10 Data Security - Defense Flashcards
1
Q
What are the managements tasks for IT security?
1.
2.
3.
4.
5.
A
- risk analysis
- adoption of guidelines
- sensitisation of employees
- establishment of IT security management
- identification and implementation of operational measures
2
Q
What are typical operational measures for IT security?
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
A
- access controls (for hardware software and rooms, e.g. by passwort ,ID card, key, …)
- restircted user rights (same as access controls but specifically for operating systems and user sofrtware)
- restrictive configuration (i.e. restrictive as in doubt, restrict rights
- keeping software up to date (hard to maintain up-to-dateness and security)
- deleting outdated software (risk assessment should be carried out as to whether investment should be made in new software - cf. WannaCry Virus)
- create backup cookies (regular checks; should be stored in a way that attack does not destroy; must not collide wirth data privacy)
- anti-virus software (data from external sources will be checked)
- additional: virus scan on computer
- run firewalls
- use sandboxes
- disable active content
- encrypt sensitive data (passwords, files, hard disks)
3
Q
Why is authentizitation with a password weak and what would be a higher security level?
1.
2.
3.
4.
A
- safety is only based on knowledge of a password (could be guessed or intercepted)
- higher security level: property or ohysical characteristic (USB key, EC-card / fingerprint, iris, voice)
- strong authentizitation is based on not only one but several measures
- e.g. two factor authentizitation is based on two measures (Smartcard as property and PIN as knowledge)
4
Q
Should servers store your passwort?
A
- ideally, the server should encrypt the password before storing it (with help of the Hash-algorithmns)
5
Q
What would be a safe password?
1.
2.
3.
4.
A
- consists of ~12 characters
- numbers, letters and special characters
- not party of any dictionary
- no reuse of password for different digital identities
6
Q
What is a systematic try-out when it comes to passwords?
A
- dictionary attack: at the beginning words from dictionaries are used
- brute force attack- first easy and short, then all combinations of characters are tried out
