Editing Computer security (section)

==Computer protection (countermeasures)==
In computer security, a [[Countermeasure (computer)|countermeasure]] is an action, device, procedure or technique that reduces a threat, a vulnerability, or an [[attack (computing)|attack]] by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken.<ref>{{cite ietf|rfc=2828|title=Internet Security Glossary}}</ref><ref>{{cite web |date=26 April 2010 |title=CNSS Instruction No. 4009 |url=http://www.cnss.gov/Assets/pdf/cnssi_4009.pdf |archive-url=https://web.archive.org/web/20120227163121/http://www.cnss.gov/Assets/pdf/cnssi_4009.pdf |archive-date=27 February 2012}}</ref><ref>{{cite web |title=InfosecToday Glossary |url=http://www.infosectoday.com/Articles/Glossary.pdf |url-status=live |archive-url=https://web.archive.org/web/20141120041536/http://www.infosectoday.com/Articles/Glossary.pdf |archive-date=20 November 2014}}</ref>

Some common countermeasures are listed in the following sections:

===Security by design===
{{Main|Secure by design}}

Security by design, or alternately secure by design, means that the software has been designed from the ground up to be secure. In this case, security is considered a main feature.

The UK government's National Cyber Security Centre separates secure cyber design principles into five sections:<ref>{{Cite web |title=Cyber security design principles |url=https://www.ncsc.gov.uk/collection/cyber-security-design-principles/cyber-security-design-principles |access-date=2023-12-11 |website=www.ncsc.gov.uk |language=en}}</ref>

# Before a secure system is created or updated, companies should ensure they understand the fundamentals and the context around the system they are trying to create and identify any weaknesses in the system.
# Companies should design and centre their security around techniques and defences which make attacking their data or systems inherently more challenging for attackers.
# Companies should ensure that their core services that rely on technology are protected so that the systems are essentially never down.
# Although systems can be created which are safe against a multitude of attacks, that does not mean that attacks will not be attempted. Despite one's security, all companies' systems should aim to be able to detect and spot attacks as soon as they occur to ensure the most effective response to them. 
# Companies should create secure systems designed so that any attack that is successful has minimal severity.

These design principles of security by design can include some of the following techniques:
* The [[principle of least privilege]], where each part of the system has only the privileges that are needed for its function. That way, even if an [[Hacker (computer security)|attacker]] gains access to that part, they only have limited access to the whole system.
* [[Automated theorem proving]] to prove the correctness of crucial software subsystems.
* [[Code review]]s and [[unit testing]], approaches to make modules more secure where formal correctness proofs are not possible.
* [[Defense in depth (computing)|Defense in depth]], where the design is such that more than one subsystem needs to be violated to compromise the integrity of the system and the information it holds.
* Default secure settings, and design to ''fail secure'' rather than ''fail insecure'' (see [[fail-safe]] for the equivalent in [[safety engineering]]). Ideally, a secure system should require a deliberate, conscious, knowledgeable and free decision on the part of legitimate authorities in order to make it insecure.
* [[Audit trail]]s track system activity so that when a security breach occurs, the mechanism and extent of the breach can be determined. Storing audit trails remotely, where they can only be appended to, can keep intruders from covering their tracks.
* [[Full disclosure (computer security)|Full disclosure]] of all vulnerabilities, to ensure that the ''window of vulnerability'' is kept as short as possible when bugs are discovered.

===Security architecture===
Security architecture can be defined as the "practice of designing computer systems to achieve security goals."<ref name="NSCS security arch">{{Cite web |title=How the NCSC thinks about security architecture |url=https://www.ncsc.gov.uk/blog-post/how-ncsc-thinks-about-security-architecture |access-date=2023-12-18 |website=www.ncsc.gov.uk |language=en}}</ref> These goals have overlap with the principles of "security by design" explored above, including to "make initial compromise of the system difficult," and to "limit the impact of any compromise."<ref name="NSCS security arch" /> In practice, the role of a security architect would be to ensure the structure of a system reinforces the security of the system, and that new changes are safe and meet the security requirements of the organization.<ref>{{Cite web |title=Secure System Architecture and Design |url=https://www.ukcybersecuritycouncil.org.uk/careers-and-learning/cyber-career-framework/secure-system-architecture-design| date=2024| access-date=4 January 2024 |website=UK Cyber Security Council |language=en }}</ref><ref>{{Cite web |title=security architecture – Glossary {{!}} CSRC |url=https://csrc.nist.gov/glossary/term/security_architecture |access-date=2023-12-18 |website=csrc.nist.gov |language=EN-US}}</ref>

Similarly, Techopedia defines security architecture as "a unified security design that addresses the necessities and potential risks involved in a certain scenario or environment. It also specifies when and where to apply security controls. The design process is generally reproducible." The key attributes of security architecture are:<ref>{{cite web |last1=Jannsen |first1=Cory |title=Security Architecture |url=http://www.techopedia.com/definition/72/security-architecture |url-status=live |archive-url=https://web.archive.org/web/20141003064643/http://www.techopedia.com/definition/72/security-architecture |archive-date=3 October 2014 |access-date=9 October 2014 |website=Techopedia |publisher=Janalta Interactive Inc}}</ref>
* the relationship of different components and how they depend on each other.
* determination of controls based on risk assessment, good practices, finances, and legal matters.
* the standardization of controls.

