sidechannel.org
Duct tape makes you smart...

Bruce Schneier blogged about a fantastic side-channel paper the other day. This paper Side-Channel Leaks in Web Applications written by Shuo Chen, Rui Wang, XiaoFeng Wang, and Kehuan Zhang, is a great read.

I highly recommend it.

Domain 2
Access Control

Domain 2 builds on the core base information security principal's of
Confidentiality Integrity and Availability and starts introducing what I call the foundation or access control principals. This base and foundation will be prevalent throughout the rest of the domains.

Let's introduce and briefly look at Identification, Authentication, and Authorization

Identification

Identification can be defined as the assertion of identity. One of the ways we assert our identity is to present some sort of identification media, such as passport or driver license. Sometimes data leakage from this media, such as RFID Scanning , can surprise even the most security conscience!

Authentication

Authentication can be defined as the act of identifying or the validation of identity. The three types of authentication are:

Authentication by knowledge	Something you know, such as a password
Authentication by ownership	Something you have, such as a smart card
Authentication by characteristic	Something you are or do

We all know some common attacks on authentication, shoulder surfing is a very simple and effective one for passwords or PINS.

Information leakage in the process of authentication isn't new, but just as important as protecting your identification (passport, token, password,etc) is being aware what information can be gleaned from the authentication steps themselves.

Authorization

Authorization can be defined as the granting of right of access to a user, program, or process.

One very common way of getting more access than allowed, is to find a bug or vulnerability in a particular application or process to gain privilege escalation .

I was wondering if I was going to have any time to devote to this site while I studied for my CISSP exam. As I pondered this an interesting thought entered my head. It might be fun to see what side channel type attacks mean to each of the ten CISSP domains. After all side channel (at least to me) is about seeing what information you can learn by looking at something from a different angle.

Domain 1
Information Security and Risk Management

Domain 1 introduces us to the core information security principal's of
Confidentiality Integrity and Availability or CIA.

Actually, there is a lot to this domain! However, since this is the first domain and my first post with this idea, I figured I would keep it at a higher level with these 3 concepts.

Confidentiality

This is the classic definition of a side channel attack! The term was really coined and defined when dealing with secret communications. Because of this, it's rather easy to think of how one might try and get side channel information. Such as, Timing Attacks, Acoustic Cryptanalysis, or even TEMPEST .

We will definitely take a deeper look at some of these when we get to Domain 3!

Integrity

Sometime you don't need to actually compromise integrity to get useful information. The appearance of compromise can be good enough. This can be accomplished with some good social engineering.

Availability

Watching the response to failure can give a lot of good information. Does a system fail open or closed during a DOS attack?

A very interesting paper on information leakage in the cloud, worth reading.

http://people.csail.mit.edu/tromer/papers/cloudsec.pdf