IdeaWazaWiki

Defense strategy (computing): Difference between revisions

Waza (talk | contribs)

1 user group
1,042 edits
Defense strategy (in computing)
 
Cleanup: remove deletion notice and missing templates
 
(97 intermediate revisions by 52 users not shown)
Line 1: Line 1:
In computing, '''defense strategy''' is a concept and practice used by computer designers, users, and IT personnel to reduce [[computer security]] risks.<ref>{{cite book|title=Formalizing Agents' Beliefs for Cyber-Security Defense Strategy Planning|series=Advances in Intelligent Systems and Computing|year=2015|url=https://www.ifis.uni-luebeck.de/uploads/tx_wapublications/martiny-motzek-cisis-pdt-public.pdf|doi=10.1007/978-3-319-19713-5_2|last1=Martiny|first1=Karsten|last2=Motzek|first2=Alexander|last3=Möller|first3=Ralf|volume=369|pages=15–25|isbn=978-3-319-19712-8|s2cid=18198176 }}</ref>


'''Defense strategy (in computing)''' is a concept, form of practice for computer designers, users, IT personnel to help reduce the risk of [[computer security]] or cybersecurity problems.
==Common strategies==


==Common Strategies==
=== Boundary protection ===
Boundary protection employs security measures and devices to prevent unauthorized access to computer systems (referred to as controlling the system border). The approach is based on the assumption that the attacker did not penetrate the system. Examples of this strategy include using [[Gateway (telecommunications)|gateways]], [[Router (computing)|routers]], [[Firewall (computing)|firewalls]], and [[password]] checks, deleting suspicious emails/messages, and limiting physical access.


'''Boundary protection''' - strategy employing different security measures and devices preventing unauthorized access to computer system (controlling system border). Approach is based on assumption that attacked did not penetrated system.
Boundary protection is typically the main strategy for computing systems; if this type of defense is successful, no other strategies are required. This is a resource-consuming strategy with a known scope. External information system monitoring is part of boundary protection.<ref>{{Cite web|url=https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search|title=Release Search - NIST Risk Management Framework &#124; CSRC &#124; CSRC|first=Information Technology Laboratory|last=Computer Security Division|date=November 30, 2016|website=CSRC &#124; NIST}}</ref>


Examples of this strategy are using of [[Firewall (computing)]], [[password]] check, deleting suspicious mails / messages, using gateways, routers and limiting physical access.<ref> SC-7 BOUNDARY PROTECTION, NIST Special Publication 800-53 [https://nvd.nist.gov/800-53/Rev4/control/SC-7]</ref>
=== Information System Monitoring ===
Information System Monitoring employs security measures to find intruders or the damage done by them. This strategy is used when the system has been penetrated, but the intruder did not gain full control. Examples of this strategy include [[antivirus software]], applying a [[Patch (computing)|patch]], and [[network behavior anomaly detection]].


''' Information System Monitoring '''- strategy performing different security measures finding intruder or damage done by intruder. Strategy based on assumption that system is penetrated, but intruder did not gained full control.<ref> SI-4 INFORMATION SYSTEM MONITORING, NIST Special Publication 800-53[https://nvd.nist.gov/800-53/Rev4/control/SI-4]</ref>
This strategy's success is based on competition of offence and defence. This is a time and resource-consuming strategy, affecting performance. The scope is variable in time. It cannot be fully successful if not supported by other strategies.


Examples of this strategy are using of [[antivirus software]], using [[Patch (computing)]].
=== Secure enclave ===
Secure enclave is a strategy that employs security measures that prevent access to some parts of the system. This strategy is used when the system has been penetrated, but an intruder cannot access its special parts. Examples of this strategy include using the [[Access level]], using a [[Trusted Platform Module]], using a [[microkernel]], using Diode (unidirectional network device), and using [[Air gap (networking)|air gaps]].


'''Unavoidable actions''' - strategy performing different security measures that cannot be prevented or neutralized. . Strategy based on assumption that system is penetrated, but intruder cannot access defensive mechanism.
This is a supporting strategy for boundary protection, information system monitoring and unavoidable action strategies. This is a time and resource-consuming strategy with a known scope. Even if this strategy is fully successful, it does not guarantee the overall success of the larger defense strategy.


