Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

c836 Information Basics > 1 > Flashcards

1 Flashcards

1
Q

to set a limit on the amount of data we expect to receive to set aside storage for that data
*required in most programming languages
* prevents buffer overflows

A

Bounds Checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A type of software development vulnerability that occurs when multiple processes or multiple threads within a process control or share access to a particular resource, and the correct handling of that resource depends on the proper ordering or timing of transactions

A

Race Conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

a type of attack that can occur when we fail to validate the input to our applications or take steps to filter out unexpected or undesirable content

A

Input Validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

a type of input validation attacks in which certain print functions within a programming language can be used to manipulate or view the internal memory of an application

A

Format String Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A type of attack that can occur when we fail to use strong authentication mechanisms for our applications

A

Authentication Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A type of attack that can occur when we fail to use authorization best practices for our applications

A

Authorization Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A type of attack that takes advantage of weaknesses in the software loaded on client machines or one that uses social engineering techniques to trick us into going along with the attack

A

Cryptographic Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A type of attack that takes advantage of weaknesses in the software loaded on client machines or one that uses social engineering techniques to trick us into going along with the attack

A

Client-Side Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

an attack carried out by placing code in the form of a scripting language into a web page or other media that is interpreted by a client browser

A

XSS (Cross Site Scripting)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

an attack in which the attacker places a link on a web page in such a way that it will be automatically executed to initiate a particular activity on another web page or application where the user is currently authenticated

A

XSRF (cross-site request forgery)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

An attack that takes advantage of the graphical display capabilities of our browser to trick us into clicking on something we might not otherwise

A

Clickjacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A type of attack on the web server that can target vulnerabilities such as lack of input validation, improper or inadequate permissions, or extraneous files left on the server from the development process

A

server-side attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Name the 4 main categories of database security issues

A
  1. Protocol issues
  2. unauthenticated access
  3. arbitrary code execution
  4. privilege escalation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A type of tool that analyzes web pages or web-based applications and searches for common flaws such as XSS or SQL injection flaws, and improperly set permissions, extraneous files, outdated software versions, and many more such items

A

web application analysis tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

unauthenticated flaws in network protocols, authenticated flaws in network protocols, flaws in authentication protocols

A

protocol issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

An attack that exploits an applications vulnerability into allowing the attacker to execute commands on a user’s computer.
* arbitrary code execution in intrinsic or securable SQL elements

A

arbitrary code execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An attack that exploits a vulnerability in software to gain access to resources that the user normally would be restricted from accessing.
* via SQL injection or local issues

A

Privilege Escalation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

a security best practice for all software
* the most effective way of mitigating SQL injection attacks

A

validating user inputs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A web server analysis tool that performs checks for many common server-side vulnerabilities & creates an index of all the files and directories it can see on the target web server (a process known as spidering)

A

Nikto (and Wikto)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A well-known GUI web analysis tool that offers a free and professional version; the pro version includes advanced tools for conducting more in-depth attacks

A

burp suite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A type of tool that works by bombarding our applications with all manner of data and inputs from a wide variety of sources, in the hope that we can cause the application to fail or to perform in unexpected ways

A

fuzzer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A tool developed by Microsoft to find flaws in file-handling source code

A

MiniFuzz File Fuzzer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A tool developed by Microsoft to examine source code for general good practices

A

BinScope Binary Analyzer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A tool developed by Microsoft for testing certain pattern-matching expressions for potential vulnerabilities

A

SDL Regex Fuzzer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

CERT, NIST 800, BSI, an organization’s internal coding guidelines

A

good sources of secure coding guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

the process of reducing the number of available avenues through which our OS might be attacked

A

OS hardening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The total of the areas through which our operating system might be attacked

A

attack surface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q
  1. Removing unnecessary software
  2. Removing or turning off unessential services
  3. Making alterations to common accounts
  4. Applying the principle of least privilege
  5. Applying software updates in a timely manner
  6. Making use of logging and auditing functions
A

