.04 RG Vocab system security - linux Flashcards
Source code
Programming code in text format compiled into software you can run
GNU
Not UNIX; recognized as the start of the Open-Source Movement in 1983. GNU
software is included with the Linux kernel in the form of distribution or distros.
Linux
Operating system kernel released in 1991 named after Linus Torvalds
Open source
Describes software that allows the end user to have access to the source
code and the freedom to change and implement that software based on a less restrictive
license than closed-source software. Examples: GNU Core Utilities, Linux, FreeBSD
Closed source
Describes software that gives the end user little to no access to the source
code and limited freedom to change and implement that software based on a very restrictive
license compared to open-source licenses. Examples: Microsoft, UNIX, IBM z/OS
Linux kernel
A foundational Linux component responsible for the low-level interface
between an operating system and hardware
Bootloader
Code run by a computer after it starts. The bootloader can then be pointed to
the Linux kernel on storage/disk to start the Linux kernel (i.e., bootstrapping).
Drivers
Software that makes computer devices available for use by applications. File system
drivers “present” the filesystem to applications that save files.
Network
Allows applications to communicate from a computer to other computers over
wired (Ethernet) and wireless networks (IEEE 802.11)
Linux Security Modules (LSM)
Primarily designed as enhanced access control
mechanisms called mandatory access control (MAC); includes AppArmor, SELinux, Smack,
and TOMOYO. Do not confuse this MAC with the layer 2 media access control addresses in
Ethernet.
Processes, instances, and threads
Hardware resources and “time” to run (i.e., an
instance) allocated by an operating system when code is run. This process can perform
multiple activities, which are known as threads.
Sessions
Consists of a group of processes. When users log in, applications and services
(known as daemons) are instantiated and grouped into process groups.
tty, pty
Teletype and pseudo-teletype; terminal types used for interactive CLI and GUI
applications
Service (daemon)
A process that involves no interaction with a user
Applications
Any process that the user can interact with
Password
A series of characters known by a user and used in conjunction with user
accounts to assure a user’s identity
Login prompt
Triggers applications and services (daemons) to instantiate and group into
process groups when a user logs in
Command-line interface (CLI)
A user interface that allows for typing commands within a
Linux system; starts on bootup or launches from the graphical user interface (GUI) via the
terminal emulator application
Graphical user interface (GUI)
A user interface that provides interaction with a windowed
environment to launch applications with a pointing device (e.g., a mouse); generally starts on
bootup
GNU Core Utilities (coreutils)
A foundational Linux component that provides common
commands integrated with the command-line interface (CLI). The coreutils package contains
many common commands that include but are not limited to ls, mv, cp, touch, cat, and pwd.
X server
A foundational Linux distro component that provides a graphical user interface
(GUI)
Package management
A foundational component that provides software and service
installation, updates, and removal
Client
Requests resources or services from a server
Server
Provides resources or services for a client
Protocols
Used by computer systems to agree on how to communicate with one another
over a network
Vulnerabilities
Weakness in software or a system
Threats
Actor that seeks to exploit vulnerabilities
Exploits
An action taken by an actor to compromise a system by using vulnerabilities
Ransomware
Malware used to deprive organizations of access to their information until
they pay a ransom
Bot
A system infected by malware that allows for remote command and control (C&C) of the
infected systems
C&C
Command and control or C2; refers to systems that control already infected systems
(bots) to launch various attacks (e.g., a DDoS or a coin-mining operation)
Worms
Malware that propagates by detecting other systems on a network with specific
vulnerabilities and then by replicating its code on the system to exploit those vulnerabilities
Shellshock
A vulnerability that existed for 30 years before being noticed in 2014; remains
an enterprise threat. Shellshock exploits a BASH vulnerability to provide an attacker with
elevated privileges that they would not have otherwise.
Distributed Denial of Service (DDoS)
An attack that uses C&C and bots to send traffic to
systems that overwhelm those systems
Kali Linux
A popular Linux distro that includes many useful security tools
hashcat
An advanced password recovery utility that can determine the strength of
passwords based on the amount of time it takes to crack the password
Endpoint security
Security controls installed on endpoint systems, such as computers
ClamAV
A toolkit and malware detection engine that can quickly scan files
Firewall
A system or device that has configurable rules that protect systems from other
hosts on the network
iptables
A firewall software package for Linux systems
DDoS mitigation
The people, processes, and technology involved in thwarting a DDoS
attack
Hardening
An all-encompassing term that describes tools, controls, and processes used to
increase infrastructure security
User configuration
Proper password rules and user setup, which are critical to server
security and required in modern server software
Business requirements
The processes, assets, people, and practices that are necessary
for a business to operate and that must be considered when assessing security updates
“Over hardening”
Occurs when the application of security controls impacts the ability of
users to work on a system (i.e., availability is impacted)
“Under hardening”
Occurs when there are insufficient security controls in place to address
risks identified in the risk management process
Access control
A security control that endeavors to limit access to individuals who need
permission to obtain specific information
Baselining
A standard set of security configurations applied to a set of similar systems in an
organization
Security controls
Any administrative, technological, or physical controls used to implement
proper security
Host firewall
A generic term for a firewall installed on a host system. Example:
iptables/nftables
Patching
Software updates that remediate security vulnerabilities
Center for Internet Security (CIS) Benchmarks
Industry practice security configurations.
Three profiles are available: Level 1, Level 2, and STIG. Each profile addresses specific
organizational and system risks that find the right hardening balance.