Examples of this strategy are computer [[reboot]], using [[Physical unclonable function]], and using [[Security switch]].
=== False target ===
False target is a strategy that deploys non-real targets for an intruder. It is used when the system has been penetrated, but the intruder does not know the system architecture. Examples of this strategy include [[Honeypot (computing)|honeypots]], [[Virtual Computer|virtual computers]], [[virtual security switch]]es, fake files, and address/password copies.


'''Secure enclave '''- strategy performing different security measures preventing access to some parts of system. Strategy based on assumption that system is penetrated, but intruder cannot access its special parts.
This is a supporting strategy for information system monitoring. It is a time-consuming strategy, and the scope is determined by the designer. It cannot be fully successful if not supported by other strategies.


Examples of this strategy are using of [[Access level]], using [[Trusted Platform Module]], using [[microkernel]], usign Diode (unidirectional network device).
=== Moving target ===
Moving target is a security strategy based on frequent changes of data and processes. This strategy is based on the assumption that the system has been penetrated, but the intruder does not know the architecture of the system and its processes. Examples of this strategy are regular changes of [[password]]s or [[Key (cryptography)|keys (cryptography)]], using a dynamic platform, etc.


'''False target ''' – strategy of preparing non- real target for intruder. Strategy based on assumption that system is penetrated, but intruder does not know system architecture.
This is a supporting strategy for information system monitoring. It is a time-consuming strategy, and the scope is determined by the designer. It cannot be fully successful if not supported by other strategies. Actions are activated on a scheduled basis or as a response to a detected threat.


Example of this strategy is [[honeypot]], [[Virtual Computer]], [[Virtual security switch]], fake files, addresses / passwords copies.
=== Useless information ===
Useless information comprises  security measures to turn important information into useless data for an intruder. The strategy is based on the assumption that the system has been penetrated, but the intruder is not able to decrypt information, or does not have enough time to decrypt it. For example, [[Encrypting File System|encrypting the file system]] or using [[encryption software]] can render the data useless even if an attacker gets access to the file system, or using [[data masking]], where sensitive data is hidden in non-sensitive data with modified content.


'''Moving target '''- strategy performing different security measures of changing data, processes. . Strategy based on assumption that system is penetrated, but intruder does not know system architecture, processes.
This is a supporting strategy for information system monitoring. It is a time and resource-consuming strategy, affecting performance. The scope is known. It cannot be successful if not supported by other strategies. [[Claude Shannon]]'s theorems show that if the encryption key is smaller than the secured information, the [[information-theoretic security]] can not be achieved. There is only one known unbreakable cryptographic system: the [[one-time pad]]. This strategy is not generally possible to use because of the difficulties involved in exchanging one-time pads without the risk of being compromised. Other cryptographic systems are only buying time or can be broken (see [[Cryptographic hash function#Degree_of_difficulty]]). This strategy needs to be supported by the moving target or deletes strategies.


Example of this strategy is changing [[password]], changing [[Key (cryptography)]], using Dynamic Platform <ref> Moving Target Techniques: Leveraging Uncertainty for Cyber Defense, [https://www.ll.mit.edu/sites/default/files/page/doc/2018-05/22_1_8_Okhravi.pdf]</ref>
=== Deletion ===
Deletion is a strategy using  security measures to prevent an intruder from gaining sensitive information at all costs. The strategy is based on the assumption that the damage from information disclosure would be greater than the damage caused by deleting the information or disabling the system required to gain access to the information. The strategy is part of the [[data-centric security]] approach. Examples of this strategy include information deletion as a response to a security violation (such as unauthorized access attempts) and [[password]] resets.


'''Useless information''' - strategy performing different security measures to make important information useless for intruder. . Strategy based on assumption that system is penetrated, but intruder is not able to decrypt information or does not have enough time to decrypt it.
This is a supporting strategy for information system monitoring. It is a resource-consuming strategy, and the scope is determined by the designer. It cannot be fully successful on its own since the detected intrusion is not quarantined.


Examples of this strategy are [[Encrypting File System]], using [[Encryption software]].
=== Information redundancy ===
Information redundancy is a strategy performing security measures to keep redundancy for information and using it in case of damage. The strategy is based on the assumption that finding and repairing the damage is more complicated than the restoration of the system. Examples of this strategy include using system restoration, keeping backup files, and using a backup computer.


