1: 6 Understanding Vulnerability Types Flashcards
What is the cybersecurity CIA Triad?
Confidentiality, Integrity, Availability
Confidentiality
Protects information from unsecure eyes
Integrity
Protects information from unauthorized modification
Availability
Ensures information available when needed
What are the different types of risks an organization might face due to cybersecurity threats?
Financial, Reputational, Strategic, Operational, Compliance
Financial Risk
Monetary loss to the organization
Reputational Risk
Loss of goodwill due to loss of reputation regarding an organization
Strategic Risk
Jeopardizes the ability to meet our major goals and objectives
Operational Risk
Threatens ability to carry out day-to-day activities
Compliance Risk
Running afoul of regulatory or legal requirements
End of Sale
Vendor will still support the product
End of Support
Vendor will discontinue some/all support
End of Life
Vendor will no longer release updates
What are 2 risks associated with vendors?
Understaffed- Inadequate support for existing products
Embedded Systems not being disclosed
Default Configurations
Using misconfigured firewalls, open permissions, default passwords, unsecured root accounts leading to vulnerabilities
What is the best way to avoid default configuration vulnerabilities?
Follow documented security standards and baselines when configuring systems and applications
Cryptographic Vulnerabilities
Weak cipher suites/weak cryptographic protocol implementations lead to vulnerable communications
Patch Management
Ensures all systems get patches to avoid vulnerabilities
Account Management
People can knowingly/accidentally cause damage with too much access
Principle of least Privilege
Limiting the access of people to the minimum needed to complete their duties
Architectural Vulnerabilities
Complex systems improperly designed
What is the best way to protect against Architectural Vulnerabilities
Incorporate security requirements early
System Sprawl
When devices not being disconnected after their use, leading to vulnerabilities. System sprawl is most dangerous when assets are undocumented .
Which triad component does Disclosure Attacks target?
Confidentiality
Which triad component does Alteration Attacks target?
Integrity
Which triad component does Denial Attacks target?
Availability
