Access Control
The 3 basic actions of a person on an item of data: viewing (confidentiality), modifying (integrity), using (availability). These are the basic modes of access computer security seeks to preserve.
Access control is the basic model or paradigm of security. Several other models support specific computer security objectives:
- BLP model
Data confidentiality and sharing, by David Bell and Leonard La Padula. - Biba model
Data integrity, by Kenneth Biba. - Chinese Wall model
Preventing conflict of interests in shared information systems.
Types of Threats
Threats to computer security exist for data, systems, and services.
- Non-human origin
Hardware, software, network, or power failure. - Human origin, benign intent
Human error in initiating a wrong action or giving wrong input. - Human origin, malicious intent
Autonomous attacks initiated by humans, either random (worms, viruses, malicious web pages or scripts, phishing emails) or directed (spear phishing, impersonation).
Advanced Persistent Threat
An advanced persistent threat (APT) is a directed attack designed to snare a high value target, e.g. stealing a company CEO’s email password, or cause extremely high damage, e.g. destroying a uranium enrichment plant.
APT attacks are executed by coordinated human actions rather than through program code alone. Attackers are skilled, motivated, organized, and well funded.
- Advanced
Attackers have a full spectrum of intelligence-gathering techniques at their disposal. - Persistent
Attackers have specific objectives, rather than opportunistically seeking information for financial or other gain. - Threat
Attackers constitute a high-level threat because they have both capability and intent for severe damage or loss.