DOCSEARCHbyAlgolia
Submit Docs

How to Secure Anything

repository·master·Indexed 27 days ago

https://github.com/veeral-patel/how-to-secure-anything

A comprehensive guide and methodology for security engineering applicable to digital and physical systems. It covers the high-level process of securing systems, including defining security policies, understanding adversaries, implementing security models, minimizing attack surfaces, and managing the Trusted Computing Base (TCB). The guide details security design principles, the Prevent/Detect/Respond framework, attacker mindset techniques like attack trees, and analysis methods such as FTA and FMEA.

Tokens
10.8K
Snippets
1
Records
73
Agent score
95%

What's inside how-to-secure-anything

  1. Overview of Security Engineering

    master
    Security engineering is the discipline of building secure systems by defining desired security properties, choosing mechanisms to enforce them, and providing assurance that those properties hold. It is a process applicable to any system, from computer networks to physical structures like castles or museums.

  2. Explore real-world security case studies and resources

    master

    This project provides a curated list of resources for studying how real-world systems are secured across various domains. Use these resources to understand both defensive mechanisms and common attack vectors.

    Domains Covered:

    • Physical Security: Defending facilities vs. methods used by attackers.
    • Nuclear Command and Control: Physical protection of nuclear materials.
    • Monitoring and Metering: Security of electronic payment and metering systems.
    • Banking and Bookkeeping: Infrastructure security (e.g., Coinbase) and historical bank robberies.
    • Distributed Systems: Security in distributed environments.
    • Copyright and DRM: Protection of software and digital rights.
    • Web Browsers & Applications: Architecture of Chromium, Chrome, and high-assurance HTML5 applications.
    • Mobile & Cloud: Android ecosystem security and Google Cloud infrastructure.
    • Operating Systems: Security-focused OSs (sel4, SELinux, AppArmor), kernel design, and time protection.
    • Specialized Domains: Prison design, voting systems, museum security, casino surveillance, and military fortifications (siegecraft).

  3. Understand the Reference Monitor concept

    master

    A reference monitor is a security mechanism that validates access requests against established policies. It acts as a gatekeeper between a subject (e.g., a process or person) and an object (e.g., a file or a secure area).

    Examples:

    • SELinux reference monitor: Checks if a specific process is authorized to write to a specific file.
    • Physical security: An armed guard at a bunker gate checking visitor IDs.

  4. Components of a dependable system

    master

    To build a dependable system, you must address four core components:

    • Policy: Define exactly what you are supposed to achieve.
    • Mechanism: Implement the machinery to enforce the policy, such as access controls or hardware tamper resistance.
    • Assurance: Determine the level of reliance you can place on individual mechanisms and how effectively they work together.
    • Incentive: Account for the motives of both the defenders (to do their job properly) and the attackers (to defeat your policy).

  5. Understand the concept of trustworthiness in systems

    master

    In the context of security engineering, trustworthiness is defined by the following principles:

    • System Definition: A system is a collection of components operating together to achieve a larger function.
    • Trust: Trust is the confidence that a system possesses specific properties, such as those defined by the CIA triad (Confidentiality, Integrity, and Availability).
    • Trusted Computing: The practice of proving that a computer or system should be trusted based upon verifiable evidence, rather than assuming trust by default.

  7. Differentiate between DAC and MAC access control models

    master

    When designing or implementing access control, choose between two primary models based on how rules are managed:

    • Discretionary Access Control (DAC): Users have the authority to grant access to objects to other users or remove access. In this model, the access control matrix is editable by users.
    • Mandatory Access Control (MAC): Authorization rules are centrally set and cannot be changed by users. In this model, the access control matrix is un-editable by users.

  9. Achieve security assurance

    master
    Security engineering aims to build systems that satisfy specific security properties. Assurance is the process of proving that the system actually satisfies those properties. This involves using formal verification, high-assurance design methods, and rigorous evaluation to ensure that security controls are not just present, but effective and reliable.

  11. Implement robust authentication mechanisms

    master

    To move beyond simple, vulnerable passwords, consider these authentication strategies:

    • Password Enhancements: Use one-time passwords, implement expiration times, or enforce usage counts to limit the window of opportunity for attackers.
    • Unforgettability (Hardware-based): Use physical tokens that are hard to fabricate, such as magnetic stripe cards, YubiKeys, or fingerprints. The terminal transmits a unique, non-secret code from the device to the computer to verify identity.
    • Dynamic Signature Readers: Use biometric or dynamic input methods to reduce the risk of forgery and wiretapping.