Hi everyone,

The promotion of my book, The Effective CISSP: Security and Risk Management is ticking.
The Kindle version is now 50% off for US$4.99. 👍🎉
I hope you enjoy it! 😀

Physical Later

Networks are nodes connected to share resources and made of physical devices, media, connectors, signals, and so forth.

Data Link Layer

A link is a connection between two adjacent nodes. Point-to-point or P2P refers to the link. The Data Link layer describes the data transmission between any two nodes on a network that are connected as a link logically. The transmission over the physical media is mediated through contention (CSMA/CD), queueing (token passing, e.g., Token Ring), or polling. In brief, the data link layer deals with logical link control and media access control.

Network Layer

A path, or route, is the connection between two end nodes across a series of connected links. End-to-end refers to a path that connects two endpoints. Routing is the decision of path selection. A router is a node making routing decisions. Nodes and networks are uniquely identified and path selection decisions are made by routers to support transmission or transportation. The Network layer deals with addressing and routing. IPv4 uniquely identifies nodes and networks with a 32-bit address delimited by a subnet mask.

Transportation Layer

Transportation between two nodes can fail because of the network dynamics. Depending on applications and users’ needs, control mechanisms may be optionally applied to ensure the reliability of data transmission. TCP is a reliable version of the transmission, while UDP is an unreliable one. Both of them provide services for software applications to connect to each other through the so-called “ports.” A TCP Port 80 is a well-known port number reserved for applications that provide HTTP services, e.g., the web server.

Session Layer

Applications are, in fact, agents of users. It is the users that communicate with each other through software applications. A session is a dialog between users who use applications as agents to communicate.

Presentation Layer

User messages shall be encoded, formatted, recorded, expressed, and transmitted consistently. In other words, they shall be presented so much so readable to all machines. It may or may not compressed for performance or encrypted for security.

Application Layer

Applications solve problems and create values for people. They should be friendly and meaningful to users. The style of windows, scroll bars, and buttons are de facto protocols for the graphical user interface. SMTP commands, such as HELO, RCPT TO, DATA FROM, etc., can be viewed as a command-line interface (CLI). HTML and XML impose semantics and rules on data that are readable to humans.

Multilevel Security

Multilevel security is a security policy that allows you to classify objects and users based on a system of hierarchical security levels and a system of non-hierarchical security categories.

Multilevel security provides the capability to prevent unauthorized users from accessing information at a higher classification than their authorization, and prevents users from declassifying information.

Multilevel security offers the following advantages:

• Multilevel security enforcement is mandatory and automatic.
• Multilevel security can use methods that are difficult to express through traditional SQL views or queries.
• Multilevel security does not rely on special views or database variables to provide row-level security control.
• Multilevel security controls are consistent and integrated across the system, so that you can avoid defining users and authorizations more than once.
• Multilevel security does not allow users to declassify information.

Source: IBM

What is a multilevel database?

Here is a link to pages that describe multilevel databases from Security in Computing By Shari Lawrence Pfleeger at Google Books.

Briefly, a multilevel database provides granular security for data depending on the sensitivity of the data field and clearance of the user for both writing and reading data.

Source: serverfault

Multi-level security in database management systems

Multi-level secure database management system (MLS-DBMS) security requirements are defined in terms of the view of the database presented to users with different authorizations.

These security requirements are intended to be consistent with DoD secure computing system requirements. An informal security policy for a multi-level secure database management system is outlined, and mechanisms are introduced that support the policy.

Security constraints are the mechanism for defining classification rules, and query modification is the mechanism for implementing the classification policy. These mechanisms ensure that responses to users’ queries can be assigned classifications which will make them observable to the querying users.

Source: ScienceDirect

Multilevel Database

The first formulation of multilevel mandatory policies and the Bell LaPadulamodel, simply assumed the existence of objects (information containers) to which a classification is assigned. This assumption works well in the operating system context, where objects to be protected are essentially files containing the data. Later studies investigated the extension of mandatory policies to database systems. While in operating systems security classes are assigned to files, database systems can afford a finer-grained classification. Classification can in fact be considered at the level of relations (equivalent to file-level classification in OS), at the level of columns (different properties can have a different classification), at the level of rows (properties referred to…

Source: Springer Link

MAC Security Issues

• Inference: Derivation of new information from known information. The inference problem refers to the fact that the derived information may be classified at a level for which the user is not cleared. The inference problem is that of users deducing unauthorized information from the legitimate information they acquire.
• Aggregation: The result of assembling or combining distinct units of data when handling sensitive information. Aggregation of data at one sensitivity level may result in the total data being designated at a higher sensitivity level.
• Polyinstantiation: Polyinstantiation allows a relation to contain multiple rows with the same primary key; the multiple instances are distinguished by their security levels.
• Referential integrity: A database has referential integrity if all foreign keys reference existing primary keys.
• Entity integrity: A tuple in a relation cannot have a null value for any of the primary key attributes.
• Granularity: The degree to which access to objects can be restricted. Granularity can be applied to both the actions allowable on objects, as well as to the users allowed to perform those actions on the object.

Source: NIST SP 800-8 (obsoleted)

References

• MAC Security Issues

Secret and Authenticator

Effective digital authentication may entail several factors, or better known as authentication factors. The “secret” authenticates the subject (or claimant) to the verifier. An “authenticator” is the device, possessed or controlled by the subject, that contains or carries the secret.

Authentication Factors

Authentication factors are typically distinguished in terms of how the authenticators are presented. For example,

• The password memorized in your brain.
• A private key stored in a device (e.g., ID badge, token, smart card, mobile phone, etc.)
• Biometric characteristics inherited in your body (e.g., fingerprints, signature dynamics, iris patterns, etc.)

In a narrow sense, the password is a secret, and the brain is the authenticator. However, as we cannot present our “brain,” we offer the password only. So, it’s not uncommon for people to treat the password as the authenticator itself. The private key is the secret; because its length is too long for you to memorize, you store it in a smart card as the authenticator.

According to the above definitions, we can conclude the following well-known authentication factors:

• Something you know: the secrets memorized in your brain
• Something you have: the secrets stored in the authenticator
• Something you are: the secrets (biometric characteristics) you inherit in your body

Multi-Factor Authentication (MFA)

Multi-factor authentication is an authentication method in which a subject is authenticated through two or more authentication factors. A bank card protected by a PIN code is a well-known MFA example. You have to possess the bank card and know the PIN code to withdraw money from the ATM.

Two-step Authentication

Two-step authentication is a specialized form of MFA, which incorporates two factors: something you know and something you have.

• The first step is typically a traditional login (something you know).
• The second step is sending the authentication code or one-time password (OTP) to a device possessed by the user (something you have) through an out-of-band mechanism (e.g., SMS, APP notification, or email).

Is OTP a Something-you-know Factor?

A friend asked me this question today. My answer is NO. Instead, it is the factor, something-you-have.

A one-time-password (OTP) is typically generated randomly by a software or hardware token. It can be generated at the client-side or server-side. Users don’t have to memorize it, but they have to possess or control something to receive it.

Moreover, OTP itself is a secret, not the authenticator. An authentication factor takes both the secret and authenticator into consideration.

References

• NIST SP 800-63-3
• Authentication
• Multi-factor authentication
• Authentication Factor

Have your eagles landed?

• The Effective CISSP: Security and Risk Management
• Get Your Copy to Succeed in CISSP!
• https://wentzwu.com/buy