6 main hardening categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

states we should only allow a party the absolute minimum permission needed for it to carry out its function

A

Principle of Least Privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

A particularly complex and impactful item of malware that targeted the Supervisory Control and Data Acquisition (SCADA) systems that run various industrial processes; this piece of malware raised the bar for malware from largely being a virtual-based attack to actually being physically destructive

A

Stuxnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A type of tool that uses signature matching or anomaly detection (heuristics) to detect malware threats, either in real-time or by performing scans of files and processes

A

anti-malware tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

the process of anomaly detection used by anti-malware tools to detect malware without signatures

A

heuristics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A hardware and software-based technology that prevents certain portions of the memory used by the operating system and applications from being used to execute code

A

executable space protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

The act of inputting more data than an application is expecting from a particular input, creating the possibility of executing commands by specifically crafting the excess data

A

buffer overflow (overrun)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

a security method that involves shifting the contents of memory around to make tampering difficult

A

ASLR (Address Space Layout Randomization)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

This type of firewall generally contains a subset of the features on a large firewall appliance but is often capable of similar packet filtering and stateful packet inspection activities

A

software firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

a system used to analyze the activities on or directed at the network interface of a particular host.
* may communicate with management device by sending regular beacons

A

HIDS (host-based intrusion detection system)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

a type of tool that can detect various security flaws when examining hosts

A

scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

A tool that is aimed specifically at the task of finding and reporting network services on hosts that have known vulnerabilities

A

vulnerability assessment tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

A well-known vulnerability assessment tool that includes a port scanner

A

Nessus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

A group of tools that can include network mapping tools, sniffers, and exploits

A

exploit framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

small bits of software that take advantage of flaws in software/applications in order to cause them to behave in ways that were not intended by their creators

A

exploits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Name 3 examples of exploit frameworks

A

Metasploit, Immunity CANVAS, Core Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

This method of security involves a well-configured and patched network, and incorporating elements such as network segmentation, choke points, and redundancy

A

security in network design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

The act of dividing a network into multiple smaller networks, each acting as its own small network (subnet)

A

network segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

certain points in the network, such as routers, firewalls, or proxies, where we can inspect, filter, and control network traffic

A

choke points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

a method of security that involves designing a network to always have another route if something fails or loses connection

A

redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

a mechanism for maintaining control over the traffic that flows into and out of our networks

A

firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

A firewall technology that inspects the contents of each packet in network traffic individually and makes a gross determination (based on source and destination IP address, port number, and the protocol being used) of whether the traffic should be allowed to pass

A

packet filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

a firewall that can watch packets and monitor the traffic from a given connection

A

SPI (Stateful Packet Inspection)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

a firewall technology that can analyze the actual content of the traffic that is flowing through

A

DPI (Deep Packet Inspection)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

a specialized type of firewall that can serve as a choke point, log traffic for later inspection, and provides a layer of security by serving as a single source of requests for the devices behind it

A

proxy server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

a combination of a network design feature and a protective device such as a firewall.
Often used for systems that need to be exposed to external networks but are connected to our own network (such as a web server)

A

DMZ (demilitarized zone)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

A system that monitors network traffic and alerts for unauthorized activity

A

NIDS (Network intrusion detection system)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

An IDS that maintains a database of signatures that might signal a particular type of attack and compares incoming traffic to those signatures

A

signature-based IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

an IDS that takes a baseline of normal network traffic and activity and measures current traffic against this baseline to detect unusual events

A

anomaly-based IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

an encrypted connection between two points

A

VPN (Virtual Private Network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

protocol used to secure traffic in a variety of ways, including file transfers and terminal access. uses RSA encryption (asymmetric encryption)

A

SSH (Secure Shell)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

a phrase that refers to an organization’s strategy and policies regarding the use of personal vs. corporate devices

A

BYOD (bring your own device)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

a solution that manages security elements for mobile devices in the workplace

A

MDM (mobile device management)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

a well-known Linux sniffing tool used to detect wireless access points

A

kismet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

A Windows tool used to detect wireless access points

A

NetStumbler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

A well-known port scanner that can also search for hosts on a network, identify the operating systems those hosts are running, detect the version of the services running on any open ports, and more