''' Delete'''- strategy performing different security measures preventing intruder from gaining sensitive information at all cost. Strategy based on assumption that damage from information disclosure is more than system integrity. Assuming system may be penetrated, attempt is detected. Strategy is part of [[Data-centric security]] approach.
This is a supporting strategy for information system monitoring. This strategy consumes considerable resources, and the scope is known. It can be fully successful in its part.


Example of this strategy is information deletion as response to security violation, unauthorized access attempt.
=== Limiting of actions made by a robot ===
Limiting of actions made by a robot is a strategy performing security measures to limit a robot's ([[software bot]]) actions. The strategy is based on the assumption that a robot can take more actions, or create damage that a human cannot create. Examples of this strategy include using [[anti-spam techniques]], using [[CAPTCHA]] and other [[human presence detection]] techniques, and using [[Denial-of-service_attack#DDS_based_defense|DOS]]-based defense (protection from [[Denial-of-service attack]]).


'''Information redundancy''' -strategy performing different security measures to keep redundancy for information and using it in case of damage. Strategy based on assumption that finding and repairing of damage is more complicated than restoration of system.
This is a supporting strategy for boundary protection and information system monitoring. It is a time and resource-consuming strategy, and the scope is determined by the designer. This strategy cannot be fully successful on its own.


Examples of this strategy are using system restoration, keeping backup files, using backup computer.
=== Active defense ===
[[Active defense]] is a strategy performing security measures attacking the potential intruders. The strategy is based on the assumption that a potential intruder under attack has fewer abilities. Examples of this strategy include creating and using lists of trusted networks, devices, and applications, blocking untrusted addresses, and vendor management.


''' Limiting of actions made by robot''' - strategy performing different security measures to limit robots (software bot) actions. Strategy based on assumption that robot can make more actions or create damage that human cannot.
This is a supporting strategy for boundary protection and information system monitoring. It is a time and resource-consuming strategy, and the scope is determined by the designer. This strategy cannot be fully successful on its own.


Example of this strategy is using [[Anti-spam techniques]], using [[CAPTCHA]] and other [[Human presence detection]] techniques, using DDS based defense (protection from [[Denial-of-service attack]]).
=== Unavoidable actions ===
Unavoidable actions employ security measures that cannot be prevented or neutralized. This strategy is based on the assumption that the system has been penetrated, but an intruder cannot prevent the defensive mechanism from being employed. Examples of this strategy include [[reboot]]ing, using [[physical unclonable function]]s, and using a [[security switch]].


''' Active defense''' - strategy performing different security measures attacking potential intruder. Strategy based on assumption that potential intruder under attack have less abilities.
This strategy can support any other strategy.<ref>{{Cite web|url=https://www.pcworld.com/article/3225913/what-is-two-factor-authentication-and-which-2fa-apps-are-best.html|title=What is two-factor authentication, and which 2FA solutions are best?|date=June 5, 2019|website=PCWorld}}</ref><ref>{{Cite web|url=https://www.researchgate.net/figure/A-PUF-Based-Encryption-Scheme_fig3_314296637|title=PUF based encryption|website=www.researchgate.net}}</ref><ref>{{Cite web|url=https://hal.archives-ouvertes.fr/hal-01322882/document|title=Design and implementation of Hardware-assisted security architecture for software integrity monitoring|website=hal.archives-ouvertes.fr}}</ref><ref>{{Cite web|url=https://www.sciencedaily.com/releases/2018/02/180219141219.htm|title=Real-time Captcha technique improves biometric authentication|website=ScienceDaily}}</ref>{{clarify|date=December 2019}} This is a resource-consuming strategy, and the scope is determined by the designer. An implementation may have a wide impact on devices.<ref>{{Cite web|url=https://amosbbatto.wordpress.com/2019/08/15/adding-switches-not-simple/|title=Adding kill switches to protect your privacy is not as simple as you might think|website=amosbbatto.wordpress.com|date=August 15, 2019}}</ref> This strategy can be fully successful, but in most cases, there is a [[trade-off]] of full system functionality for security. This strategy can be used [[proactive]]ly or reactively. Actions done in response to an already detected problem may be too late.<ref>{{Cite web|url=https://arstechnica.com/cars/2019/10/should-all-connected-cars-have-a-physical-network-kill-switch/|title=Should all connected cars have a physical network kill switch?|first=Jonathan M.|last=Gitlin|date=October 18, 2019|website=Ars Technica}}</ref> Any implementation needs to be supported by the secure enclave strategy in order to prevent neutralizing action by unauthorized access to the protection mechanism.


