SCC141: term 2
暂无描述。系统推荐的高质量记忆内容，适合每天坚持背诵学习。
卡片预览 (24 张)
why is system security important?
-everyday life relies on digital systems -attacks are costly -data security, sensitive data may be being stored
what can system security weaknesses lead to?
-downtime -data loss -safety issues -harassment- robotics
what is the CIA triad?
-foundation for security requirements that aims to secure a system -confidentiality -integrity -availability
what does the confidentiality portion of CIA triad represent?
-makes sure data is only accessible by authorised users -enacted through: encryption, access control and authentication methods
what does the integrity portion of the CIA triad represent?
-makes sure data can only be modified or removed by authorised users -enacted through: checksums, hashing, digital signatures and version control
what does the availability portion of the CIA triad represent?
-makes sure resources/system is accessible when needed by authorised users -prevented by denial of service/ransomware
why does the CIA triad matter?
-security fails if confidentiality/integrity/availability is compromised
list some security design principles:
-economy of mechanism -fail-safe defaults -complex mediation -open design -separation of privilege -least privilege -least common mechanism -psychological acceptability
what is the security design principle economy of mechanism?
-keeping designs simple reduces the risk of bugs/error -encourages reusing quality components where possible
what is the security design principle fail-safe defaults?
-denying access to resources, granting access if explicitly allowed
what is the security design principle complete mediation?
-requests for resources must be authorised EVERY time -no, ‘once you’re in, you’re in forever’
what is the security design principle open design?
-transparency about system security -peer reviews designs -allows others the opportunity to find loopholes/bugs in the security that may be exploited
what is the security design principle separation of privilege?
-dividing power over security across multiple parties -means no single authority can compromise system security
what is the security design principle defence in depth?
-multiple layers of security -if one layer of security fails, the others should hold
what is the security design principle least privilege?
-a user or process should be granted the least privileges necessary for a task -reducing access
what is the security design principle least common mechanism?
-minimising shared resources or mechanisms being used by multiple components -if one is compromised, they all are
what is the security design principle psychological acceptability?
-security should be user friendly -could fail if users choose to bypass it
what are the immutable laws of security?
10 security principles -published by microsoft in 2001 -updated 2009/2023
why are privacy regulations needed ??
-to prevent data misuse -to protect a user’s fundamental right to privacy -help establish trust between user and service provider
what does the EU artificial intelligence act regulate?
-addresses unregulated AI applications -categorises AI systems by risk -high risk AI needs to be highly regulated -proposed in April 2021 -enforcement expected by 2025
what is federated learning and how does it improve AI privacy?
-trains models locally on user’s device without transferring data to a centralised server -protects sensitive data and reduces chance of data breaches during transmission.w
what is differential privacy?
-introducing statistical noise -makes it impossible to trace data to its origin -means data breaches are less damaging, as identities are hidden
what are some methods that can be used to increase privacy?
-federated learning: training AI locally -differential privacy: noise in data sets to anonymize -encryption
what are some emerging privacy concerns with new technologies?
-generative AI and deepfakes -biometric data: eg voice recognition -neurotechnology: brain computer interfaces like neuralink -consent fatigue: endless pop ups, users ignore and accept privacy agreements -rapid tech evolution: can laws keep up with advancements?