Security Architecture

Encryption using linked key pairs where what the public key encrypts only the private key can decrypt; slow, so used for key exchange and signatures rather than bulk data.

The confidentiality-only security model behind CISSP Domain 3: No Read Up (Simple Security Property) and No Write Down (Star Property) keep classified data from leaking downward.

The integrity counterpart to Bell-LaPadula: No Read Down and No Write Up stop trusted data from being contaminated by less trustworthy sources. Confidentiality is out of scope.

The Brewer-Nash model: access rights change dynamically based on what a user has already accessed, blocking conflicts of interest between competing clients' data.

A commercial integrity model built on well-formed transactions and separation of duties: users change data only through certified programs, never directly. Access triple: subject, program, object.

Recovering data such as disk encryption keys from a computer's RAM shortly after power is cut, exploiting the fact that memory contents fade over seconds or minutes rather than at once.

Access control in which the decision turns on what the requested object contains, such as the values in a database record, as well as on who is asking.

Access control in which the decision depends on the circumstances of the request, such as time, location, device or the sequence of earlier actions, rather than on the data requested.

Layering physical, technical, and administrative controls so no single control failure exposes an asset; every layer assumes the layer in front of it can be breached.

A message hash encrypted with the sender's private key, proving integrity, authenticity, and nonrepudiation to anyone with the matching public key; it provides no confidentiality.

Access controlled at the owner's discretion: whoever owns a resource decides who else may use it. Flexible, but permissions can spread in ways no central policy intended.

A control that requires two or more people to act together, at the same moment, to complete a single sensitive operation, so that no individual can perform it alone.

A failure mode where a control defaults to denying access when it loses power or malfunctions, protecting the asset; contrast fail safe, which defaults to protecting people.

A security model defining eight primitive protection rights: how subjects and objects are securely created and deleted, and how access rights are granted, transferred, and revoked.

A one-way function condensing any input into a fixed-length digest used to verify integrity; computationally infeasible to reverse, and secure only while collisions stay impractical.

Holding copies of cryptographic keys with a trusted third party so they can be recovered for continuity or produced for lawful access, trading confidentiality risk for availability.

Configuring a system to provide only the functions, ports, protocols, software and services its mission requires, and disabling or removing the rest to reduce the attack surface.

Granting each user, process, or account only the access its task requires, and no more. Limits the damage from mistakes, malware, and compromised credentials alike.

An attack where the adversary secretly relays, and can alter, traffic between two parties who believe they communicate directly; defeated by mutual authentication and certificate validation.

Access decided by the system comparing security labels against clearances, under a policy users cannot override. Not even a file's owner can share it outside policy.

Restricting access to specific information to those with an operational requirement for it, applied after clearance rather than instead of it.

The Biba rule that a subject cannot read data of lower integrity than its own, stopping trusted processes from being corrupted by unreliable input.

The Bell-LaPadula rule that a subject cannot read data classified above their clearance. Confidentiality's ceiling: a Secret clearance never opens a Top Secret file.

The Biba rule that a subject cannot write to a higher integrity level, stopping unreliable processes from injecting bad data into trusted records.

Assurance that a party cannot credibly deny an action. It needs a secret only that party holds, which is why digital signatures provide it and shared-key MACs cannot.

Authenticating with a stolen password hash instead of the password itself, exploiting NTLM's use of the hash as the credential; no cracking needed, the hash is the secret.

A hardware-enforced privilege hierarchy in which privilege increases inward: ring 0 holds the kernel and is most privileged, ring 3 holds user applications and is least privileged.

The CAs, registration authorities, certificates, and revocation services (CRLs, OCSP) that bind identities to public keys and let strangers trust asymmetric cryptography at scale.

The abstract machine that mediates every access by every subject to every object against the security policy. A concept, not a product, defined by three properties.

The hardware, firmware and software inside the trusted computing base that implements the reference monitor concept in running code. The implementation, not the concept.

Splitting a critical process across multiple people so no individual can complete it alone, forcing collusion to commit fraud. A core control in Clark-Wilson and Domain 1 alike.

An attack recovering secrets from an implementation's physical leakage (timing, power draw, emanations, cache behaviour) rather than from any weakness in the algorithm itself.

The Bell-LaPadula rule that a subject cannot write to a lower classification level, stopping cleared users from leaking secrets into documents that lower clearances can read.

Encryption where one shared secret key both encrypts and decrypts: fast enough for bulk data, but burdened by the key distribution problem and n(n-1)/2 keys for n parties.

The total combination of hardware, firmware and software responsible for enforcing a system's security policy; if any part of it fails, every protection built on top of it fails.

A hardware-isolated area of a processor where code and data are protected from the rest of the system, including the host operating system: the basis of confidential computing.

A dedicated hardware chip that stores cryptographic keys, measures boot integrity, and seals secrets to a known-good platform state, anchoring full-disk encryption and secure boot.

A Clark-Wilson concept: data may only be changed by vetted procedures that move it from one consistent state to another, never by direct edits, preserving internal and external consistency.

A security model granting no implicit trust from network location: every request is authenticated, authorised, and continuously verified, wherever it originates.