A

nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

this type of tool can intercept traffic on a network; listens for any traffic that the network interface of our computer or device can see

A

packet sniffer (aka network or protocol analyzer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

classic, command-line sniffing tool that monitors network activities, filters traffic, and more
runs on UNIX systems

A

tcpdump (WinDump for Windows)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

a graphical interface protocol sniffing tool that is capable of filtering, sorting, & analyzing both wired and wireless traffic - popular troubleshooting tool

A

Wireshark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

A type of tool that deliberately displays vulnerabilities or attractive data so it can detect, monitor, and sometimes tamper with the activities of an attacker

A

honeypot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

A tool used to test the security of firewalls and map network topology.
- constructs specially crafted ICMP packets to evade measures to hide devices behind firewall
- scripting functionality to test firewall/IDS

A

hping3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

A type of security that is concerned with the protection of people, equipment, and data

A

physical security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

the plans we put in place to ensure that critical business functions can continue operations in the event of an emergency

A

BCP (Business Continuity Plan)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

the plans we put in place in preparation for a potential disaster, and what exactly we will do during and after

A

DRP (Disaster Recovery Plan)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

extreme temperature, gases, living organisms, projectiles, movement, energy anomalies, people, toxins, smoke, and fire

A

major categories of physical threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

The devices, systems, people, and other methods we put in place to ensure our security in a physical sense

A

physical security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

name the 3 main types of physical controls

A
  1. deterrent
  2. detective
  3. preventive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Controls designed to discourage those who might seek to violate our security controls

A

deterrent controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

controls designed to detect and report undesirable events that are taking place

A

detective controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Controls designed to physically prevent unauthorized entities from breaching our physical security

A

preventive controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Data that is unintentionally left behind on a storage device

A

residual data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Name the 3 main considerations for protecting people

A
  1. Safety
  2. evacuation plans
  3. administrative controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Name the 3 main considerations for protecting data

A
  1. availability
  2. residual data
  3. backups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Name the considerations for protecting equipment

A

equipment, facility repair/replacement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

storage media that is least sensitive to temperature, humidity, magnetic fields, and impacts

A

flash media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

a data storage virtualization technology that combines multiple physical disk drive components into a single logical unit for the purposes of data redundancy, performance improvement, or both.

A

RAID (redundant array of inexpensive disks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

protecting data, passwords, social engineering, network usage, malware, the use of personal equipment, clean desk, policy knowledge

A

most common security awareness issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

a security awareness issue that is concerned with the criticality of carefully handling data from the perspectives of compliance, as well as reputation and customer retention

A

protecting data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

a security awareness issue that involves educating users of the importance of strong passwords and password handling best practices

A

passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

techniques used by an attacker that rely on the willingness of people to help others

A

social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

A technique involving a fake identity & a believable scenario that elicits the target to give out sensitive information or perform some action which they would not normally do for a stranger

A

pretexting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

a social engineering technique that uses electronic communications (email, text, phone calls) to convince a potential victim to give out sensitive information or perform some action

A

phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

a social engineering techniqe that targets a specific company, organization, or person, and involves knowing specifics about the target to appear valid

A

spearphishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

a method by which a person follows directly behind another person who authenticates to the physical access control measure, thus allowing the follower to gain access without authenticating

A

tailgating (piggybacking)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

a security awareness issue that involves educating users about security issues around connecting devices to networks, such as connecting outside devices to the corporate network, and connecting corporate resources to a public network

A

network usage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

a security awareness issue that involves educating users about malicious software and how to avoid it

A

malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

security awareness issue that is concerned with protecting a company’s assets

A

use of personal equipment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

a security awareness issue that requires users to protect sensitive information at all times, even when away from one’s desk

A

clean desk policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

a security awareness issue that is necessary to maintain compliance throughout the organization