Practicing security architecture provides the right foundation to systematically address business, IT and security concerns in an organization.

===Security measures===
A state of computer security is the conceptual ideal, attained by the use of three processes: threat prevention, detection, and response. These processes are based on various policies and system components, which include the following:
* Limiting the access of individuals using [[user account]] [[access control]]s and using [[cryptography]] can protect systems files and data, respectively.
* [[Firewall (networking)|Firewalls]] are by far the most common prevention systems from a network security perspective as they can (if properly configured) shield access to internal network services and block certain kinds of attacks through packet filtering. Firewalls can be both hardware and software-based. Firewalls monitor and control incoming and outgoing traffic of a computer network and establish a barrier between a trusted network and an untrusted network.<ref name="Oppliger-1997">{{Cite journal |last=Oppliger |first=Rolf |date=1997-05-01 |title=Internet security: firewalls and beyond |journal=Communications of the ACM |volume=40 |issue=5 |pages=92–102 |doi=10.1145/253769.253802 |issn=0001-0782|doi-access=free }}</ref>
* [[Intrusion Detection System]] (IDS) products are designed to detect network attacks in-progress and assist in post-attack [[forensics]], while [[audit trail]]s and [[data logging|logs]] serve a similar function for individual systems.
* ''Response'' is necessarily defined by the assessed security requirements of an individual system and may cover the range from simple upgrade of protections to notification of [[legal]] authorities, counter-attacks, and the like. In some special cases, the complete destruction of the compromised system is favored, as it may happen that not all the compromised resources are detected.
* Cyber security awareness training to cope with cyber threats and attacks.<ref>{{Cite web |title=How to Increase Cybersecurity Awareness |url=https://www.isaca.org/resources/isaca-journal/issues/2019/volume-2/how-to-increase-cybersecurity-awareness |access-date=2023-02-25 |website=ISACA}}</ref>
* Forward web [[Proxy server|proxy]] solutions can prevent the client to visit malicious web pages and inspect the content before downloading to the client machines.

Today, computer security consists mainly of preventive measures, like [[Firewall (computing)|firewalls]] or an [[exit procedure]]. A firewall can be defined as a way of filtering network data between a host or a network and another network, such as the [[Internet]]. They can be implemented as software running on the machine, hooking into the [[network stack]] (or, in the case of most [[UNIX]]-based operating systems such as [[Linux]], built into the operating system [[Kernel (operating system)|kernel]]) to provide real-time filtering and blocking.<ref name="Oppliger-1997" /> Another implementation is a so-called ''physical firewall'', which consists of a separate machine filtering network traffic. Firewalls are common amongst machines that are permanently connected to the Internet.

Some organizations are turning to [[big data]] platforms, such as [[Apache Hadoop]], to extend data accessibility and [[machine learning]] to detect [[advanced persistent threat]]s.<ref>{{Cite news |last=Woodie |first=Alex |date=9 May 2016 |title=Why ONI May Be Our Best Hope for Cyber Security Now |url=http://www.datanami.com/2016/05/09/oni-may-best-hope-cyber-security-now/ |url-status=live |access-date=13 July 2016 |archive-url=https://web.archive.org/web/20160820015812/https://www.datanami.com/2016/05/09/oni-may-best-hope-cyber-security-now/ |archive-date=20 August 2016}}</ref>

In order to ensure adequate security, the confidentiality, integrity and availability of a network, better known as the CIA triad, must be protected and is considered the foundation to information security.<ref>{{cite web |last=Walkowski |first=Debbie |date=9 July 2019 |title=What Is The CIA Triad? |url=https://www.f5.com/labs/articles/education/what-is-the-cia-triad.html |access-date=25 February 2020 |website=F5 Labs |language=en}}</ref> To achieve those objectives, administrative, physical and technical security measures should be employed. The amount of security afforded to an asset can only be determined when its value is known.<ref>{{cite web |date=3 December 2018 |title=Knowing Value of Data Assets is Crucial to Cybersecurity Risk Management {{!}} SecurityWeek.Com |url=https://www.securityweek.com/knowing-value-data-assets-crucial-cybersecurity-risk-management |access-date=25 February 2020 |website=www.securityweek.com}}</ref>

===Vulnerability management===
{{main|Vulnerability management}}

Vulnerability management is the cycle of identifying, fixing or mitigating [[Software vulnerability|vulnerabilities]],<ref>{{cite book |last=Foreman |first=Park |title=Vulnerability Management |date=2009 |publisher=Auerbach Publications |isbn=978-1-4398-0150-5 |publication-place=Boca Raton, Fla. |page=1}}</ref> especially in software and [[firmware]]. Vulnerability management is integral to computer security and [[network security]].

