SECURITY AND SECUIRTY AUDITS
1) What Is Security?
• Security is easily remembered by the acronym CIA, which stands for
confidentiality, integrity, and availability.
i) Confidentiality means that no unauthorized people are able to
access information;
ii) Integrity means that no unauthorized people are able to modify
information; and
iii) Availability means that authorized people are able to access
information
Authorization has two elementsthat answer the following questions:
➔ Who is trying to access or modifyinformation and
• Do they have the right to perform the operation they
requested? Both of these elements are supported by a
variety of techniques.
2) Threats
• The point of view of an attacker provides one perspective for you to
take when designing your system or subsystem.
• Microsoft has introduced the acronym STRIDE for a threat model.
• STRIDE stands for
The STRIDE model
i) Spoofing identity. An example of identity spoofing is illegally
accessingand then using another user’s authentication information,
such as usernameand password.
ii) Tampering with data. Data tampering involves the malicious
modificationof data.
iii) Repudiation. Repudiation threats are associated with users who
denyperforming an action without other parties having a way to
proveotherwise.
iv) Information disclosure. Information disclosure threats involve
theexposure of information to individuals who are not supposed to
haveaccess to it.
v) Denial of service. Denial of service (DoS) attacks target the
serviceavailability to valid users—for example, by making a web
servertemporarily unavailable or unusable.
