Midterm Study Guide

This is simply a guide of topics that I consider important for the midterm. I don’t promise to ask you about them all, or about any of these in particular; but I may very well ask you about any of these, as well as anything we discussed in class, in the discussion section, or that is in the readings (including the papers).

1. Fundamentals
   1. What is security?
   2. Basics of risk analysis
   3. Relationship of security policy to security
   4. Policy vs. mechanism
   5. Assurance and security

2. Saltzer’s and Schroeder’s principles of secure design

3. Robust programming

4. Penetration studies
   1. Flaw hypothesis methodology
   2. Scoping the system

5. Vulnerabilities models
   1. RISOS model
   2. PA model
   3. NRL model
   4. Aslam’s model
   5. CVE, CWE, MITRE/SANS Top 25, OWASP Top 10

6. Attacks
   1. Attack trees
   2. Requires/provides model
   3. Attack graphs

7. Access control matrix
   1. Matrix
   2. Primitive operations
   3. Commands
   4. Harrison-Ruzzo-Ullman result (undecidability of safety)

8. Policies
   1. Mandatory access control (MAC)
   2. Discretionary access control (DAC)
   3. Originator-controlled access control (ORCON)
   4. Policy languages

9. Confidentiality Models
   1. Bell-LaPadula Model
   2. Lattices and the BLP Model
   3. Tranquility

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: [email protected]

ECS 153, Computer Security Version of April 23, 2021 at 9:35AM

You can also obtain a PDF version of this.