[Original link] System Architect (Second Edition) Study Notes----Information Encryption and Decryption Technology

Article directory

1. Component framework of information security system
2. Encryption technology
3. Access control and digital signature technology
4. Anti-attack technology for information security
5. Information security assurance system pre-assessment method

1. Component framework of information security system

1.1 Information security system composition framework

Technology System
organizational system
Management system

1.2 Technical content of information security system

Basic security equipment
computer network security
operating system security
Database security
End device security

1.3 Commonly used basic security equipment

Crypto chip
encryption card
ID card

1.5 Operating system security content

No error configuration
No loopholes
No backdoor
No Trojan horses

1.6 Operating system security mechanism

Identification and authentication mechanism
access control mechanism
least privilege management
Trusted Path Mechanism
Operation guarantee mechanism
Storage protection mechanism
File protection mechanism
Security audit mechanism

1.7 Database security technology

Physical database integrity
Logical database integrity
element security
Auditability
Access control
Authentication
Availability
inferential control
Multi-level protection
Eliminate covert channels

1.8 Organizational system of information security system

decision-making level
Management
Execution layer

1.9 Management system of information security system

legal management
System management
Training management

2. Encryption technology

2.1 Secure communication model

2.2 Meaning of symmetric encryption algorithm

In the heaped key encryption algorithm, the encryption key and decryption key are the same, which is called the shared secret key algorithm or the heaped key algorithm.

2.3 Commonly used heap encryption algorithms

DES（Data Encryption Standard）
IDEA (International Data Encryption Algorithm)
AES（Advance Encryption Standard）

2.4 The meaning of asymmetric encryption algorithm

Asymmetric encryption algorithms always use different encryption keys and decryption keys, becoming unshared key algorithms or asymmetric key algorithms.

3. Access control and digital signature technology

3.1 Basic model of access control

main body
object
Control Strategy

3.2 Contents of access control

Certification
Control Strategy
audit

3.3 Access control implementation technology

access control matrix
access control list
Ability table
Authorization relationship table

3.4 Conditions for digital signature

The signature is trusted
Signature cannot be forged
Signatures cannot be reused
Signed files are immutable
The signature is non-repudiable

4. Anti-attack technology for information security

4.1 Selection of secret key

Increase key space
Choose a strong key
Key randomness

4.2 Traditional denial of service attack types

Consume resources
Destroy or change configuration information
Physically destroy or alter network components
Exploiting processing errors in the service program to disable the service

4.3 Common types of denial of service attacks on resources

Denial of service attacks on network connections
Consumes disk space
Consumes CPU resources and memory resources

4.4 The phenomenon of distributed denial of service and DDos

There are a large number of waiting TCP connections on the attacked host.
A large number of data packets arrive that are not part of the website service connection and often point to arbitrary ports on the machine.
The network in China and Europe is flooded with a large number of data packets, and the original address is fake
Produce high traffic of useless data to cause network congestion, making the victim host unable to communicate with the outside world normally.
Taking advantage of the service and transmission protocol provided by the victim host, it sends service requests, making it impossible for the victim host to process all normal requests in a timely manner.
In severe cases, it may cause a crash

4.5 DDos three-level control model

4.6 Defense methods against denial of service attacks

Enhance feature identification of data packets
Set up a firewall to monitor localhost port usage
Statistics on the amount of communication data can also provide information about the location and quantity of attacking systems.
Correct discovered problems and system bugs as much as possible

4.6 Preventive measures against ARP spoofing

Solidify ARP table to prevent ARP spoofing
Use ARP server
Use two-way binding to solve and prevent ARP spoofing
ARP protection software-ARP Guard

4.7 Detection of DNS spoofing

Passive listening detection
False packet detection
cross check query

4.8 Purpose of port scanning

Determine which services are open on the target host
Determine the operating system of the target host

4.9 Classification of port scanning principles

Full TCP connection
Semi-open scanning (SYN scan)
FIN scan
Third-party scanning

4.10 Attack methods on the TCP/IP stack

SYN Flooding
ICMP attack
SNMP attack

4.11 Types of system vulnerability scanning

Network-based vulnerability scanning
Host-based vulnerability scanning

4.12 Components of a network-based vulnerability scanner

Vulnerability database module
User configuration console module
scan engine module
Currently active scanning knowledge module
Result storage and report generation tools

4.13 Advantages of network vulnerability scanning

Network-based vulnerability scanners are relatively inexpensive
Network-based vulnerability scanner does not require administrators of the target system to operate
Network-based vulnerability scanner does not require anything to be installed on the target system during the detection process
Easy maintenance

4.14 Advantages of host-based vulnerability scanning

High number of vulnerabilities scanned
Centralized management
Low network traffic load

5. Information security assurance system pre-assessment method

5.1 Level of security protection provided for computer information

Level 1: User independent protection level (corresponding to TESEC level C1)
Level 2: System audit protection level (corresponding to TCSEC level C2)
Level 3: Safety mark protection level (corresponding to TESEC level B1)
Level 4: Structural protection level (corresponding to TESEC level B2)
Level 5: Access verification protection level (corresponding to TCSEC level B3)

5.2 Security risk management

Determine the scope of the breakout assessment
Determine the objectives of the risk assessment
Establish appropriate organizational structure
Establish a systematic risk assessment approach
Obtain top management approval for risk assessment planning

5.3 Basic elements of risk assessment

vulnerability
assets
threaten
risk
security measures

5.4 Relationship diagram of various elements of risk assessment

5.5 Risk calculation process

Identify information assets and assign values to them
Analyze threats and assign a value to the likelihood of their occurrence
Identify the vulnerabilities of information assets and assign a severity value to the weaknesses
Calculate the likelihood of a security incident based on threats and vulnerabilities
Calculate the risk value of information assets based on the importance of information assets and the possibility of security incidents.

System Architect (Second Edition) Study Notes—Information Security Systems and Information Security Technology