Introduction to Computer Security

Security Properties

Computer security: Protecting computers, software, and data from unauthorized access, modification, or disruption.
Cybersecurity: The broader field, covering networks, online services, and connected infrastructure.
CIA triad: A model that groups the primary security properties into confidentiality, integrity, and availability.

Confidentiality and Related Concepts

Confidentiality: Ensuring information is only accessible to authorized users.
Privacy: Control over how personal information is collected, used, and shared.
Anonymity: Hiding a person’s identity even when their actions are visible.
Secrecy: Intentionally concealing information or even its existence.

Integrity and Related Concepts

Integrity: Ensuring data and systems stay accurate and are changed only with authorization.
Data integrity: Protection against unauthorized modification or deletion of information.
Origin integrity: Assurance that information came from its claimed source.
System integrity: Assurance that hardware, software, and processes work as expected.
Authenticity: Evidence that a person, system, or message is what it claims to be.
Accountability: Linking actions to the people or systems responsible for them.

Availability and Denial of Service

Availability: Ensuring systems and data are usable when needed.
Denial-of-service (DoS) attack: An attack that makes a service unavailable or too slow to use.
Distributed denial-of-service (DDoS) attack: A denial-of-service attack driven by many machines at once.

Building and Evaluating Defenses

Prevention: Stopping attacks before they succeed.
Detection: Identifying and reporting attacks and attempted attacks.
Recovery: Restoring systems and operations after an attack or failure.
Forensics: Investigating incidents to determine what happened.
Defense in depth: Layering independent controls so that one failure does not compromise the system.
Policy: What a system allows and what it does not.
Mechanism: Whatever enforces a policy.
Technical mechanism: Enforcement built into software or hardware, such as access controls or cryptography.
Procedural mechanism: Enforcement that depends on people following a process, such as audits or ID checks.
Assumption: A condition a mechanism relies on, which can fail silently when it is wrong.
Assurance: Confidence that a system correctly enforces its policies.
Penetration testing: An authorized attack on a system to find and report weaknesses.
Security engineering: Designing and operating secure systems, including the tradeoffs involved.
Security architecture: The overall design of a system’s security controls and structure.
Security theater: A measure that looks protective but does little to reduce risk.

Risk

Asset: Anything valuable a system must protect, including data, money, and reputation.
Security control: A safeguard, also called a countermeasure, that reduces or limits harm.
Risk analysis: Identifying assets, the threats to them, and which controls are worth applying.
Threat model: Analysis that identifies system components, trust boundaries, and potential vulnerabilities.
Mitigate: Reduce a risk’s likelihood or impact by adding controls.
Avoid: Eliminate a risk by stopping the activity that creates it.
Transfer: Shift part of a risk’s cost through insurance, contracts, or outsourcing.
Accept: Decide a risk is small enough to live with.
Residual risk: The risk that remains after controls are applied.

Trust and the Supply Chain

Trusted Computing Base (TCB): The hardware, firmware, and software that must work correctly for security to hold.
Trust boundary: A point where data or control crosses between trusted and untrusted parts of a system.
Supply chain: The people, tools, vendors, and components used to build and deliver a system.
Supply chain security: Protecting the process by which software and hardware are built and delivered.
Supply chain attack: A compromise introduced through trusted third-party software, hardware, or updates.
Code signing: Cryptographic proof of which publisher released software, but not that their build system was clean.

Vulnerabilities and Exploits

Vulnerability: A weakness that could allow a security property to fail.
Bug: A defect in hardware or software, some of which create vulnerabilities.
Exploit: Code or a technique that takes advantage of a vulnerability.
Zero-day vulnerability: A vulnerability the vendor and defenders do not know exists.
Zero-day attack: An attack that exploits a vulnerability before defenders can prepare.
Spectre: A processor vulnerability that tricks software into exposing data through speculative execution.
Meltdown: A processor vulnerability that lets a program read protected kernel memory.
Rowhammer: A memory vulnerability where repeated access to one DRAM row flips bits in another.
Metasploit: A framework bundling known exploits for authorized testing, and usable for attacks.

Attacks and Incidents

Attack: A deliberate attempt to compromise a security property.
Security incident: An event that jeopardizes a security property or violates a policy.
Data breach: An incident involving unauthorized access to or disclosure of data.
Exfiltration: Unauthorized transfer of data to a location the attacker controls.
Ransomware: Malware that disables access to data and demands payment to restore it.
Extortion: Demanding payment under threat, such as publishing stolen data.
Double extortion: Encrypting data and also threatening to publish it.
Wiper: Malware built to destroy data.
Resource hijacking: Running the attacker’s software on someone else’s machine.
Impersonation: Using stolen or forged credentials to act as someone else.
Credential stuffing: Replaying passwords stolen from one site against unrelated sites.
Social engineering: Manipulating a person into giving up information or access.
SIM swapping: Redirecting a victim’s phone number to the attacker’s SIM card.
Botnet: Compromised machines under the control of one attacker.
Command-and-control (C2): The infrastructure that sends instructions to a botnet.
Computer Emergency Response Team (CERT): A center for coordinating incident response across organizations, first established at Carnegie Mellon.