A

policy and regulatory knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

a program that seeks to make users aware of the risk they are accepting through their current actions and attempts to change their behavior through targeted efforts

A

SATE (Security Awareness, Training and Education)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

the process we use to protect our information

A

OPSEC (Operations Security)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

A Chinese military general from 6th century BC who wrote The Art of War, a text that shows early examples of operations security principles

A

Sun Tzu

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

The codename of a study conducted to discover the cause of an information leak during the Vietnam War; is now a symbol of OPSEC

A

Purple Dragon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

the process of intelligence gathering and analysis in order to support business decisions

A

competitive intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

5 steps of the operations security process (OPSEC)

A

1.Identification of critical information
2.Analysis of threats
3.Analysis of vulnerabilities
4.Assessment of risks
5.Application of countermeasures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

If you don’t know the threat, how do you know what to protect?

A

The 1st Law of Haas’ Laws of Operations Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

If you don’t know what to protect, how do you know you are protecting it?

A

The 2nd Law of Haas’ Laws of Operations Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

If you are not protecting it, the dragon wins!

A

The 3rd Law of Haas’ Laws of Operations Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

services that are hosted, often over the Internet, for the purposes of delivering easily scaled computing services or resources

A

cloud computing

107
Q

1st step in the OPSEC process, arguably the most important: to identify the assets that most need protection and will cause us the most harm if exposed

A

identification of critical information

108
Q

2nd step in the OPSEC process: to look at the potential harm or financial impact that might be caused by critical information being exposed, and who might exploit that exposure

A

analysis of threats

109
Q

3rd step in the OPSEC process: to look at the weaknesses that can be used to harm us

A

analysis of vulnerabilities

110
Q

4th step in the OPSEC process: to determine what issues we really need to be concerned about (areas with matching threats and vulnerabilities)

A

assessment of risks

111
Q

5th step in the OPSEC process: to put measures in place to mitigate risks

A

appliance of countermeasures

112
Q

this law provides a framework for ensuring the effectiveness of information security controls in federal government - changed from Management (2002) to Modernization in 2014

A

FISMA (Federal Information Security Modernization Act)

113
Q

this law improves the efficiency and effectiveness of the health care system and protects patient privacy

A

HIPAA (Health Insurance Portability and Accountability Act)

114
Q

this law protects the privacy of students and their parents

A

FERPA (Family Educational Rights and Privacy Act)

115
Q

this law regulates the financial practice and governance of corporations

A

SOX (Sarbanes-Oxley Act)

116
Q

this law protects the customers of financial institutions

A

GLBA (Gramm-Leach-Bliley Act)

117
Q

relating to an organization’s adherence to laws, regulations, and standards

A

compliance

118
Q

Regulations mandated by law usually requiring regular audits and assessments

A

regulatory compliance

119
Q

Regulations or standards designed for specific industries that may impact ability to conduct business (e.g. PCI DSS)

A

industry compliance

120
Q

the state or condition of being free from being observed or disturbed by other people

A

privacy

121
Q

This act safeguards privacy through the establishment of procedural and substantive rights in personal data

A

The Federal Privacy Act of 1974

122
Q

Rights relating to the protection of an individual’s personal information

A

privacy rights

123
Q

Information that can be used to identify an individual, and should be protected as sensitive data and monitored for compliance

A

PII (Personally Identifiable Information)

124
Q

the science of keeping information secure

A

cryptography

125
Q

The science of breaking through the encryption used to create ciphertext

A

Cryptanalysis

126
Q

The overarching field of study that covers cryptography and cryptanalysis

A

cryptology

127
Q

The specifics of the process used to encrypt plaintext or decrypt ciphertext

A

cryptographic algorithm (cipher)

128
Q

unencrypted data

A

plaintext (cleartext)

129
Q

encrypted data

A

ciphertext

130
Q

an ancient cryptographic technique based on transposition; involves shifting each letter of a plaintext message by a certain number of letters (historically 3)