Example of this strategy is creating and using lists of trusted networks, devices, applications, blocking addresses, Vendor Management.
Actions can be of the following types:
 
*Preventive actions – blocking certain functions, signals, peripheral devices, memory parts, and/or data transfers. For example: blocking audio/video recording, the sending of long messages, or secret memory access.
== Strategy Analysis ==
*Creative actions – activating certain functions, sending signals, messages, and/or data. For example: sending an alarm signal or message, or activating data copying or transfer.
 
*Modification actions – modifying a peripheral device's functioning, or modifying the data, signals or processes of the defended system. For example, independent hardware encryption/decryption, changing [[accelerometer]] accuracy, filtering messages or words, or changing [[state diagram]] or [[algorithm]] by independent hardware.
Boundary protection Strategy Analysis.
 
Main strategy for computing system, if this type of defense is successful, no other strategies are required. Resources consuming strategy. External information system monitoring is part of Boundary protection. <ref> SI-4 INFORMATION SYSTEM MONITORING, NIST Special Publication 800-53 [https://nvd.nist.gov/800-53/Rev4/control/SI-4 ] </ref>
 
Information System Monitoring Strategy Analysis.
 
Strategy success based on competition of offence and defense.  Time and Resources consuming strategy, affecting performance.  Cannot be fully successful if not supported by other strategies.
 
Unavoidable actions Strategy Analysis.
 
Strategy can support any other strategy. Resources consuming strategy.  Strategy can be fully successful, however in most cases its limiting system functionality.
 
Secure enclave Strategy Analysis.
 
Supporting strategy for Boundary protection and Information System Monitoring. Time and Resources consuming strategy. Strategy can be fully successful in its part, which does not guarantee overall success.
 
False target Strategy Analysis.
 
Supporting strategy for Information System Monitoring. Time-consuming strategy. Cannot be fully successful if not supported by other strategies.
 
Moving target Strategy Analysis.
 
Supporting strategy for Information System Monitoring. Time-consuming strategy. Cannot be fully successful if not supported by other strategies.
 
Useless information Strategy Analysis.
 
Supporting strategy for Information System Monitoring. Time and Resources consuming strategy, affecting performance.   Cannot be  successful if not supported by other strategies.  Consequences of [[Claude Shannon]] theorems shows that if encryption key is smaller than secured information , the [[Information-theoretic security]] can not be achieved. There is only one known unbreakable cryptographic system, the [[one-time pad]], this is not generally possible to use because of the difficulties involved in exchanging one-time pads without their being compromised. Other cryptographic system are only buying time, can be broken. This strategy need to be supported by Moving target strategy or Delete strategy.
 
Delete Strategy Analysis
 
Supporting strategy for Information System Monitoring.  Resources consuming strategy.   Cannot be fully successful, since detection is not quarantined.
 
Information redundancy Strategy Analysis.
 
Supporting strategy for Information System Monitoring.  Considerable resources consuming strategy.   Can be fully successful in its part.
 
Limiting of actions made by robots Strategy Analysis.
 
Supporting strategy for Boundary protection and Information System Monitoring. Time and Resources consuming strategy. Strategy cannot be fully successful.
 
Active defense Strategy Analysis.
 
Supporting strategy for Boundary protection and Information System Monitoring. Time and Resources consuming strategy. Strategy cannot be fully successful.


==See also==
==See also==
*[[Firewall (computing)]]
*[[Antivirus software]]
*[[Patch (computing)]]
*[[Security switch]]
*[[Physical unclonable function]]
*[[Access level]]
*[[Trusted Platform Module]]
*[[Honeypot]]
*[[Virtual Computer]]
*[[Virtual security switch]]
*[[Encryption software]]
*[[Data-centric security]]
*[[Anti-spam techniques]]
*[[CAPTCHA]]
*[[Human presence detection]]
*[[Information-theoretic security]]
*[[Strong cryptography]]
*[[Strong cryptography]]


==References==
==References==
{{Reflist}}


{{Reflist}}
[[Category:Computer security]]
Retrieved from "https://ideawaza.com/wiki/Defense_strategy_(computing)"