Vulnerabilities can be discovered with a [[vulnerability scanner]], which analyzes a computer system in search of known vulnerabilities,<ref>{{Cite book |last=Johnson |first=A. |url=https://books.google.com/books?id=FxRbDwAAQBAJ&q=Vulnerabilities+can+be+discovered+with+a+vulnerability+scanner,+which+analyzes+a+computer+system+in+search+of+known+vulnerabilities&pg=SA5-PA83 |title=CCNA Cybersecurity Operations Companion Guide |date=2018 |publisher=Cisco Press |isbn=978-0-13-516624-6 |language=en}}</ref> such as [[open port]]s, insecure software configuration, and susceptibility to [[malware]].  In order for these tools to be effective, they must be kept up to date with every new update the vendor release.  Typically, these updates will scan for the new vulnerabilities that were introduced recently.

Beyond vulnerability scanning, many organizations contract outside security auditors to run regular [[penetration test]]s against their systems to identify vulnerabilities. In some sectors, this is a contractual requirement.<ref>{{cite book |last1=Calder |first1=Alan |title=PCI DSS: A Pocket Guide |last2=Williams |first2=Geraint |publisher=IT Governance Limited |year=2014 |isbn=978-1-84928-554-4 |edition=3rd |quote=network vulnerability scans at least quarterly and after any significant change in the network}}</ref>

===Reducing vulnerabilities===

The act of assessing and reducing vulnerabilities to cyber attacks is commonly referred to as [[information technology security assessment]]s. They aim to assess systems for risk and to predict and test for their vulnerabilities. While [[formal verification]] of the correctness of computer systems is possible,<ref>{{cite conference |last1=Harrison |first1=J. |year=2003 |title=Formal verification at Intel |conference=18th Annual IEEE Symposium of Logic in Computer Science, 2003. Proceedings |pages=45–54 |doi=10.1109/LICS.2003.1210044 |isbn=978-0-7695-1884-8 |s2cid=44585546}}</ref><ref>{{cite conference |last1=Umrigar |first1=Zerksis D. |last2=Pitchumani |first2=Vijay |year=1983 |title=Formal verification of a real-time hardware design |url=http://portal.acm.org/citation.cfm?id=800667 |conference=Proceeding DAC '83 Proceedings of the 20th Design Automation Conference |publisher=IEEE Press |pages=221–227 |isbn=978-0-8186-0026-5}}</ref> it is not yet common. Operating systems formally verified include [[seL4]],<ref>{{cite web |title=Abstract Formal Specification of the seL4/ARMv6 API |url=https://sel4.systems/Docs/seL4-spec.pdf |archive-url=https://web.archive.org/web/20150521171234/https://sel4.systems/Docs/seL4-spec.pdf |archive-date=21 May 2015 |access-date=19 May 2015}}</ref> and [[SYSGO]]'s [[PikeOS]]<ref>{{cite conference |last1=Baumann |first1=Christoph |last2=Beckert |first2=Bernhard |last3=Blasum |first3=Holger |last4=Bormer |first4=Thorsten |title=Ingredients of Operating System Correctness? Lessons Learned in the Formal Verification of PikeOS |url=http://www-wjp.cs.uni-saarland.de/publikationen/Ba10EW.pdf |conference=Embedded World Conference, Nuremberg, Germany |archive-url=https://web.archive.org/web/20110719110932/http://www-wjp.cs.uni-saarland.de/publikationen/Ba10EW.pdf |archive-date=19 July 2011}}</ref><ref>{{cite web |last=Ganssle |first=Jack |title=Getting it Right |url=http://www.ganssle.com/rants/gettingitright.htm |archive-url=https://web.archive.org/web/20130504191958/http://www.ganssle.com/rants/gettingitright.htm |archive-date=4 May 2013}}</ref> – but these make up a very small percentage of the market.

It is possible to reduce an attacker's chances by keeping systems up to date with security patches and updates and by hiring people with expertise in security. Large companies with significant threats can hire Security Operations Centre (SOC) Analysts. These are specialists in cyber defences, with their role ranging from "conducting threat analysis to investigating reports of any new issues and preparing and testing disaster recovery plans."<ref>{{Cite web |title=Everything you need for a career as a SOC analyst |url=https://www.cybersecurityjobsite.com/staticpages/10300/everything-you-need-for-a-career-as-a-soc-analyst/ |access-date=2023-12-19 |website=www.cybersecurityjobsite.com}}</ref>

Whilst no measures can completely guarantee the prevention of an attack, these measures can help mitigate the damage of possible attacks. The effects of data loss/damage can be also reduced by careful [[backup|backing up]] and [[insurance]].