A

Caesar cipher

131
Q

a more recent cipher that uses the same mechanism as the Caesar cipher but moves each letter 13 places forward

A

ROT13 cipher

132
Q

uses a single key for both encryption of the plaintext and decryption of the ciphertext

A

symmetric key cryptography (private key cryptography)

133
Q

A type of cipher that takes a predetermined number of bits in the plaintext message (commonly 64 bits) and encrypts that block

A

block cipher

134
Q

A type of cipher that encrypts each bit in the plaintext message, 1 bit at a time

A

stream cipher

135
Q

A set of symmetric block ciphers endorsed by the US government through NIST. Shares the same block modes that DES uses and also includes other modes such as XEX-based Tweaked CodeBook (TCB) mode

A

AES (Advanced Encryption Standard)

136
Q

this method uses 2 keys, a public key and a private key

A

asymmetric key cryptography (public key cryptography)

137
Q

a protocol that uses the RSA algorithm (an asymmetric algorithm) to secure web and email traffic

A

SSL (secure sockets layer)

138
Q

keyless cryptography that creates a largely unique and fixed-length hash value based on the original mesage

A

hash function (message digest)

139
Q

used to determine whether the message has changed; provides integrity (but not confidentiality)

A

hash

140
Q

a method of securing a message that involves generating a hash and encrypting it using a private key

A

digital signature

141
Q

created to link a public key to a particular individual;
used as a form of electronic identification for that person

A

certificate

142
Q

a trusted entity that handles digital certificates

A

CA (certificate authority)

143
Q

infrastructure that includes the CAs that issue and verify certificates and the RAs that verify the identity of the individuals associated with the certificates

A

PKI (public key infrastructure)

144
Q

An authority in a PKI that verifies the identity of the individual associated with the certificate

A

RA (registration authority)

145
Q

a public list that holds all the revoked certifications for a certain period of time

A

CRL (Certificate Revocation List)

146
Q

Data that is on a storage device of some kind and is not moving

A

data at rest

147
Q

Data that is moving over a WAN or LAN, a wireless network, over the internet, or in other ways

A

data in motion

148
Q

This type of data is protected using data security (encryption) and physical security

A

data at rest

149
Q

This type of data is the hardest to protect

A

data in use

150
Q

a subset of cryptography that refers specifically to the transformation of unencrypted data into its encrypted form

A

encryption

151
Q

decryption
The process of recovering the plaintext message from the ciphertext

A

decryption

152
Q

a set of methods we use to establish a claim of identity as being true - corroborates the identity of an entity, whether it is the sender, the sender’s computer, some device, or some information

A

authentication

153
Q

An asymmetric encryption algorithm that uses smaller key sizes and requires less processing power than many other encryption methods.
commonly used in smaller wireless devices

A

ECC (Elliptic Curve Cryptography)

154
Q

this provides us with the means to trace activities in our environment back to their source

A

accountability

155
Q

Refers to a situation in which sufficient evidence exists as to prevent an individual from successfully denying that he or she has made a statement, or taken an action

A

nonrepudiation

156
Q

refers to elements that discourage or prevent misbehavior in our environments

A

deterrence

157
Q

a tool that alarms and takes actions when malicious events occur

A

IDS (intrusion detection system)

158
Q

a methodical examination and review that ensures accountability through technical means;
ensures compliance with applicable laws, policies, and other bodies of administrative control, and detects misuse

A

auditing

159
Q

A process that provides a history of the activities that have taken place in the environment

A

logging

160
Q

a subset of auditing that focuses on observing information about the environment in order to discover undesirable conditions such as failures, resource shortages, security issues, and trends

A

monitoring

161
Q

An activity involving the careful examination of our environment using vulnerability scanning tools in order to discover vulnerabilities

A

vulnerability assessment

162
Q

A more active method of finding security holes that includes using the kinds of tools attackers use to mimic an attack on our environment

A

penetration testing

163
Q

a record of where evidence was and how it was passed and protected;
required by courts for admissibility of records

