1 Flashcards
Incident response phases
Preparation
Detection & Analysis
Containment, Eradication & Recovery
Post-event activity
From NiST
Types of halon
1211 only in portable, streaming agent
1301 only in fixed, flooding agent
Sha
Secure Hash Algorithm
Hashing algorithm
20 byte output
AES
Advanced Encryption Standard Original name rijndael Block cipher Block size 128 Key length 128, 192, 256
EAP
Extensible authentication protocol
Used by ppp
Support multi auth mechanisms
Token cards, smart cards, certs, opt, public key enc
Usage gap
Total potential - actual current usage
Used to authent asym keys
Password
Circuit level firewall
Provides udp and tcp connection security
Operates transport and application layers such as session
Stream cipher
Faster than block
PEAP
Protected Extensible Authentication Protocol
Mschap
Gtc
IDEA
International data encryption algorithm
Symmetric block cipher
DES
Data encryption standard
Symmetric block
Blowfish
Symmetric block
Key 32 to 448 bits
Two fish
Symmetric block
Block 128
Key up to 256
ECB
Electronic Code Book
Block Cipher
Same key on each block
CBC
Cipher Block Chaining
Block cipher
Uses IV on first block
Plaintext XORed with previous ciphertext before being encrypted
PCBC
Propagating Cipher Block Chaining
Block Cipher
uses IV on first block
Plaintext XORed with both previous plaintext and previous ciphertext before being encrypted
CFB
Cipher Feedback
makes a block cipher into a self-syncronizing stream cipher
if part of encrypted message lost, only part of decryption lost.
OFB
Output Feedback
makes a block cipher into a synchronous stream cipher
allows many error correction codes to function even when applied before encryption
smart cards
typically credit card sized
embedded IC
some have electrical contacts
does not display
MD5
Message Digest
Hash
128 hash output
SOM
Service-Oriented Modeling
Comprehensive view of analysis, design and arch of all software entities
View software entities as assets referred to as services
SOMF
Service-Oriented Modeling Framework
Modeling language for software development
practices, environments, disciplines, artifacts
SOA Value Proposition
Software Assets reuse
Architectural components abstraction
Business Traceability
IPSEC Authentication Methods
Pre-shared key
Certificate
Kerberos
Kerberos Components
3 main
Authentication Server
Ticket Granting Server
Principles Database
IPComp
IP Payload Compression
SABSA
Sherwood Applied Business Security Architecture
Business driven, risk and opportunity focused security architectures
traceably support business objectives
SSH encrypt options
inlcude AES, Blowfish, 3DES, CAST128, Arcfour (RC4), IDEA
L2TP
layer 2 Tunneling Protocol
operates at layer 2
Extenion of PPTP
Used to enable the operation of a VPN over Internet
Does not provide encryption or confidentiality by itself
IPSec
protocol suite that authenticates and encrypts the packets of data sent over an IP network. used in VPNs.
Mutual Authentication
RC4
aka ARC4
stream cipher
RC5
Rivest Cipher
Symmetric
block cipher
SKA
Shared Key Authentication
WEP encryption key shared in advance
SwIPe
1993
Provides confidentiality, Integrity and authentication with end to end and intermediate hop security
ALE
Annualized Loss Expectency
product of ARO (Annual Rate of Occurance) and SLE (Single Loss Expectancy)
SLE
Single Loss Expectency
ARO
Annual Rate of Occurance
EF
Exposure Factor
Potential percentage of loss if a specific threat is realized
AV
Asset Value
MS-CHAPv2
Provides mutual authentication
Layer 1 protocols
10BaseT
DSL, ISDN
Infrared
Layer 2 protocols
ARP ATM CHAP CDP Ethernet L2TP MAC PPP PPTP STP Spanning Tree Protocol VLAN
Layer 3
network layer NAT AppleTalk IP ICMP ARP RIP OSPF IPSec
Layer 4
Transport Layer ESP NetBios SPX TCP UDP
layer 5
Session Layer - provides session management netbios RPC SMB SOCKS
Layer 6
Presentation layer TLS SSL FTP IMAP SSH
Layer 7
Application Layer SOAP DHCP DNS HTTP/S NFS POP3 SNMP Telnet SSH TFTP
X.25
ITU-T protocol suite for packet switched WAN
Skipjack
used by clipper chip
symmetric block cipher
Clipper Chip
used Skip Jack to encrypt and Diffie Hellman key exchange
MAC
Message Authentication Code
SKIP
Simple Key Management for Internet Protocol
encryption tool used to protect sessionless datagram protocols.
designed to integrate with IPSec
layer 3
ElGamal
Asymetric encryption
based on Diffie Hellman key exchange
Blueprint
A detailed plan or program of action.
overall architecture first, then individual components
Security Architecture
Think of same way home architecture
How many doors and windows are there?
Who is allowed in and out of each opening?
Must people in home identify self before going out and back in?
What possessions need protection?
What people need protection?