Outside of formal assessments, there are various methods of reducing vulnerabilities. [[Two factor authentication]] is a method for mitigating unauthorized access to a system or sensitive information.<ref>{{Cite web |title=Turn on 2-step verification (2SV) |url=https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/activate-2-step-verification-on-your-email |access-date=2023-12-19 |website=www.ncsc.gov.uk |language=en}}</ref> It requires ''something you know:'' a password or PIN, and ''something you have'': a card, dongle, cellphone, or another piece of hardware. This increases security as an unauthorized person needs both of these to gain access.

Protecting against social engineering and direct computer access (physical) attacks can only happen by non-computer means, which can be difficult to enforce, relative to the sensitivity of the information. Training is often involved to help mitigate this risk by improving people's knowledge of how to protect themselves and by increasing people's awareness of threats.<ref>{{Cite web |title=NCSC's cyber security training for staff now available |url=https://www.ncsc.gov.uk/blog-post/ncsc-cyber-security-training-for-staff-now-available |access-date=2023-12-19 |website=www.ncsc.gov.uk |language=en}}</ref> However, even in highly disciplined environments (e.g. military organizations), social engineering attacks can still be difficult to foresee and prevent.

Inoculation, derived from [[inoculation theory]], seeks to prevent social engineering and other fraudulent tricks and traps by instilling a resistance to persuasion attempts through exposure to similar or related attempts.<ref>{{cite conference |last1=Treglia |first1=J. |last2=Delia |first2=M. |year=2017 |title=Cyber Security Inoculation |conference=NYS Cyber Security Conference, Empire State Plaza Convention Center, Albany, NY, 3–4 June}}</ref>

===Hardware protection mechanisms===
{{See also|Computer security compromised by hardware failure}}