A

chain of custody

164
Q

enables us to determine what users are allowed to do

A

authorization

165
Q

States that we should allow only the bare minimum access required in order for a given party (person, user account, or process) to perform a needed functionality

A

principle of least privilege

166
Q

the act of doing something that is prohibited by law or rule

A

violation

167
Q

An act that grants a particular party access to a given resource

A

allowing access

168
Q

an act that prevents a party from accessing something, such as logging on to a machine or entering the lobby of our building after hours

A

denying access

169
Q

An act that allows some access to a given resource, but only up to a certain point

A

limiting access

170
Q

A set of resources devoted to a program, process, or similar entity, outside of which the entity cannot operate

A

sandbox

171
Q

the ability to remove access from a resource at any point in time

A

revocation

172
Q

typically built to a certain resource, these contain the identifiers of the party allowed to access the resource and what that party is allowed to do

A

ACL (Access Control List)

173
Q

in this method of security, a person’s capabilities are oriented around the use of a token that controls their access (e.g. a personal badge)

A

capability-based security

174
Q

A type of attack that is more common in systems that use ACLs rather than capabilities;
- when software has greater permissions than user, the user can trick the software into misusing authority

A

confused deputy problem

175
Q

a type of attack that misuses the authority of the browser on the user’s computer

A

CSRF (Cross Site Request Forgery)

176
Q

client-side attack that involves the attacker placing an invisible layer over something on a website that the user would normally click on in order to execute a command differing from what a user thinks they are performing
- takes advantage of some of the page rendering features that are available in newer browsers

A

clickjacking (user interface redressing)

177
Q

access control model in which access is determined by the owner of the resource in question
- e.g. network share permissions

A

DAC (Discretionary Access Control)

178
Q

access control model in which access is based on attributes (of a person, a resource, or an environment)

A

ABAC (attribute-based access control)

179
Q

access is based on the role the individual is performing
- similar to MAC in that access controls are set by an authority responsible for doing so, rather than by the owner of the resource

A

RBAC (Role Based Access Control)

180
Q

Attributes of a particular individual, such as height

A

subject attributes

181
Q

Attributes that relate to a particular resource, such as operating system or application

A

resource attributes

182
Q

Attributes that relate to environmental conditions, such as time of day or length of time

A

environmental attributes

183
Q
  • Designed to prevent conflicts of interest
  • commonly used in industries that handle sensitive data
  • 3 main resources classes are considered in this model: objects, company groups, and conflict classes
A

Brewer and Nash model

184
Q

A combination of DAC and MAC, primarily concerned with the confidentiality of the resource.
- 2 security properties define how information can flow to and from the resource: the simple security property and the * property

A

Bell-LaPadula Model

185
Q

Primarily concerned with protecting the integrity of data, even at the expense of confidentiality.
- 2 security rules: the simple integrity axiom and the * integrity axiom

A

Biba model

186
Q

A method by which a person follows directly behind another person who authenticates to the physical access control measure, thus allowing the follower to gain access without authenticating

A

Tailgating

187
Q

Access controls that regulate movement into and out of building or facilities

A

Physical access controls

188
Q

An access control model that includes many tiers of security and is used extensively by military and government organizations and those that handle data of a very sensitive nature

A

Multilevel access control model

189
Q

Access control model in which access is decided by a group or individual who has the authority to set access on resources

A

MAC (Mandatory Access Control)

190
Q

Something that supports our claim to identity, either in our personal interactions or in computer systems, e.g. social security cards

A

identity verification

191
Q

the claim of what someone or something is

A

identification

192
Q

Authentication requirements help prevent this crime

A

Falsifying Identification

193
Q

A password is an example of this type of factor

A

Something you know

194
Q

An iris scan is an example of this type of factor

A

something you are

195
Q

A swipe card is an example of this type of factor

A

something you have

196
Q

The time delay between your keystrokes is an example of this type of factor

A

something you do

197
Q

Being at a specific terminal is an example of this type of factor

A

where you are

198
Q

An authentication mechanism in which both parties authenticate each other
-can prevent a man-in-the-middle attack