Vectors and Surfaces

Attack vector: The path or method used to reach a target.
Attack surface: All the points where an attacker could try to get in.
Hardening: Removing unused software, services, open ports, and insecure defaults.
Loosening guide: Vendor documentation on the risk of turning a disabled feature back on.
Air gap: No network connection at all, with transfers made by a controlled physical process.
Sensitive Compartmented Information Facility (SCIF): A room for classified material, controlling every path information could leave by.

Vulnerabilities in AI Systems

Prompt injection: Text that an AI agent treats as an instruction rather than as content.
Indirect prompt injection: Prompt injection hidden in a document, page, or email the agent processes.

Threats and Threat Actors

Threat: Any circumstance or event that could cause harm, including accidents and failures.
Threat actor: A person, group, or state that might carry out a threat. Also called a threat agent.
Disclosure: Unauthorized access to information.
Deception: Accepting false information as true.
Disruption: Interrupting or degrading correct operation.
Usurpation: Unauthorized control of a system or resource.
Attribution: Determining who carried out an attack.

Adversaries

Adversary: The person, group, or state behind an attack.
Threat matrix: Classification of an adversary by expertise, unskilled to skilled, and focus, opportunistic to targeted.
Opportunistic attack: Scanning broadly and taking whatever proves vulnerable.
Targeted attack: Pursuing a chosen victim.
White hat: A hacker who finds and reports vulnerabilities under authorization.
Black hat: A hacker who exploits vulnerabilities for gain or disruption.
Gray hat: A hacker who acts without authorization but may claim a defensive purpose.
Access broker: A criminal who sells footholds in compromised networks.
Malicious insider: An employee or contractor who abuses legitimate access.
Hacktivist: An attacker advancing a political or social message.
Industrial spy: An attacker who steals trade secrets for a competitor or a government.
Script kiddie: A low-skilled attacker using tools built by others.
Advanced persistent threat (APT): A well-resourced adversary that pursues goals over years and keeps its access.

Cyber Warfare

Cyber warfare: State-directed operations to disrupt, damage, or disable infrastructure or military systems.
Cyber espionage: Operations aimed at collecting information rather than causing an effect.
Programmable logic controller (PLC): A small industrial computer that runs motors and valves in factories and plants.
GPS jamming: Drowning out satellite signals so that receivers lose position and time.
GPS spoofing: Broadcasting false navigation signals that receivers accept as real.

Countermeasures

Court-authorized botnet operation: Seizing command servers and redirecting malware domains under a warrant.
Provider-led takedown: A company’s court-authorized seizure of criminal domains.
Helpful worm: Self-spreading code meant to remove malware, released without authorization.
Hack-back: Offensive action by a victim against an attacker, usually illegal.
Computer Fraud and Abuse Act (CFAA): The U.S. law making unauthorized computer access a federal crime.

Tracking Vulnerabilities

Common Vulnerabilities and Exposures (CVE): A unique identifier for a publicly disclosed vulnerability.
Common Vulnerability Scoring System (CVSS): A 0 to 10 rating of a vulnerability’s technical severity.
National Vulnerability Database (NVD): A U.S. database that adds product and severity data to CVE records.
Known Exploited Vulnerabilities (KEV): CISA’s catalog of vulnerabilities with confirmed exploitation in the wild.
Exploit Prediction Scoring System (EPSS): An estimate of how likely a vulnerability is to be exploited soon.
Likely Exploited Vulnerabilities (LEV): A proposed estimate of how likely exploitation has already been observed.
MITRE Corporation: The nonprofit that runs the CVE program and the ATT&CK framework.
National Institute of Standards and Technology (NIST): The federal agency responsible for the NVD.
Cybersecurity and Infrastructure Security Agency (CISA): The federal agency that publishes the KEV catalog and sponsors CVE.
Forum of Incident Response and Security Teams (FIRST): The international consortium that maintains CVSS and EPSS.
ATT&CK framework: MITRE’s catalog of the techniques adversaries use.
Coordinated disclosure: Reporting a vulnerability to the vendor and allowing time for a fix.

Naming and Attribution

False flag: A clue planted to point investigators at the wrong party.
Tactics: An adversary’s broad objectives, such as gaining initial access.
Techniques: The general methods used to achieve those objectives.
Procedures: The specific ways an adversary carries out its techniques.