Hardware-based or assisted computer security also offers an alternative to software-only computer security. Using devices and methods such as [[dongle]]s, [[trusted platform module]]s, intrusion-aware cases, drive locks, disabling USB ports, and mobile-enabled access may be considered more secure due to the physical access (or sophisticated backdoor access) required in order to be compromised. Each of these is covered in more detail below.
* USB [[dongle]]s are typically used in software licensing schemes to unlock software capabilities,<ref>{{Cite web |title=What is a license dongle?  |url=https://www.revenera.com/software-monetization/glossary/license-dongle |access-date=2024-06-12 |website=www.revenera.com |language=en}}</ref> but they can also be seen as a way to prevent unauthorized access to a computer or other device's software. The dongle, or key, essentially creates a secure encrypted tunnel between the software application and the key. The principle is that an encryption scheme on the dongle, such as [[Advanced Encryption Standard]] (AES) provides a stronger measure of security since it is harder to hack and replicate the dongle than to simply copy the native software to another machine and use it. Another security application for dongles is to use them for accessing web-based content such as cloud software or [[Virtual Private Networks]] (VPNs).<ref>{{cite web |title=Token-based authentication |url=http://www.safenet-inc.com/multi-factor-authentication/authenticators/pki-usb-authentication/etoken-5200-token-based-authentication/ |url-status=live |archive-url=https://web.archive.org/web/20140320234026/http://www.safenet-inc.com/multi-factor-authentication/authenticators/pki-usb-authentication/etoken-5200-token-based-authentication/ |archive-date=20 March 2014 |access-date=20 March 2014 |publisher=SafeNet.com}}</ref> In addition, a USB dongle can be configured to lock or unlock a computer.<ref>{{cite web |date=10 February 2010 |title=Lock and protect your Windows PC |url=http://www.thewindowsclub.com/lock-protect-your-windows-pc-using-a-usb-drive-with-predator |url-status=live |archive-url=https://web.archive.org/web/20140320220321/http://www.thewindowsclub.com/lock-protect-your-windows-pc-using-a-usb-drive-with-predator |archive-date=20 March 2014 |access-date=20 March 2014 |publisher=TheWindowsClub.com}}</ref>
* [[Trusted platform module]]s (TPMs) secure devices by integrating cryptographic capabilities onto access devices, through the use of microprocessors, or so-called computers-on-a-chip. TPMs used in conjunction with server-side software offer a way to detect and authenticate hardware devices, preventing unauthorized network and data access.<ref>{{cite web |first=James |last=Greene |year=2012 |title=Intel Trusted Execution Technology: White Paper |url=http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/trusted-execution-technology-security-paper.pdf |url-status=live |archive-url=https://web.archive.org/web/20140611161421/http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/trusted-execution-technology-security-paper.pdf |archive-date=11 June 2014 |access-date=18 December 2013 |publisher=Intel Corporation}}</ref>
* [[Computer case#Intrusion detection|Computer case intrusion detection]] refers to a device, typically a push-button switch, which detects when a computer case is opened. The firmware or BIOS is programmed to show an alert to the operator when the computer is booted up the next time.
* Drive locks are essentially software tools to encrypt hard drives, making them inaccessible to thieves.<ref>{{cite web |date=4 October 2008 |title=SafeNet ProtectDrive 8.4 |url=http://www.scmagazine.com/safenet-protectdrive-84/review/2596/ |url-status=live |archive-url=https://web.archive.org/web/20140320220133/http://www.scmagazine.com/safenet-protectdrive-84/review/2596/ |archive-date=20 March 2014 |access-date=20 March 2014 |work=SCMagazine.com}}</ref> Tools exist specifically for encrypting external drives as well.<ref>{{cite web |date=11 May 2009 |title=Secure Hard Drives: Lock Down Your Data |url=https://www.pcmag.com/article2/0,2817,2342798,00.asp |url-status=live |archive-url=https://web.archive.org/web/20170621202140/http://www.pcmag.com/article2/0,2817,2342798,00.asp |archive-date=21 June 2017 |publisher=PCMag.com}}</ref>
* Disabling USB ports is a security option for preventing unauthorized and malicious access to an otherwise secure computer. Infected USB dongles connected to a network from a computer inside the firewall are considered by the magazine Network World as the most common hardware threat facing computer networks.
* Disconnecting or disabling peripheral devices (like camera, GPS, removable storage, etc.), that are not in use.<ref>{{cite journal |last1=Souppaya |first1=Murugiah P. |last2=Scarfone |first2=Karen |date=2013 |title=Guidelines for Managing the Security of Mobile Devices in the Enterprise |url=https://www.nist.gov/publications/guidelines-managing-security-mobile-devices-enterprise |journal=National Institute of Standards and Technology |series=Special Publication (NIST SP) |location=Gaithersburg, MD |doi=10.6028/NIST.SP.800-124r1 |doi-access=free}}</ref>
* Mobile-enabled access devices are growing in popularity due to the ubiquitous nature of cell phones.<ref>{{Cite web |date=2024-02-23 |title=Access Control Statistics: Trends & Insights |url=https://entrycare.com/access-control-statistics/ |access-date=2024-04-26 |language=en-US}}</ref> Built-in capabilities such as [[Bluetooth]], the newer [[Bluetooth low energy]] (LE), [[near-field communication]] (NFC) on non-iOS devices and [[biometrics|biometric]] validation such as thumbprint readers, as well as [[QR code]] reader software designed for mobile devices, offer new, secure ways for mobile phones to connect to access control systems. These control systems provide computer security and can also be used for controlling access to secure buildings.<ref>{{cite web |date=4 November 2013 |title=Forget IDs, use your phone as credentials |url=http://video.foxbusiness.com/v/2804966490001/forget-ids-use-your-phone-as-credentials/?playlist_id=937116503001#sp=show-clips |url-status=live |archive-url=https://web.archive.org/web/20140320215829/http://video.foxbusiness.com/v/2804966490001/forget-ids-use-your-phone-as-credentials/?playlist_id=937116503001#sp=show-clips |archive-date=20 March 2014 |access-date=20 March 2014 |publisher=[[Fox Business Network]]}}</ref>
* [[IOMMU]]s allow for hardware-based [[Sandbox (computer security)|sandboxing]] of components in mobile and desktop computers by utilizing [[direct memory access]] protections.<ref>{{cite web |title=Direct memory access protections for Mac computers |url=https://support.apple.com/guide/security/direct-memory-access-protections-seca4960c2b5/1/web/1 |access-date=16 November 2022 |website=Apple}}</ref><ref>{{cite web |title=Using IOMMU for DMA Protection in UEFI Firmware |url=https://www.intel.com/content/dam/develop/external/us/en/documents/intel-whitepaper-using-iommu-for-dma-protection-in-uefi-820238.pdf |url-status=live |archive-url=https://web.archive.org/web/20211209062425/https://www.intel.com/content/dam/develop/external/us/en/documents/intel-whitepaper-using-iommu-for-dma-protection-in-uefi-820238.pdf |archive-date=2021-12-09 |access-date=16 November 2022 |publisher=Intel Corporation}}</ref>
* [[Physical unclonable function|Physical Unclonable Functions]] (PUFs) can be used as a digital fingerprint or a unique identifier to integrated circuits and hardware, providing users the ability to secure the hardware supply chains going into their systems.<ref>{{Cite journal |last1=Babaei |first1=Armin |last2=Schiele |first2=Gregor |last3=Zohner |first3=Michael |date=2022-07-26 |title=Reconfigurable Security Architecture (RESA) Based on PUF for FPGA-Based IoT Devices |journal=Sensors |language=en |volume=22 |issue=15 |page=5577 |bibcode=2022Senso..22.5577B |doi=10.3390/s22155577 |issn=1424-8220 |pmc=9331300 |pmid=35898079 |doi-access=free}}</ref><ref>{{Cite journal |last1=Hassija |first1=Vikas |last2=Chamola |first2=Vinay |last3=Gupta |first3=Vatsal |last4=Jain |first4=Sarthak |last5=Guizani |first5=Nadra |date=2021-04-15 |title=A Survey on Supply Chain Security: Application Areas, Security Threats, and Solution Architectures |url=https://ieeexplore.ieee.org/document/9203862 |journal=IEEE Internet of Things Journal |volume=8 |issue=8 |pages=6222–6246 |doi=10.1109/JIOT.2020.3025775 |issn=2327-4662 |s2cid=226767829|url-access=subscription }}</ref>