A

multifactor authentication

199
Q

a password that is a combination of uppercase letters, lowercase letters, numbers, and symbols, such as punctuation marks

A

elements of a complex password

200
Q

Unique physical characteristics of an individual, such as the color patterns in an iris, fingerprints, or handprints

A

biometrics

201
Q

a stipulation that our chosen biometric characteristic should be present in the majority of people we expect to enroll in the system

A

universality

202
Q

a measure of the differences of a particular characteristic among a group of individuals

A

uniqueness

203
Q

how well a particular characteristic resists change over time and with advancing age

A

permanence

204
Q

How easy it is to acquire a characteristic that we can later use to authenticate a user

A

collectability

205
Q

A set of metrics that judge how well a given system functions

A

performance measurement

206
Q

A measure of how agreeable a particular characteristic is to the users of a system

A

acceptability

207
Q

Describes the ease with which a system can be tricked by a falsified biometric identifier

A

circumvention

208
Q

the rate at which we accept users whom we should actually have rejected

A

FAR (false acceptance rate)

209
Q

the rate at which we reject legitimate users when we should have accepted them

A

FRR (false rejection rate)

210
Q

protects information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction

A

Information Security

211
Q

companies that process credit card payments must comply with this set of standards

A

PCI DSS (Payment Card Industry Data Security Standard)

212
Q

the act of holding information in confidence, not to be released to unauthorized individuals
-a necessary component of privacy

A

Confidentiality

213
Q

refers to the ability to prevent our data from being changed in an unauthorized or undesirable manner

A

integrity

214
Q

refers to the ability to access our data when we need it

A

availability

215
Q

a type of attack, primarily against confidentiality

A

interception

216
Q

something that has the potential to cause harm to our assets

A

threat

217
Q

a weakness that can be used to harm us

A

vulnerability

218
Q

the likelihood that something bad will happen

A

risk

219
Q

involves considering the value of the asset being threatened to assess risk
-sometimes added to the threat/vulnerability/risk equation

A

impact

220
Q

An attack that causes our assets to become unusable or unavailable for our use, on a temporary or permanent basis
-primarily affects availability
-can affect integrity

A

interruption attack

221
Q

A model that adds three more principles to the CIA triad: possession or control, utility, and authenticity

A

Parkerian hexad

222
Q

the physical disposition of the media on which the data is stored

A

possession/control

223
Q

allows for attribution as to the owner or creator of the data in question

A

authenticity

224
Q

refers to how useful the data is to us

A

utility

225
Q

An attack that involves generating data, processes, communications, or other similar activities with a system;
- affects primarily integrity and availability

A

fabrication attack

226
Q

One of the first and most important steps of the risk management process

A

identify assets

227
Q

A multilayered defense that will allow us to achieve a successful defense should one or more of our defensive measures fail

A

defense in depth

228
Q

based on rules, laws, policies, procedures, guidelines, and other items that are “paper” in nature

A

administrative controls

229
Q

controls that protect the systems, networks, and environments that process, transmit, and store our data

A

logical controls (technical controls)

230
Q

Controls that protect the physical environment in which our systems sit, or where our data is stored

A

physical controls

231
Q

Involves putting measures in place to help ensure that a given type of threat is accounted for

A

mitigating risk

232
Q

The risk management phase that consists of all of the activities that we can perform in advance of the incident itself, in order to better enable us to handle it

A

preparation phase

233
Q

The risk management phase where we detect the occurrence of an issue and decide whether it is actually an incident so that we can respond to it appropriately

A

detection and analysis phase

234
Q

The risk management phase where we determine specifically what happened, why it happened, and what we can do to keep it from happening again

A

post-incident activity phase

235
Q

to completely remove the effects of the issue from our environment

A

eradication

236
Q

taking steps to ensure that the situation does not cause any more damage than it already has, or at the very least, lessen any ongoing harm

A

containment

237
Q

restore to a better state (either the state prior to the incident, or if we did not detect the problem immediately, prior to when the issue started)

A

recovery

238
Q

EU regulation that safeguards personally identifiable information

A

EU Directive 95/46/EC

239
Q

Detects wireless access points and analyzes network traffic. Useful for surveying a network to understand its wireless security footprint.

