Security Architecture and Engineering practice questions

CT logs

Why wrong: Certificate Transparency (CT) logs are public, append-only records of all certificates issued by participating Certificate Authorities. Their primary purpose is to provide an auditing mechanism to detect misissued certificates and enhance trust in the CA ecosystem, rather than providing real-time revocation status during a client-server connection. While they can eventually reveal a revoked certificate if its issuance was suspicious, they do not offer an immediate, on-demand check for a certificate's current validity status.

Certificate pinning

Why wrong: Certificate pinning is a security mechanism where a client pre-associates a specific host with its expected public key or certificate. This helps prevent Man-in-the-Middle (MITM) attacks by ensuring that only a trusted certificate is accepted for a given domain, even if a rogue Certificate Authority issues an unauthorized certificate. However, pinning itself does not actively check the revocation status of the pinned certificate; if the pinned certificate is later revoked, the client will continue to trust it unless another revocation checking mechanism is also employed.

CRL distribution points

Why wrong: CRL distribution points (CDPs) provide locations from which clients can download Certificate Revocation Lists (CRLs), which are lists of certificates that have been revoked by a Certificate Authority. Clients periodically download and cache these lists to check if a certificate is present, but this process is not real-time. There is an inherent delay between when a certificate is revoked and when the updated CRL is published and subsequently downloaded by clients, making it unsuitable for immediate revocation status verification during a connection.

User roles

Why wrong: In the Clark-Wilson integrity model, explicit "user roles" as a primary architectural component are not directly defined. Instead, the model focuses on the integrity of data items and the certified procedures that manipulate them. Separation of duties and access control are enforced through the concept of Transformation Procedures (TPs) and the access triples (user, TP, CDI), which dictate who can execute specific TPs on particular data, rather than relying on a role-based access control system as a core architectural element.

Unconstrained Data Items (UDIs)

Why wrong: Unconstrained Data Items (UDIs) are data inputs that originate from external sources and have not yet been subjected to the integrity controls of the Clark-Wilson model. While they are necessary for system operation as raw input, UDIs are not considered core components of the *integrity model* itself because their integrity is not guaranteed or controlled by the model's mechanisms. They must be validated and transformed by a certified Transformation Procedure (TP) before they can become a Constrained Data Item (CDI).

Simple Security Property

Why wrong: The Simple Security Property, also known as "no read down," is a fundamental rule within the Bell-LaPadula confidentiality model. It dictates that a subject at a given security level cannot read an object at a lower security level. This property is entirely focused on preventing unauthorized disclosure of information, which contrasts sharply with the Clark-Wilson model's primary objective of maintaining data integrity.

Lattice-based access control

Why wrong: Lattice-based access control (LBAC) is a mathematical framework often employed in Mandatory Access Control (MAC) models, such as Bell-LaPadula or Biba, to define a partial ordering of security labels. It establishes a hierarchy of security levels and their relationships, governing information flow based on these classifications. While powerful for enforcing strict confidentiality or integrity policies in MAC environments, LBAC is not a core component or defining characteristic of the Clark-Wilson integrity model, which relies on different mechanisms.

No Write Up property

Why wrong: The "No Write Up" property is a key rule within the Biba integrity model, stating that a subject cannot write to an object at a higher integrity level. This rule, also known as the "*-integrity property," prevents subjects from corrupting data at higher integrity classifications. While both Biba and Clark-Wilson are integrity models, this specific property is unique to Biba's integrity levels and is not a direct component of the Clark-Wilson framework.

Biba model

Why wrong: The Biba model is an integrity-focused access control model, contrasting directly with confidentiality models like Bell-LaPadula, and is not suitable when confidentiality is the primary concern. Its primary goal is to prevent data corruption by enforcing two key rules: the "simple integrity property" (no read down), which prevents subjects from reading data at a lower integrity level, and the "*-integrity property" (no write up), which prevents subjects from writing to a higher integrity level. This ensures that high-integrity data is not contaminated by low-integrity data, making it suitable for systems where data accuracy is paramount.