===Secure operating systems===
{{Main|Security-evaluated operating system}}

One use of the term ''computer security'' refers to technology that is used to implement [[Security-evaluated operating system|secure operating system]]s. Using secure operating systems is a good way of ensuring computer security. These are systems that have achieved certification from an external security-auditing organization, the most popular evaluations are [[Common Criteria]] (CC).<ref>{{Cite web |title=The Most Secure OS: What is the Safest OS Available? |url=https://tech.co/antivirus-software/what-is-the-most-secure-os |access-date=2023-12-19 |website=Tech.co |language=en-US}}</ref>

===Secure coding===
{{Main|Secure coding}}

In software engineering, [[secure coding]] aims to guard against the accidental introduction of security vulnerabilities. It is also possible to create software designed from the ground up to be secure. Such systems are ''[[secure by design]]''. Beyond this, formal verification aims to prove the [[correctness (computer science)|correctness]] of the [[algorithms]] underlying a system;<ref>{{cite journal |last=Sanghavi |first=Alok |date=21 May 2010 |title=What is formal verification? |journal=EE Times_Asia}}</ref>
important for [[cryptographic protocol]]s for example.

===Capabilities and access control lists===
{{Main|Access control list|Role-based access control|Capability-based security}}

Within computer systems, two of the main [[Computer security model|security models]] capable of enforcing privilege separation are [[access control list]]s (ACLs) and [[role-based access control]] (RBAC).

An [[access-control list]] (ACL), with respect to a computer file system, is a list of permissions associated with an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.

Role-based access control is an approach to restricting system access to authorized users,<ref>{{cite journal |author1=Ferraiolo, D.F. |author2=Kuhn, D.R. |name-list-style=amp |date=October 1992 |title=Role-Based Access Control |url=http://csrc.nist.gov/groups/SNS/rbac/documents/ferraiolo-kuhn-92.pdf |journal=15th National Computer Security Conference |pages=554–563}}</ref><ref>{{cite journal |last1=Sandhu |first1=R |last2=Coyne |first2=EJ |last3=Feinstein|first3=HL |last4=Youman |first4=CE |date=August 1996 |title=Role-Based Access Control Models |url=http://csrc.nist.gov/rbac/sandhu96.pdf |journal=IEEE Computer |volume=29 |issue=2 |pages=38–47 |citeseerx=10.1.1.50.7649 |doi=10.1109/2.485845 |s2cid=1958270}}</ref><ref>{{Cite conference |author1=Abreu, Vilmar |author2=Santin, Altair O. |author3=Viegas, Eduardo K. |author4=Stihler, Maicon |date=2017 |title=A multi-domain role activation model |url=https://secplab.ppgia.pucpr.br/files/papers/2017-1.pdf |conference=2017 IEEE International Conference on Communications (ICC) |publisher=IEEE Press |pages=1–6 |doi=10.1109/ICC.2017.7997247 |isbn=978-1-4673-8999-0 |s2cid=6185138}}</ref>  used by the majority of enterprises with more than 500 employees,<ref name="autogenerated2002">{{cite book |author1=A.C. O'Connor |url=http://csrc.nist.gov/groups/SNS/rbac/documents/20101219_RBAC2_Final_Report.pdf |title=Economic Analysis of Role-Based Access Control |author2=R.J. Loomis |date=2002 |publisher=Research Triangle Institute |page=145 |name-list-style=amp}}</ref> and can implement [[mandatory access control]] (MAC) or [[discretionary access control]] (DAC).

A further approach, [[capability-based security]] has been mostly restricted to research operating systems. Capabilities can, however, also be implemented at the language level, leading to a style of programming that is essentially a refinement of standard object-oriented design. An open-source project in the area is the [[E programming language|E language]].

