Page 656 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

of the attack refers to a systematic whittling at assets in accounts or
other records with financial value, where very small amounts are

deducted from balances regularly and routinely. Metaphorically, the
attack may be explained as stealing a very thin slice from a salami each
time it’s put on the slicing machine when it’s being accessed by a
paying customer. In reality, though no documented examples of such
an attack are available, most security experts concede that salami
attacks are possible, especially when organizational insiders could be
involved. Only by proper separation of duties and proper control over

code can organizations completely prevent or eliminate such an attack.
Setting financial transaction monitors to track very small transfers of
funds or other items of value should help to detect such activity;
regular employee notification of the practice should help to discourage
attempts at such attacks.

If you want an entertaining method of learning about the

salami attack or the salami technique, view the movies Office
Space, Sneakers, and Superman III. You can also read the article

from Wired about an attack of this nature from 2008:
https://www.wired.com/2008/05/man-allegedly-b/.

Programming

We have already mentioned the biggest flaw in programming: the
buffer overflow, which can occur if the programmer fails to check or
sanitize the format and/or the size of input data. There are other
potential flaws with programs. Any program that does not handle any

exception gracefully is in danger of exiting in an unstable state. It is
possible to cleverly crash a program after it has increased its security
level to carry out a normal task. If an attacker is successful in crashing
the program at the right time, they can attain the higher security level
and cause damage to the confidentiality, integrity, and availability of

your system.
All programs that are executed directly or indirectly must be fully

tested to comply with your security model. Make sure you have the