Brewer-Nash model

Why wrong: The Brewer-Nash model, also known as the Chinese Wall model, is designed to prevent conflicts of interest by dynamically adjusting access permissions based on a subject's prior access history. It ensures that a user who has accessed information related to one client or company cannot subsequently access information related to a competing client or company within the same conflict-of-interest class. This model is distinct from classification-based models as it focuses on ethical separation and preventing information flow between competing entities, rather than strict hierarchical confidentiality levels.

Clark-Wilson model

Why wrong: The Clark-Wilson model is an integrity model specifically tailored for commercial applications, emphasizing well-formed transactions and separation of duties to maintain data consistency and prevent fraud. It uses constrained data items (CDIs) that can only be modified by certified transformation procedures (TPs), which are subject to integrity verification procedures (IVPs) and certification rules. This robust framework ensures that data integrity is preserved through controlled operations, preventing unauthorized or erroneous modifications in business processes.

Bell-LaPadula

Why wrong: The Bell-LaPadula model is primarily concerned with confidentiality, preventing unauthorized disclosure of information. It enforces two main rules: the Simple Security Property (no read up) and the *-Property (no write down). These rules ensure that information flows only from lower to higher classification levels, thereby protecting sensitive data from being accessed by subjects at lower security levels, which is the inverse of an integrity requirement.

Graham-Denning

Why wrong: The Graham-Denning model is a foundational access control matrix model that defines a set of eight primitive protection rights or operations. These operations describe how subjects can create or delete subjects and objects, and how they can grant, delete, or transfer access rights. It provides a framework for specifying and managing access control policies, but it does not inherently enforce specific integrity or confidentiality rules like 'no write up' or 'no read down'.

Clark-Wilson

Why wrong: The Clark-Wilson model focuses on maintaining data integrity through well-formed transactions and separation of duties. It uses certification rules and integrity verification procedures to ensure that data items are modified only by authorized transformation procedures, which are executed by authorized users. This model distinguishes between constrained data items (CDIs) and unconstrained data items (UDIs) to enforce strict controls over data modification, aiming to prevent fraud and errors rather than protecting against information flow in a lattice-based manner.

MAC

Why wrong: Mandatory Access Control (MAC) is a highly structured access control model where the operating system or security kernel enforces a system-wide security policy. Access decisions are based on security labels assigned to subjects (users/processes) and objects (files/resources), representing their classification and clearance levels. Data owners have no discretion to grant or revoke access; all permissions are centrally managed and strictly enforced by the system, preventing unauthorized information flow. This model prioritizes confidentiality and integrity in high-security environments.

RBAC

Why wrong: Role-Based Access Control (RBAC) grants permissions based on a user's assigned role within an organization, rather than individual identity or object ownership. Permissions are defined for specific roles (e.g., "Administrator," "Auditor," "User"), and users acquire those permissions by being assigned to one or more roles. While administrators manage role assignments, individual data owners do not have the authority to directly grant or revoke access to their data; access is determined by the roles a user holds and the permissions associated with those roles.

ABAC

Why wrong: Attribute-Based Access Control (ABAC) makes access decisions dynamically by evaluating a set of attributes associated with the subject (user), object (resource), action (what is being done), and environment (context). A policy engine evaluates these attributes against defined policies to determine access. While ABAC offers highly granular and flexible control, the decision-making logic is based on predefined policies and attribute values, not the direct discretionary authority of a data owner to grant or revoke specific permissions on a per-user basis.

RC4

Why wrong: RC4 is a stream cipher, meaning it encrypts data bit by bit or byte by byte, rather than in fixed-size blocks. While historically used for its speed, RC4 has known cryptographic vulnerabilities, including biases in its key stream and susceptibility to related-key attacks. These significant security flaws make it unsuitable for modern secure applications, leading to its deprecation in protocols like WEP and TLS.