===User security training===
The end-user is widely recognized as the weakest link in the security chain<ref>{{cite web |date=22 January 2014 |title=Studies prove once again that users are the weakest link in the security chain |url=https://www.csoonline.com/article/2137210/security-awareness/studies-prove-once-again-that-users-are-the-weakest-link-in-the-security-chain.html |access-date=8 October 2018 |website=CSO Online}}</ref> and it is estimated that more than 90% of security incidents and breaches involve some kind of human error.<ref>{{cite web |date=2 September 2014 |title=The Role of Human Error in Successful Security Attacks |url=https://securityintelligence.com/the-role-of-human-error-in-successful-security-attacks/ |access-date=8 October 2018 |website=IBM Security Intelligence}}</ref><ref>{{cite web |date=15 April 2015 |title=90% of security incidents trace back to PEBKAC and ID10T errors |url=https://www.computerworld.com/article/2910316/90-of-security-incidents-trace-back-to-pebkac-and-id10t-errors.html |access-date=8 October 2018 |website=Computerworld}}</ref> Among the most commonly recorded forms of errors and misjudgment are poor password management, sending emails containing sensitive data and attachments to the wrong recipient, the inability to recognize misleading URLs and to identify fake websites and dangerous email attachments.  A common mistake that users make is saving their user id/password in their browsers to make it easier to log in to banking sites.  This is a gift to attackers who have obtained access to a machine by some means.  The risk may be mitigated by the use of two-factor authentication.<ref>{{cite web |date=7 October 2018 |title=Protect your online banking with 2FA |url=https://www.nzba.org.nz/2018/10/08/protect-your-online-banking-with-2fa/ |access-date=7 September 2019 |website=NZ Bankers Association}}</ref>

As the human component of cyber risk is particularly relevant in determining the global cyber risk<ref>{{cite web |year=2014 |title=IBM Security Services 2014 Cyber Security Intelligence Index |url=https://pcsite.co.uk/computer-security/IBM_Security_Services_2014_Cyber_Security_Intelligence_Index.pdf |access-date=9 October 2020 |website=PcSite}}</ref> an organization is facing, security awareness training, at all levels, not only provides formal compliance with regulatory and industry mandates but is considered essential<ref>{{cite news |last1=Caldwell |first1=Tracey |date=12 February 2013 |title=Risky business: why security awareness is crucial for employees |newspaper=The Guardian |url=https://www.theguardian.com/media-network/media-network-blog/2013/feb/12/business-cyber-security-risks-employees |access-date=8 October 2018}}</ref> in reducing cyber risk and protecting individuals and companies from the great majority of cyber threats.

The focus on the end-user represents a profound cultural change for many security practitioners, who have traditionally approached cybersecurity exclusively from a technical perspective, and moves along the lines suggested by major security centers<ref>{{cite web |title=Developing a Security Culture |url=https://www.cpni.gov.uk/developing-security-culture |archive-url=https://web.archive.org/web/20181009013120/https://www.cpni.gov.uk/developing-security-culture |archive-date=9 October 2018 |access-date=8 October 2018 |website=CPNI – Centre for the Protection of National Infrastructure}}</ref> to develop a culture of cyber awareness within the organization, recognizing that a security-aware user provides an important line of defense against cyber attacks.

===Digital hygiene===
Related to end-user training, '''digital hygiene''' or '''cyber hygiene''' is a fundamental principle relating to information security and, as the analogy with [[personal hygiene]] shows, is the equivalent of establishing simple routine measures to minimize the risks from cyber threats. The assumption is that good cyber hygiene practices can give networked users another layer of protection, reducing the risk that one vulnerable node will be used to either mount attacks or compromise another node or network, especially from common cyberattacks.<ref name="Cyber Hygiene">{{cite web |title=Cyber Hygiene – ENISA |url=https://www.enisa.europa.eu/publications/cyber-hygiene |access-date=27 September 2018 |language=en-gb}}</ref> Cyber hygiene should also not be mistaken for [[proactive cyber defence]], a military term.<ref name="Kaljulaid-2017">{{cite web |last=Kaljulaid |first=Kersti |date=16 October 2017 |title=President of the Republic at the Aftenposten's Technology Conference |url=https://president.ee/en/official-duties/speeches/13671-president-of-the-republic-at-the-aftenpostens-technology-conference/index.html |access-date=27 September 2018}}</ref>

