2019 FRSecure CISSP Mentor Program: Session 4

### Overview This session of the FRSecure CISSP Mentor Program covers foundational material from Domain 3 (Security Architecture and Engineering), continuing from prior classes. The lecture starts with an exam-style quiz reviewing memory types, ISO/IEC standards, governance frameworks like COBIT, and data roles. The main presentation focuses on hardware architecture, operating system security rings, virtualization, cloud computing models, common attacks and software flaws, and concludes with a historical introduction to cryptography.

### Key Topics - **Review and Core Concepts**: Review of registers, static RAM (flip-flops) versus dynamic RAM, ISO/IEC 27001 and 27002, and administrative roles (data owner, custodian, system owner). - **System Architecture & Protection Rings**: Conceptual layering and abstraction, reference monitor enforcement within the kernel, and the four hierarchical rings (Ring 0 kernel mode to Ring 3 user mode). - **Hardware & Processing**: Motherboard components (Northbridge/Southbridge buses), CPU execution cycles (fetch, decode, execute, store), pipelining, multitasking, multiprocessing, and watchdog timers. - **Virtualization & Cloud Computing**: Differences between Type 1 and Type 2 hypervisors; full virtualization versus paravirtualization; cloud deployment and service models (IaaS, PaaS, SaaS) and associated governance/audit issues. - **System Flaws & Attacks**: Buffer overflows, race conditions (time-of-check/time-of-use), maintenance hooks versus backdoors, malware types (viruses, worms, trojans, rootkits), and mobile device management. - **Cryptography Fundamentals**: Historical ciphers (Caesar, Vigenère, Scytale), Kerckhoffs's principle, exclusive-OR (XOR) operations, the one-time pad, and historical rotor/cipher machines.

### Technical Details - **Protection Rings**: Ring 0 is kernel mode where the kernel and reference monitor operate to enforce access control policies; Ring 1 holds remaining OS components; Ring 2 houses device drivers; Ring 3 runs user applications. Systems like Windows and Linux functionally rely on Rings 0 and 3. - **Hardware Architecture**: Northbridge (memory controller hub) connects high-speed components such as RAM to the CPU, while Southbridge handles slower I/O peripherals. CPU cycles follow four discrete steps (fetch, decode, execute, store), optimized via pipelining. Processing modes distinguish between symmetric multiprocessing (one OS managing all CPUs) and asymmetric multiprocessing (individual OS instances per CPU). - **Memory & System Protection**: Techniques discussed include Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and the Trusted Platform Module (TPM) chip for cryptographic functions and pre-boot authentication. - **Virtualization & Cloud**: Type 1 hypervisors execute bare-metal, whereas Type 2 run on top of an existing operating system. Cloud models define responsibility matrices: IaaS transfers infrastructure management to the provider, PaaS manages the underlying platform, and SaaS abstracts the entire software stack. Security tools such as Cloud Access Security Brokers (CASBs) and frameworks like CSA's CAIQ are highlighted. - **Cryptography & International Controls**: Foundational mechanisms require confusion and diffusion to eliminate patterns. Exclusive-OR (XOR) outputs 0 when compared bits match and 1 when they differ. The one-time pad remains mathematically unbreakable only if characters are truly random, securely kept, and never reused. Export and international trade restrictions on cryptography transitioned from COCOM to the Wassenaar Arrangement in 1996.

### Takeaways To pass the CISSP exam, candidates must master standard architectural concepts rather than deep, specialized modern hardware nuances. Essential focal points include understanding abstraction layers, ring architecture, reference monitor functions, and the shared responsibility models in cloud environments. For cryptography, memorizing fundamental logic like XOR behavior, distinguishing monoalphabetic from polyalphabetic ciphers, and knowing export frameworks like the Wassenaar Arrangement are critical.