RSA

Why wrong: RSA is an asymmetric cryptographic algorithm, utilizing a pair of mathematically linked public and private keys. Its primary applications include secure key exchange, digital signatures, and encrypting small amounts of data, such as symmetric keys. Due to its computational intensity, which involves complex mathematical operations on large prime numbers, RSA is prohibitively slow and inefficient for encrypting large volumes of "bulk data," making symmetric ciphers the preferred choice for such tasks.

3DES

Why wrong: Triple DES (3DES or TDES) is a symmetric block cipher that applies the original DES algorithm three times to each 64-bit data block, typically using two or three distinct keys to enhance security. While it provides a larger effective key length than single DES, its smaller 64-bit block size and inherent computational overhead make it significantly slower and less efficient than modern ciphers like AES. NIST officially deprecated 3DES in 2017, recommending a transition to AES due to its susceptibility to meet-in-the-middle attacks and performance limitations.

SafeSEH

Why wrong: SafeSEH (Safe Structured Exception Handling) is a compiler and linker feature designed to protect against exploits that overwrite Structured Exception Handler (SEH) records on the stack. It works by creating a list of valid exception handlers during compilation, which the operating system then validates against when an exception occurs. If an attempt is made to invoke an exception handler not on the approved list, the program terminates, preventing an attacker from redirecting execution flow via a corrupted SEH chain. This mechanism focuses on the integrity of exception handling, not the randomization of memory addresses.

Stack canaries

Why wrong: Stack canaries are a buffer overflow protection mechanism where a small, secret value (the "canary") is placed on the stack between local variables and control data, such as the return address. Before a function returns, the program checks if this canary value has been altered. If the canary has been overwritten, it indicates a buffer overflow has occurred, and the program is typically terminated to prevent potential exploitation. While effective at detecting stack-based overflows, this technique focuses on integrity checking rather than randomizing memory locations.

DEP/NX bit

Why wrong: Data Execution Prevention (DEP), often implemented via the NX (No-Execute) bit, is a system-level memory protection feature that marks certain memory regions as non-executable. Its primary purpose is to prevent an attacker from executing code from data segments of memory, such as the stack or heap, which are typically only intended to store data. If an attempt is made to execute code from a DEP-protected region, the system generates an exception, effectively thwarting many buffer overflow and code injection attacks. However, DEP does not randomize memory addresses; it only enforces execution permissions.

Encrypting network traffic

Why wrong: A Trusted Platform Module (TPM) is a hardware security module designed for platform integrity and secure key storage, not for the real-time encryption and decryption of network traffic. Network encryption, such as that provided by TLS (Transport Layer Security) or IPsec (Internet Protocol Security), operates at higher layers of the network stack and is typically handled by software libraries or dedicated network hardware. While a TPM can securely store the cryptographic keys used by TLS or IPsec, it does not directly perform the ongoing data encryption or decryption for network communications.

Providing antivirus protection

Why wrong: Providing antivirus protection is a function of specialized software applications designed to detect, prevent, and remove malicious software from a computer system. A Trusted Platform Module (TPM), conversely, is a hardware component embedded in a computer system that focuses on platform integrity, secure boot processes, and cryptographic operations. While a TPM can contribute to a more secure system environment that makes it harder for malware to persist, it does not actively scan for, identify, or remediate viruses or other forms of malware.

Enforcing access control policies

Why wrong: Enforcing access control policies is primarily the responsibility of the operating system's security kernel or dedicated access control mechanisms, which determine user and process permissions to system resources. A Trusted Platform Module (TPM) does not directly manage user identities or resource permissions within an operating system. While a TPM can contribute to the overall security posture by ensuring system integrity and securely storing authentication credentials, it does not actively grant or deny access to files, directories, or system functions based on defined policies.

Virtual machine monitor

Why wrong: A Virtual Machine Monitor (VMM) is a generic term for the software component that creates and runs virtual machines. While a hypervisor is a type of VMM, this term is too broad and does not specify the architectural type (e.g., Type 1 or Type 2) that is crucial for evaluating specific security implications. A security architect needs to consider the specific implementation details, which a generic VMM designation does not provide.