The most common acts of digital hygiene can include updating malware protection, cloud back-ups, passwords, and ensuring restricted admin rights and network firewalls.<ref>{{Cite web |title=Cyber security breaches survey 2023 |url=https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2023/cyber-security-breaches-survey-2023 |access-date=2023-12-27 |website=GOV.UK |language=en}}</ref> As opposed to a purely technology-based defense against threats, cyber hygiene mostly regards routine measures that are technically simple to implement and mostly dependent on discipline<ref>{{Cite news |last=Kuchler |first=Hannah |date=27 April 2015 |title=Security execs call on companies to improve 'cyber hygiene' |work=Financial Times |url=https://www.ft.com/content/8468cfda-e9e3-11e4-a687-00144feab7de |url-access=subscription |access-date=27 September 2018 |archive-url=https://ghostarchive.org/archive/20221210/https://www.ft.com/content/8468cfda-e9e3-11e4-a687-00144feab7de |archive-date=10 December 2022}}</ref> or education.<ref>{{Cite news |title=From AI to Russia, Here's How Estonia's President Is Planning for the Future |language=en-US |magazine=Wired |url=https://www.wired.com/story/from-ai-to-russia-heres-how-estonias-president-is-planning-for-the-future/ |access-date=28 September 2018}}</ref> It can be thought of as an abstract list of tips or measures that have been demonstrated as having a positive effect on personal or collective digital security. As such, these measures can be performed by laypeople, not just security experts.

Cyber hygiene relates to personal hygiene as computer viruses relate to biological viruses (or pathogens). However, while the term ''computer virus'' was coined almost simultaneously with the creation of the first working computer viruses,<ref>{{Cite news |date=1 November 2017 |title=Professor Len Adleman explains how he coined the term "computer virus" |language=en-US |work=WeLiveSecurity |url=https://www.welivesecurity.com/2017/11/01/professor-len-adleman-explains-computer-virus-term/ |access-date=28 September 2018}}</ref> the term ''cyber hygiene'' is a much later invention, perhaps as late as 2000<ref>{{cite web |title=Statement of Dr. Vinton G. Cerf |url=https://www.jec.senate.gov/archive/Documents/Hearings/cerf22300.htm |access-date=28 September 2018 |website=www.jec.senate.gov}}</ref> by Internet pioneer [[Vint Cerf]]. It has since been adopted by the [[United States Congress|Congress]]<ref>{{USBill|115|HR|3010|pipe=Promoting Good Cyber Hygiene Act of 2017|site=yes}}</ref> and [[United States Senate|Senate]] of the United States,<ref>{{cite news |title=Analysis {{!}} The Cybersecurity 202: Agencies struggling with basic cybersecurity despite Trump's pledge to prioritize it |language=en |newspaper=The Washington Post |url=https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/07/26/the-cybersecurity-202-agencies-struggling-with-basic-cybersecurity-despite-trump-s-pledge-to-prioritize-it/5b58a84e1b326b1e64695548/ |access-date=28 September 2018}}</ref> the FBI,<ref>{{cite web |title=Protected Voices |url=https://www.fbi.gov/investigate/counterintelligence/foreign-influence/protected-voices |access-date=28 September 2018 |website=Federal Bureau of Investigation |language=en-us}}</ref> [[European Union|EU]] institutions<ref name="Cyber Hygiene" /> and heads of state.<ref name="Kaljulaid-2017" />

===Difficulty of responding to breaches===
Responding to attempted [[security breaches]] is often very difficult for a variety of reasons, including:
* Identifying attackers is difficult, as they may operate through proxies, temporary anonymous dial-up accounts, wireless connections, and other anonymizing procedures which make back-tracing difficult – and are often located in another [[jurisdiction]]. If they successfully breach security, they have also often gained enough administrative access to enable them to delete [[Data logging|logs]] to cover their tracks.
* The sheer number of attempted attacks, often by automated vulnerability scanners and computer worms, is so large that organizations cannot spend time pursuing each.
* [[Law enforcement officer]]s often lack the skills, interest or budget to pursue attackers. Furthermore, identifying attackers across a network may necessitate collecting logs from multiple locations within the network and across various countries, a process that can be both difficult and time-consuming.

Where an attack succeeds and a breach occurs, many jurisdictions now have in place mandatory [[security breach notification laws]].

===Types of security and privacy===
{{div col}}
* [[Access control]]
* [[Anti-keylogger]]s
* [[Anti-malware]]
* [[Anti-spyware]]
* [[Anti-subversion software]]
* [[Anti-tamper software]]
* [[Anti-theft]]
* [[Antivirus software]]
* [[Cryptographic software]]
* [[Computer-aided dispatch]] (CAD)
* [[Data loss prevention software]]
* [[Firewall (computing)|Firewall]]
* [[Intrusion detection system]] (IDS)
* [[Intrusion prevention system]] (IPS)
* [[Log management software]]
* [[Parental control]]
* [[Records management]]
* [[Sandbox (computer security)|Sandbox]]
* [[Security information management]]
* [[Security information and event management]] (SIEM)
* [[Patch (computing)|Software and operating system updating]]
* [[Vulnerability Management]]
{{div col end}}