In computing, defense strategy is a concept and practice used by computer designers, users, and IT personnel to reduce
computer security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
risks.
Common strategies
Boundary protection
Boundary protection employs security measures and devices to prevent unauthorized access to computer systems (referred to as controlling the system border). The approach is based on the assumption that the attacker did not penetrate the system. Examples of this strategy include using
gateways,
routers,
firewalls, and
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
checks, deleting suspicious emails/messages, and limiting physical access.
Boundary protection is typically the main strategy for computing systems; if this type of defense is successful, no other strategies are required. This is a resource-consuming strategy with a known scope. External information system monitoring is part of boundary protection.
Information System Monitoring
Information System Monitoring employs security measures to find intruders or the damage done by them. This strategy is used when the system has been penetrated, but the intruder did not gain full control. Examples of this strategy include
antivirus software
Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Antivirus software was originally developed to detect and remove computer viruses, hence the nam ...
, applying a
patch
Patch or Patches may refer to:
Arts, entertainment and media
* Patch Johnson, a fictional character from ''Days of Our Lives''
* Patch (''My Little Pony''), a toy
* "Patches" (Dickey Lee song), 1962
* "Patches" (Chairmen of the Board song) ...
, and
.
This strategy's success is based on competition of offence and defence. This is a time and resource-consuming strategy, affecting performance. The scope is variable in time. It cannot be fully successful if not supported by other strategies.
Unavoidable actions
Unavoidable actions employ security measures that cannot be prevented or neutralized. This strategy is based on the assumption that the system has been penetrated, but an intruder cannot prevent the defensive mechanism from being employed. Examples of this strategy include
reboot
In computing, rebooting is the process by which a running computer system is restarted, either intentionally or unintentionally. Reboots can be either a cold reboot (alternatively known as a hard reboot) in which the power to the system is physi ...
ing, using
physical unclonable function
A physical unclonable function (sometimes also called physically unclonable function, which refers to a weaker security metric than a physical unclonable function), or PUF, is a physical object that for a given input and conditions (challenge), pr ...
s, and using a
security switch
A security switch is a hardware device designed to protect computers, laptops, smartphones and similar devices from unauthorized access or operation, distinct from a virtual security switch which offers software protection. Security switches should ...
.
Secure enclave
Secure enclave is a strategy that employs security measures that prevent access to some parts of the system. This strategy is used when the system has been penetrated, but an intruder cannot access its special parts. Examples of this strategy include using the
Access level, using a
Trusted Platform Module
Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. The term can also refer to a ch ...
, using a
microkernel
In computer science, a microkernel (often abbreviated as μ-kernel) is the near-minimum amount of software that can provide the mechanisms needed to implement an operating system (OS). These mechanisms include low-level address space management, ...
, using Diode (unidirectional network device), and using
air gaps.
This is a supporting strategy for boundary protection, information system monitoring and unavoidable action strategies. This is a time and resource-consuming strategy with a known scope. Even if this strategy is fully successful, it does not guarantee the overall success of the larger defense strategy.
False target
False target is a strategy that deploys non-real targets for an intruder. It is used when the system has been penetrated, but the intruder does not know the system architecture. Examples of this strategy include
honeypots,
virtual computers,
virtual security switches, fake files, and address/password copies.
This is a supporting strategy for information system monitoring. It is a time-consuming strategy, and the scope is determined by the designer. It cannot be fully successful if not supported by other strategies.
Moving target
Moving target is a security strategy based on frequent changes of data and processes. This strategy is based on the assumption that the system has been penetrated, but the intruder does not know the architecture of the system and its processes. Examples of this strategy are regular changes of
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
s or
keys (cryptography), using a dynamic platform, etc.
This is a supporting strategy for information system monitoring. It is a time-consuming strategy, and the scope is determined by the designer. It cannot be fully successful if not supported by other strategies. Actions are activated on a scheduled basis or as a response to a detected threat.
Useless information
Useless information comprises security measures to turn important information into useless data for an intruder. The strategy is based on the assumption that the system has been penetrated, but the intruder is not able to decrypt information, or does not have enough time to decrypt it. For example,
encrypting the file system or using
encryption software
Encryption software is software that uses cryptography to prevent unauthorized access to digital information. Cryptography is used to protect digital information on computers as well as the digital information that is sent to other computers over t ...
can render the data useless even if an attacker gets access to the file system, or using
data masking
Data masking or data obfuscation is the process of modifying sensitive data in such a way that it is of no or little value to unauthorized intruders while still being usable by software or authorized personnel. Data masking can also be referred as ...
, where sensitive data is hidden in non-sensitive data with modified content.
This is a supporting strategy for information system monitoring. It is a time and resource-consuming strategy, affecting performance. The scope is known. It cannot be successful if not supported by other strategies.
Claude Shannon's theorems show that if the encryption key is smaller than the secured information, the
information-theoretic security
A cryptosystem is considered to have information-theoretic security (also called unconditional security) if the system is secure against adversaries with unlimited computing resources and time. In contrast, a system which depends on the computati ...
can not be achieved. There is only one known unbreakable cryptographic system: the
one-time pad
In cryptography, the one-time pad (OTP) is an encryption technique that cannot be cracked, but requires the use of a single-use pre-shared key that is not smaller than the message being sent. In this technique, a plaintext is paired with a ran ...