Containers

Why wrong: Containers are a form of operating-system-level virtualization where multiple isolated user-space instances (containers) share the host operating system's kernel. Unlike hypervisors, containers do not virtualize hardware or run separate guest operating systems, meaning they lack the strong isolation boundaries provided by a hypervisor. Therefore, containers represent a fundamentally different virtualization technology with distinct security considerations, not a hypervisor type.

Type 2 hypervisor

Why wrong: A Type 2 hypervisor, or hosted hypervisor, runs as an application on top of a conventional operating system. This architecture introduces additional layers, including the host OS, its drivers, and other applications, all of which can introduce potential vulnerabilities and expand the attack surface. The security of the virtualized environment becomes dependent on the security of the underlying host operating system, making it less secure for high-assurance environments.

TEMPEST

Why wrong: TEMPEST is a U.S. National Security Agency specification and a NATO certification that refers to the study and control of spurious electromagnetic signals emitted by electronic equipment. Its primary goal is to prevent the interception and reconstruction of sensitive data from these emanations, which could be exploited by adversaries. While critical for securing classified information systems, TEMPEST does not directly address physical security design principles for deterring crime through environmental design.

Fail-safe

Why wrong: A fail-safe design principle ensures that in the event of a system failure or power loss, the system defaults to a secure state, often meaning doors unlock or systems shut down safely. This principle prioritizes safety and security during abnormal conditions, preventing unauthorized access or harm when controls fail. However, it is a response mechanism to failure rather than a proactive design strategy focused on deterring criminal activity through environmental manipulation.

Layered defense

Why wrong: Layered defense, also known as defense-in-depth, involves implementing multiple security controls and countermeasures in a series, creating successive barriers that an attacker must overcome. This approach aims to slow down or deter an adversary by requiring them to defeat several different types of security measures, such as fences, guards, alarms, and access controls. While it incorporates physical controls, it is a broader strategy for combining various security elements rather than a specific design principle focused on using the built environment itself to influence behavior and prevent crime.

Covert channel

Why wrong: A covert channel is a method for an entity to transfer information in a manner that violates the system's security policy but is not designed for information transfer. These channels exploit legitimate system resources, such as file locks or CPU timing, to surreptitiously communicate data between processes that are not supposed to interact. While they leak information, the question describes an application allowing a user to do something, which typically points to an authorization or race condition flaw, not a hidden communication path.

Buffer overflow

Why wrong: A buffer overflow occurs when a program attempts to write data to a fixed-size memory buffer, but the input data exceeds the buffer's capacity. This excess data then overwrites adjacent memory locations, potentially corrupting data, altering program control flow, or executing arbitrary code. The scenario described, where an application "allows a user" to perform an action, typically indicates a logical flaw in authorization or state management, not a memory boundary violation.

Side-channel attack

Why wrong: A side-channel attack involves extracting sensitive information by observing the physical implementation of a cryptosystem or other secure computation, rather than directly attacking the algorithm itself. Attackers analyze characteristics such as power consumption, electromagnetic emissions, acoustic emanations, or execution timing to infer secret keys or data. The question describes a direct application vulnerability where a user is "allowed" an action, which is a logical flaw, not an inference based on physical characteristics.

Clark-Wilson

Why wrong: The Clark-Wilson integrity model is designed to maintain data integrity in commercial applications by enforcing well-formed transactions and separation of duties. It uses certification rules to ensure transformation procedures (TPs) are valid and enforcement rules to ensure subjects only access constrained data items (CDIs) via authorized TPs. This prevents unauthorized modification and ensures data consistency, which is distinct from preventing conflicts of interest.

Biba

Why wrong: The Biba integrity model prioritizes data integrity by preventing subjects from corrupting data at higher integrity levels. Its core rules, 'no write down' (simple integrity property) and 'no read up' (* integrity property), ensure that information flows only from lower to higher integrity levels. This prevents untrusted subjects from modifying critical data or reading data from less trusted sources, thereby protecting against data contamination.