A

Kismet/Netstumbler

240
Q

Scans networks to identify active hosts and open ports. Employed for initial network reconnaissance and security auditing.

A

NMAP

241
Q

A packet sniffer and protocol analyzer for real-time network monitoring. Ideal for diagnosing network issues or analyzing security incidents.

A

WireShark

242
Q

A Unix/Linux command-line packet capture tool. Helpful for real-time network troubleshooting and capturing packets for later analysis.

A

TCPDump

243
Q

Decoy systems to lure attackers away from legitimate targets. Useful for studying attacker behaviors and tactics.

A

Honeypots

244
Q

Crafts custom ICMP, UDP, and TCP packets to test firewalls. Employed to identify vulnerabilities or misconfigurations in firewall rules.

A

Hping3

245
Q

Provides hardware-level buffer overflow protection in Intel chipsets. Useful for preventing malicious code execution at the system level.

A

Intel Executable Disable (XD)

246
Q

Randomizes memory locations for process execution, offering buffer overflow protection. Effective against exploits aiming to predict memory addresses.

A

Address Space Layout Randomization (ASLR)

246
Q

Offers chipset-level buffer overflow protection for AMD processors. Acts as a hardware-level security feature against certain types of attacks.

A

AMD Enhanced Virus Protection

247
Q

A Tenable product for vulnerability assessment, it scans networks to identify security risks. Ideal for regular security audits.

A

Nessus

248
Q

Vulnerability assessment tool by Immunity, designed for identifying network and system weaknesses. Useful for enterprise security audits.

A

CANVAS

248
Q

A penetration testing framework that includes tools and exploits for security assessments. Can be used to simulate cyber-attacks to test network resilience

A

Metasploit

249
Q

Analyzes web servers and identifies security issues like outdated software and misconfigurations. Effective for hardening web servers before deployment.

A

Nikto and Wikto

250
Q

A web security testing platform for web application vulnerabilities. Ideal for security assessments of web-based applications.

A

Burp Suite

250
Q

Automated tools for identifying vulnerabilities by inputting unexpected data. Helpful for discovering unknown issues like crashes or security flaws in software.

A

Fuzzers (MiniFuzz, Binscope, Regex Fuzzer)

251
Q

Open-source vulnerability scanning and management software. Useful for detecting vulnerabilities in your network before they can be exploited.

A

OpenVAS

252
Q

Intrusion Detection System (IDS) that monitors network traffic in real-time for malicious activities. Employed for real-time threat detection and prevention.

A

Snort

252
Q

Advanced password recovery and cracking tool. Useful for assessing the strength of passwords by attempting to crack hashed password files.

A

Hashcat

253
Q

Password cracking software designed to identify weak passwords by using various attack methods. Effective for security audits to improve password policies.

A

John the Ripper

254
Q

Cuckoo Sandbox

A

Malware analysis tool that isolates suspicious files in a secure environment. Useful for understanding the behavior of unknown or potentially harmful files.

255
Q

Federal Information Security Management Act: Mandates a comprehensive framework to protect government information, operations, and assets.

A

FISMA

256
Q

Health Insurance Portability and Accountability Act: Regulates the use and disclosure of sensitive patient health information.

A

HIPAA

257
Q

Family Educational Rights and Privacy Act: Governs the protection of student education records and grants specific rights to students.

A

FERPA

257
Q

The Sarbanes-Oxley Act: Imposes regulations on financial reporting to improve the accuracy and integrity of corporate disclosures.

A

SOX

258
Q

The Gramm-Leach-Bliley Act: Requires financial institutions to explain their data-sharing practices and safeguard sensitive data.

A

GLBA

c836 Information Basics (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions