- Define compulsory: mandatory, enforced Ex. Following the security policy is compulsory.
- Evaluating Biometric Devices
The key concepts for this is memorization of Type I error, Type II error, and CER. A Type I error is that of false rejection. For example, Joe should be allowed in the data center. If Joe scans his retina and is denied access to the data center is it a false rejection or Type I error. A Type II error is just the opposite. If Jill does not have access to the data center, scans her retina, and access is granted, that is a false acceptance or Type II error.
- DAC, MAC, and Security Labels
The type of access control system typical computer users are accustomed to is called a Discretionary Access Control system. This means that a user’s right to read/write/execute an object is based soley on their need-to-know. Data owners are able to decide who can access the data via an Access Control List (ACL). Because the military and other government agencies want to control access based both on classification and need-to-know, they use the Mandatory Access Control system. A Security Label is an attribute of an object defining it’s classification level and need-to-know categories. A person must have both a clearance equal to or greater than the object and have been granted a need-to-know for one or more of the categories contained in the security label in order to access the object.
- Capability Table
This was a new term for me. Essentially a capability table is a list of permissions that is bound to a subject whereas an ACL is a list of permissions bound to an object. I’m sure the term is wrong, but I like to think of it as an inverse of an ACL.
- Traffic Analysis Attack
Now to me, this attack is quite a stretch. basically, it says that by watching traffic patterns people can discover information. Now in that simply form, yes, traffic monitoring can lead to all types of great information. My problem is with the book’s example: “For example, heavy traffic between HR and headquarters could indicate an upcoming layoff.” Maybe it’s just me, but that seems like a leap. I’m much more inclined to believe an upcoming layoff could be revealed by looking at the email flying by, not so much by the amount of traffic.