Bell-LaPadula

Why wrong: The Bell-LaPadula model is a state machine model primarily focused on enforcing confidentiality in military and government systems. It employs two fundamental rules: the 'simple security property' (no read up) and the '* security property' (no write down), which prevent subjects from accessing information at a higher classification level or writing information to a lower classification level. This strict information flow control is designed to prevent unauthorized disclosure of sensitive data.

Trusted platform module

Why wrong: The Trusted Platform Module (TPM) is a specialized cryptographic hardware component designed to provide hardware-rooted security functions, such as secure key storage, platform integrity measurement, and cryptographic operations. While a TPM contributes significantly to the overall trust of a system and can be considered part of a larger trusted computing system, it is not the component that implements the core access control policies of the Trusted Computing Base (TCB) itself. Its role is to establish a hardware root of trust, not to enforce all system-wide security policies.

Trusted computing base

Why wrong: The Trusted Computing Base (TCB) is the complete collection of all hardware, firmware, and software components within a system that are critical to enforcing the security policy. It represents the totality of protection mechanisms upon which the system's security depends. Therefore, the TCB is not a single component that implements anything; rather, it is the set of all components that must be trusted to maintain the system's security posture, with the security kernel being a crucial part of it.

Reference monitor

Why wrong: The reference monitor is an abstract conceptual model that dictates how all access requests between subjects and objects in a system are mediated and controlled according to a defined security policy. It specifies the rules for access control and ensures that no unauthorized operations occur. However, the reference monitor itself is not a physical or software component; it is a design principle or a theoretical construct, and thus cannot be the component that implements the TCB.

Clark-Wilson

Why wrong: Clark-Wilson is fundamentally an integrity model, not an access control model. Its primary objective is to maintain data integrity by preventing unauthorized modifications and ensuring internal and external consistency through well-formed transactions and separation of duties. While it dictates how data can be manipulated, it does not define the general rules for who can access what resources based on roles or attributes, which is the core function of an access control model.

MAC

Why wrong: Mandatory Access Control (MAC) operates on a strict, system-enforced policy where subjects and objects are assigned security labels, such as sensitivity levels and categories. Access is granted or denied based on a comparison of these labels, adhering to rules like "no read down" and "no write up." This model does not utilize roles or dynamic attributes for decision-making; instead, it relies on a rigid, predefined classification scheme enforced by the operating system or security kernel.

DAC

Why wrong: Discretionary Access Control (DAC) allows the owner of a resource to determine who can access it and what permissions they have. This model provides high flexibility for individual users but lacks centralized control and can lead to inconsistent security policies across an enterprise. DAC is generally unsuitable for environments requiring dynamic, organization-wide rules based on attributes, as it relies on individual discretion rather than a centrally enforced policy.

TOCTOU

Why wrong: Time-of-Check to Time-of-Use (TOCTOU) is a race condition where a system's state is checked, but then changes before the check's result is used, leading to a vulnerability. This typically involves an attacker exploiting a window between a security check and an action, rather than establishing a hidden communication path. Therefore, TOCTOU is a flaw in concurrency control, not a mechanism for covert information transfer.

Emanations

Why wrong: Emanations refer to unintentional physical emissions from electronic devices, such as electromagnetic radiation, acoustic noise, or thermal variations, which can inadvertently leak sensitive information. These are typically exploited via techniques like TEMPEST to reconstruct data without direct access to the system. Unlike covert channels, emanations are passive, unintended by the system's design, and do not involve active modulation by a sender to transmit data.

Side-channel

Why wrong: A side-channel attack exploits information leaked unintentionally through the physical implementation of a cryptosystem or other secure component, rather than through a logical flaw in its algorithm. Examples include analyzing power consumption, electromagnetic radiation, or execution time to infer secret keys or data. While covert channels are *intentional* hidden communication paths established by malicious actors, side-channels are *unintentional* information leakages that attackers merely observe and exploit.

Antivirus software

Why wrong: Antivirus software is a prime example of a technical or logical control, not a physical one. It operates at the software layer of an endpoint, scanning for malicious code and protecting data integrity and system availability, rather than physically restricting access to a facility or hardware.