. This strategy is not generally possible to use because of the difficulties involved in exchanging one-time pads without the risk of being compromised. Other cryptographic systems are only buying time or can be broken (see
Cryptographic hash function#Degree_of_difficulty). This strategy needs to be supported by the moving target or deletes strategies.
Deletion
Deletion is a strategy using security measures to prevent an intruder from gaining sensitive information at all costs. The strategy is based on the assumption that the damage from information disclosure would be greater than the damage caused by deleting the information or disabling the system required to gain access to the information. The strategy is part of the
data-centric security
Data-centric security is an approach to security that emphasizes the dependability of the data itself rather than the security of networks, servers, or applications. Data-centric security is evolving rapidly as enterprises increasingly rely on d ...
approach. Examples of this strategy include information deletion as a response to a security violation (such as unauthorized access attempts) and
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
resets.
This is a supporting strategy for information system monitoring. It is a resource-consuming strategy, and the scope is determined by the designer. It cannot be fully successful on its own since the detected intrusion is not quarantined.
Information redundancy
Information redundancy is a strategy performing security measures to keep redundancy for information and using it in case of damage. The strategy is based on the assumption that finding and repairing the damage is more complicated than the restoration of the system. Examples of this strategy include using system restoration, keeping backup files, and using a backup computer.
This is a supporting strategy for information system monitoring. This strategy consumes considerable resources, and the scope is known. It can be fully successful in its part.
Limiting of actions made by a robot
Limiting of actions made by a robot is a strategy performing security measures to limit a robot's (software bot) actions. The strategy is based on the assumption that a robot can take more actions, or create damage that a human cannot create. Examples of this strategy include using
anti-spam techniques
Various anti-spam techniques are used to prevent email spam (unsolicited bulk email).
No technique is a complete solution to the spam problem, and each has trade-offs between incorrectly rejecting legitimate email (false positives) as opposed to ...
, using
CAPTCHA
A CAPTCHA ( , a contrived acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of challenge–response test used in computing to determine whether the user is human.
The term was coined in 2003 ...
and other
human presence detection
Human presence detection is a range of technologies and methods for detecting the presence of a human body in an area of interest (AOI), or verification that computer, smartphone (or other device controlled by software) is operated by human.
Softw ...
techniques, and using
DOS
DOS is shorthand for the MS-DOS and IBM PC DOS family of operating systems.
DOS may also refer to:
Computing
* Data over signalling (DoS), multiplexing data onto a signalling channel
* Denial-of-service attack (DoS), an attack on a communicat ...
-based defense (protection from
Denial-of-service attack
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connect ...
).
This is a supporting strategy for boundary protection and information system monitoring. It is a time and resource-consuming strategy, and the scope is determined by the designer. This strategy cannot be fully successful on its own.
Active defense
Active defense
AirLand Battle was the overall conceptual framework that formed the basis of the US Army's European warfighting doctrine from 1982 into the late 1990s. AirLand Battle emphasized close coordination between land forces acting as an aggressively ...
is a strategy performing security measures attacking the potential intruders. The strategy is based on the assumption that a potential intruder under attack has fewer abilities. Examples of this strategy include creating and using lists of trusted networks, devices, and applications, blocking untrusted addresses, and vendor management.
This is a supporting strategy for boundary protection and information system monitoring. It is a time and resource-consuming strategy, and the scope is determined by the designer. This strategy cannot be fully successful on its own.
Unavoidable actions
This strategy can support any other strategy. This is a resource-consuming strategy, and the scope is determined by the designer. An implementation may have a wide impact on devices. This strategy can be fully successful, but in most cases, there is a trade-off of full system functionality for security. This strategy can be used
proactive
Proactivity or proactive behavior refers to self-initiated behavior that endeavours to solve a problem before it has occurred. Proactive behavior involves acting in advance of a future situation, rather than reacting. It refers to taking control o ...
ly or reactively. Actions done in response to an already detected problem may be too late.
Any implementation needs to be supported by the secure enclave strategy in order to prevent neutralizing action by unauthorized access to the protection mechanism.
Actions can be of the following types:
*Preventive actions - blocking certain functions, signals, peripheral devices, memory parts, and/or data transfers. For example: blocking audio/video recording, the sending of long messages, or secret memory access.
*Creative actions - activating certain functions, sending signals, messages, and/or data. For example: sending an alarm signal or message, or activating data copying or transfer.
*Modification actions - modifying a peripheral device's functioning, or modifying the data, signals or processes of the defended system. For example, independent hardware encryption/decryption, changing accelerometer accuracy, filtering messages or words, or changing
state diagram
A state diagram is a type of diagram used in computer science and related fields to describe the behavior of systems. State diagrams require that the system described is composed of a finite number of states; sometimes, this is indeed the case, ...
or
algorithm
In mathematics and computer science, an algorithm () is a finite sequence of rigorous instructions, typically used to solve a class of specific Computational problem, problems or to perform a computation. Algorithms are used as specificat ...
by independent hardware.
See also
*
Strong cryptography
References
{{Reflist
Computer security