Anything that removes or reduces a vulnerability or protects against one or more specific threats can be classified as a safeguard, security control, or countermeasure.
An example of this can be installing software patches, making system configuration changes, hiring security guard, or training employees to name a few.
Services that are not bound to a certain layer but may have an impact on multiple layers are known as cross-layer functions. All of the levels are involved in some orthogonal issues, such management and security. The confidentiality, integrity, and availability of the sent data are improved by these services. In reality, cross-layer functions are…
Microsoft developed the STRIDE threat model to assess threats against applications or operating systems. STRIDE is an acronym for the following: Spoofing, Tampering. Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Spoofing An attack with the goal of gaining access to a target system through the use of falsified identity. Tampering Any action…
The client needs to authenticate to gain network access. The response representation SHOULD contain a link to a resource that allows the user to submit credentials (e.g., with an HTML form). Note that the 511 response SHOULD NOT contain a challenge or the login interface itself, because browsers would show the login interface as being…
Separation of duties prevents one person from having the ability to take over vital security mechanisms. This is accomplished by dividing work among several people. Limiting the power to individuals makes it so that employees have to work with others to accomplish specific tasks. This security concepts limits potential impact to organizations in areas such…
The origin server requires the request to be conditional. Its typical use is to avoid the “lost update” problem, where a client GETs a resource’s state, modifies it, and PUTs it back to the server, when meanwhile a third party has modified the state on the server, leading to a conflict. By requiring requests to…
Accepting risk, risk tolerance, or accepted risk is the result after a cost/benefit analysis shows countermeasure costs would outweigh the possible cost of loss due to a risk. Example: Management has agreed to accept the consequences and/or loss if that risk actually happens. For example, a patch for a vulnerability exists but every time the…