Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP - 13 - Software Development Security Principles > 01 - Flash Cards > Flashcards

01 - Flash Cards

1
Q

Information

A
  • Organization’s information is a term that refers to all the information pertaining to the organization.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

System

A
  • In this context, systems refer to IT systems used to provide services.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Devices

A
  • Broad term that may refer to computing systems, servers, laptops, smartphones and external devices such as printers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Subject

A
  • Active entities such as users that access passive object to gain information from or about an object.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Object

A
  • Passive entities such as files and databases that provide subject with information.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CIA Triad

A
  • Confidentiality
  • Integrity
  • Availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Confidentiality

A
  • Is a concept that encompasses a set of measures used to protect the secrecy of data, resources, and objects.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Integrity

A
  • Ability to protect reliability and correctness of data/information.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Availability

A
  • Refers to uninterrupted access to objects to all authorized subjects.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Types of Access Control

A
  • Preventive Access Control
  • Detective Access Control
  • Corrective Access Control
  • Deterrent Access Control
  • Directive Access Control
  • Compensating Access Control
  • Administrative Access Control
  • Logical/Technical Control
  • Physical Control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Preventive Access Control

A
  • Type of control that attempts to prevent incidents before they occur – for example firewall or a guard.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Detective Access Control

A
  • Type of control that identifies security violations after they have occurred –for example motion detectors.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Corrective Access Control

A
  • Type of controls that change the environment after an incident has occured in order to to return it to normal – for example antivirus programs.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Deterrent Access Control

A
  • Type of a control that attempts to discourage specific action from happening- for example security cameras or a security policy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Directive Access Control

A
  • Type of administrative control that provide guidelines – for example monitoring and supervision.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Compensating Access Control

A
  • Type of a control that provides an alternative when it is not possible to use a primary control.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Administrative Access Control

A
  • Type of controls that are stated in organization’s security policy – for example background checks and training efforts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Logical/Technical Control

A
  • Hardware and software mechanisms used to manage access and to provide protection for systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Physical Control

A
  • Type of control one can physically touch – for example fences and guards.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Identification

A
  • Term that refers to a subject claiming an identity.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Authentication

A
  • Term that refers to verifying subject’s identity by comparing it against a database such as user accounts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Authorization

A
  • Term that refers to granting access to specific resources based on a proven identity.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Accountability

A
  • Term that refers to subjects responsibility for their actions once an audit is under way.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Authentication Factors Types

A
  • Type 1
  • Type 2
  • Type 3
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Authentication Type 1

A
  • Something you know – for example a pin or a password.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Authentication Type 2

A
  • Something you have – for example a token or a smart card.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Authentication Type 3

A
  • Something you are or you do – for example fingertips or keystrokes.
28
Q

Context- Aware Authentication

A
  • Context-aware authentication is the use of situational information (such as identity, location, time, type of device) to improve information security.
29
Q

Passwords

A
  • Most common authentication technique that belong to Type 1 authentication.
30
Q

Strong Password Policy Settings

A
  • Maximum age
  • Password lengths
  • Password complexity
31
Q

Password History

A
  • Password history remembers a certain number of passwords and prevents a user from reusing previous passwords.
32
Q

Password Phrase

A
  • Passphrase is a string of characters that has a unique meaning to a user – for example “I am awesome.”
33
Q

Cognitive Passwords

A
  • Series of questions about the facts that only a subject would know.
34
Q

Smartcards

A
  • Cards that have an embedded circuit chip and contain information about an authorized user.
  • This information is used for identification and authentication.
35
Q

Tokens

A
  • Password generating device that users carry with them.
36
Q

Token Types

A
  • Synchronous Dynamic
  • Asynchronous Dynamic
37
Q

HOTP

A
  • HMAC includes a hash function used by HMAC-based One Time Password in order to create onetime passwords..
38
Q

TOTP

A
  • Time-based One-Time Password uses a timestamp and it is valid for a certain time like 30 seconds. The password expires if the user does not use it within the frame.
39
Q

Biometrics

A
  • Face scans
  • Retina scans
  • Iris scans
  • Palm scans
  • Hand geometry
  • Heart/pulse patterns
  • Voice pattern recognition
  • Signature dynamics
  • Keystroke patterns
40
Q

Biometric Factor Error Ratings

A
  • False Rejection Rate - valid subject is not authenticated
  • False Acceptance Rate - invalid subject is authenticated
41
Q

Multifactor Authentication

A
  • Authentication method that uses 2 or more factors to provide authentication.
42
Q

Device Authentication

A
  • Fingerprinting, 802.1x, user logs…
43
Q

Service Authentication

A
  • Usually refers to username and password.
44
Q

Identity Management Implementation

A
  • Centralized access control
  • Decentralized access control
45
Q

Single Sign-On

A
  • Centralized access control method that allows a user to be authenticated once and be able to use multiple resource without authenticating again.
46
Q

LDAP

A
  • Lightweight Directory Access Protocol is a directory for network services and assets.
47
Q

Kerberos

A
  • It is a computer network authentication protocol developed by MIT that offers sign on solution for users and provides protection for logon credentials.
48
Q

Kerberos elements

A
  • Key Distribution Center
  • Kerberos Authentication Server
  • Ticket Granting Ticket
  • Ticket
49
Q

Hypertext Markup Language (HTML)

A
  • It is a major markup language used to display web pages on the internet.
50
Q

Extensible Markup Language (XML)

A
  • It is a language commonly used by data-exchange services to send information between otherwise incompatible systems.
51
Q

Service Provisioning Markup Language

A
  • XML-based language that facilitates the exchange of provisioning information among applications and organizations, corporations, or agencies.
52
Q

Extensible Access Control Markup Language

A
  • It is an open standard XML-based language designed to express security policies and access rights to information for web services, digital rights management, and enterprise security applications.
53
Q

OAuth 2.0

A
  • It is an open standard used for access delegation.
54
Q

OpenID

A
  • It is an open standard and decentralized authentication protocol maintained by the OpenID Foundation.
55
Q

OpenID Connect

A
  • It simple identity layer on top of the OAuth 2.0 protocol autorization framework.
56
Q

Scripted Access

A
  • Logon script meant to establish communication links by providing automated process to transmit credentials at the start of a logon session.
57
Q

Credential Management System

A
  • Storage space for users to keep their credentials when SSO is not available.
58
Q

AAA Protocols

A
  • Authentication, Authorization and Accounting – term used to refer to a family of protocols that mediate network access such as RADIUS and Diameter
59
Q

RADIUS

A
  • Remote Authentication Dial-In User Service is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate users and authorize their access to the requested system or service.
60
Q

Diameter

A
  • Enhanced version of RADIUS that supports a wide range of protocols including traditional IP, Mobile IP, Voice over IP.
61
Q

TACACS+

A
  • Terminal Access Controller Access-Control System refers to a family of related protocols handling remote authentication and related services for networked.
62
Q

Identity and access provisioning lifecycle

A
  • It is a concept that refers to creation, management, and deletion of accounts.
63
Q

Provisioning

A
  • In the context of setting a new account, provisioning refers to assigning appropriate privileges with an account.
64
Q

Account Review

A
  • Review process should be done regularly to ensure that security policies are being followed.
65
Q

Account Revocation

A
  • It is key to revoke accounts for terminated employees due to a risk of a sabotage.
  • Many systems set expiration dates for specific accounts.
66
Q
A

CISSP - 13 - Software Development Security Principles (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions