy protection device for programs that must be connected to an I/O port of the computer while the program is run. (ODoC)
The Router at the head of a transmission selects a number of Onion Routers at random and generates a message for each one, providing it with symmetric keys for decrypting messages, and instructing it which Router will be next in the path. Each of these messages, and the messages intended for subsequent routers, is encrypted with the corresponding Router's public key. This provides a layered structure, in which it is necessary to decrypt all outer layers of the onion in order to reach an inner layer. (Wikipedia)
Another type of protection goal, the strategy or style for protecting assets against a threat: detection, prevention, recovery, deterrence etc. Used by countermeasures.
BEWARE: The inferred individuals are not (always) correct in Protege 3.1.1/Pellet1.3!
The IDS examines the activity on each individual computer or host. (Webopedia)
Protection designed to deny unauthorised persons information derived from the interception and analysis of compromising emanations from computers, monitors, printers, etc. (ISD)
A server computer which receives messages with embedded instructions on where to send them next, and which forwards them without revealing where they originally came from. (Wikipedia)
Attacks based on leaked electromagnetic radiation which can directly provide plaintexts and other information. (Wikipedia)
S-MIME (Secure Multipurpose Internet Mail Extensions)
Secure Multimedia Internet Mail Extensions, a standard for public key encryption and signing of e-mail encapsulated in MIME (wikipedia)
A large ICMP packet sent to overflow the remote host's buffer, causing the remote host to reboot or hang. (ISD)
A timing attack is a form of side channel attack where the attacker tries to break a cryptosystem by analyzing the time taken to execute cryptographic algorithms. The attack exploits the fact that, particularly in asymmetric key algorithms, computation time for a private key operation is dependent on the key in some way. (Wikipedia) (Term also badly explained in ODotI)
A math operation may give a result larger than the available register width, an error condition may result. Integer overflows do not generally lead to exploitable conditions. However, on systems where the result is simply stored, and no error is returned (this is the general case), it may not be possible for the software to determine that the value stored is erroneous. If an integer value is used to specify the location of other code or variable values in memory, the resulting pointer error may be exploited to create a buffer overflow condition or to write and execute arbitrary (and possibly harmful) code to the resulting (and unexpected) position. (Wikipedia)
The most popular standard for security certificates. It contains information such as the public key associated with some Internet entity, its name, and a unique registration number. (ODotI)
A potential violation of security. (CCITT) Any event that is potentially harmful to an IS through unauthorised access, destruction, disclosure, modification of data, and/or denial of service. (ISD)
A programming language element is not used as intended.
A circuit-level gateway does not permit an end-to-end TCP connection, but sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The gateway typically relays TCP segments from one connection to the other without examining the contents. The security function consists of determining which connections will be allowed. (Stallings06)
ensures the validity of TCP and UDP sessions by ceating a handshake between communicating parties and passing packets through until the end of the session. (ISD)
Misuse of the format string as shown in FormatStringAttack.
A secure method of authenticating users on a computer network, developed by MIT. (ODoC)
A vulnerability scanner is a type of computer program specifically designed to search a given target (piece of software, computer, network, etc.) for weaknesses. The scanner systematically engages the target in an attempt to assess where the target is vulnerable to "attack". The program can be used either prophylactically (to find holes and plug them before they are exploited) or maliciously (to find holes and exploit them). (Wikipedia)
The process of generating and verifying a message digest credential.
Denotes when a countermeasure is employed or a vulnerability introduced or exploited. Proof-of-concept status
A countermeasure or credential is used by one or more countermeasures or credentials.
A credential is verified by at least one, possibly more countermeasures.
A vulnerability exists on one or more assets.
A countermeasure is employed at one or more points in time, e.g. at runtime, at compile time.
An operating system can support one or more countermeasures. This is for finding countermeasure products for a given operating system. For example: Which firewalls run on Mac OS?
A countermeasure implements a theoretical security model, e.g. RBAC.
Links a threat to asset and security goalby using the pattern of n-ary relationship as class. This class is represented by ThreatThreatensGoalOfAsset.
A countermeasure may verify one or more credentials. For example: DigitalSignatureValidation verifies DigitalSignature.
A countermeasure executes on one or more operating systems. This is for finding countermeasure products for a given operating system. For example: Which firewalls run on Mac OS?
A threat is enabled by one or more vulnerabilities.
A security goal can have related security goals. For example: confidentiality is related to anonymity, privacy and secrecy.
A countermeasure is supported (relates to) another countermeasure. Encryption is supported by key management.
A countermeasure is contained in one or more products. For example: Encryption part of MS Word.
A product can contain one or more countermeasure. For example: MS Word contains encryption and access control.
One technology asset resides on one or more technology assets. For example: Data resides on Host, Host resides on Network.
A property for determining what kind of users typically interact with a countermeasure. A useful add-on if one wants to reason about usability requirements of countermeasures.
An asset can have one or more vulnerabilities.
A vulnerability enables one or more threats.
A model is implemented by one or more countermeasures.
A countermeasure or a credential can use one or more countermeasures or credentials.
Threats can imply other threats. If one threat has materialised, this may open up for other threats. For example: if the host is compromised a rootkit can be introduced.
One technolgoy asset can contain further technology assets. For example: A network contains hosts, hosts contain data.
A helper property for the n-ary relations. Denotes a goal.
A helper property for the n-ary relations. Denotes a mechanism type.
A helper property for the n-ary relations. Denotes a countermeasure.
A helper property for the n-ary relations. Denotes a threat.
Links a countermeasure to asset, security goal and mechanism type by using the pattern of n-ary relationship as class. This class is represented by CountermeasureProtectsGoalOfAssetThroughMechanismtype.
Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone. Handbook of Applied Cryptography. CRC Press. 1997.