Intrusion detection system on the network

Why wrong: An Intrusion Detection System (IDS) on the network is a technical control designed to monitor network traffic for suspicious patterns or policy violations. While vital for detecting cyber threats and a key component of defense in depth, it does not physically prevent unauthorized access to a building, data center, or server equipment.

Brewer-Nash

Why wrong: The Brewer-Nash model, often referred to as the Chinese Wall model, is specifically designed to prevent conflicts of interest within organizations, particularly in financial or consulting sectors. It dynamically separates users from accessing information that could create a conflict, such as a consultant working for two competing clients. This model focuses on preventing a single individual from accessing information from competing datasets, rather than enforcing hierarchical confidentiality levels.

Clark-Wilson

Why wrong: The Clark-Wilson security model is primarily concerned with data integrity, ensuring that data remains accurate and consistent through controlled access and well-formed transactions. It employs concepts like constrained data items (CDIs), transformation procedures (TPs), and integrity verification procedures (IVPs) to maintain data integrity. This model emphasizes separation of duties and auditing to prevent unauthorized modification, making it unsuitable for addressing confidentiality requirements in a hierarchical classification system.

Biba

Why wrong: The Biba security model is exclusively focused on ensuring data integrity, aiming to prevent unauthorized modification or corruption of information. It operates with two main rules: the Simple Integrity Axiom (no read down) and the *-Integrity Axiom (no write up), which are the inverse of Bell-LaPadula's rules. This model ensures that subjects cannot write to objects of a higher integrity level or read objects of a lower integrity level, thereby protecting data from contamination by less trusted sources, but it does not address confidentiality.

Integrity

Why wrong: While integrity is a critical security objective, the Bell-LaPadula model, which is implied by the 'no read up, no write down' rules, does not prioritize it. Instead, Bell-LaPadula focuses on preventing unauthorized disclosure of information, which is confidentiality. The Biba model, conversely, is specifically designed to maintain data integrity by preventing subjects from writing to higher integrity levels or reading from lower integrity levels, thereby protecting data from contamination.

Accountability

Why wrong: Accountability is the ability to trace actions back to an individual or entity, ensuring non-repudiation and responsibility for their activities. This is primarily achieved through robust auditing, logging, and monitoring mechanisms that record user activities and system events. Access control models like Bell-LaPadula define *what* actions are permissible based on security classifications, but they do not inherently provide the logging infrastructure necessary to establish accountability for those actions.

Availability

Why wrong: Availability ensures that authorized users can access information and resources when needed, without undue delay or interruption. This security principle is typically addressed through redundant systems, fault tolerance, disaster recovery planning, and protection against denial-of-service attacks. The Bell-LaPadula model, focused on preventing unauthorized information disclosure, does not directly contribute to the continuous operational state or resilience of a system, which are core tenets of availability.

Biba

Why wrong: The Biba integrity model primarily focuses on preventing subjects from writing to objects at a lower integrity level (no write down) and reading from objects at a higher integrity level (no read up). While effective for maintaining data integrity levels and preventing unauthorized data corruption, it does not inherently define mechanisms for validating the structure or business logic of financial transactions. Consequently, Biba does not explicitly address the requirements for well-formed transactions or the enforcement of separation of duties within application processes.

Brewer-Nash

Why wrong: The Brewer-Nash model, also known as the Chinese Wall policy, is designed to prevent conflicts of interest by restricting a subject's access to information based on their prior access history. Once a subject accesses data related to one company within a conflict-of-interest class, they are prevented from accessing data related to competing companies in that same class. This model does not, however, provide mechanisms for ensuring the internal consistency, validity, or proper execution of financial transactions themselves.

Bell-LaPadula

Why wrong: The Bell-LaPadula model is a foundational security model primarily focused on enforcing confidentiality in multi-level security systems. It prevents unauthorized information flow from higher security levels to lower ones through its 'no read up' (Simple Security Property) and 'no write down' (*-property) rules. While crucial for protecting classified data, this model does not inherently address the integrity of transactions or the proper execution of business processes, which are central to ensuring well-formed financial operations.