Chapter3 Security Strategies

Content Least Privilege Defense in Depth Choke point Weakest Link Fail-Safe Stance Universal Participation Diversity of Defense Simplicity and Security Through Obscurity

Least Privilege It mean that any object(user, administrator, program system) should have only the privileges the object needs to perform its assigned tasks and no more(Limiting your exposure to attack and limiting the damage cause by particular attack). Ex: In internet context: every user don’t need to access every internet service. To create least privilege we use packet filtering.

Defense in Depth Refer to installation of multiple mechanisms that backup each other. Ex: Adopting multiple mechanisms that provide backup and redundancy for each other(Network Security(firewall),Host security, and Human security(user education, report,…)).

Choke point Choke point forces attacker to use a narrow channel which you can monitor and control. Ex: Firewall between your site and the internet(Connection between your site and the internet)

Fail-Safe Stance Refer to deny attacker by failure. Ex: Deny attacker by interrupt network connection when device was broken(Router). There are two fundamental stance that you take with respect to security decision and policy: The default deny stance: specify only what you allow and prohibit everything else. The default permit stance: Specify only what you prohibit and allow every thing else.

Universal Participation Refer to site person joining with security. Ex: It need everybody in each site to report strange happening that might be security related.

Diversity of Defense It is closely related to depth of defense but takes matters a bit further(different kind of defense). Method to implement diversity of defense is using security system from different vendor. The issues effect to diversity of defense: Inherent weaknesses Common Configuration Common Heritage Skin-deep differences

Simplicity and Security Through Obscurity It is a security strategy for two reason: First, keeping thing simple make them easier to understand. Second, Complexity provide nooks and crannies for all sorts of thing to hide in. Security through obscurity: It is a principle of protecting things by hiding them.