Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > 1.2 Summarize fundamental security concepts > Flashcards

1.2 Summarize fundamental security concepts Flashcards

1
Q

Confidentiality

A

Information is accessible only to authorized personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Integrity

A

data remains accurate and unaltered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

availability

A

data and resources are accessible when needed (e.g redundancy measure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How do we achieve Availability

A

Redundancy : back up options of critical components or functions of system with the intention of enhancing its reliability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Various type of redundancy

A

Server Redundancy
Data Redundancy
Network Redundancy
Power Redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Non Repudiation

A

provides proof of the origin, authenticity and integrity of data.
can’t deny having performed an action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How do we achieve Non Repudiation

A

Digital Signature : hashing then, encrypting the hash digest with the user private key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why Non Repudiation is important

A
  • Confirming the authenticity of Digital Signature
  • Ensuring Integrity
  • Providing Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Authentication

A

Verifying the identity of individuals or entities in digital interactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Five commonly used authentication methods

A

Something you know : knowledge factor ( username, password

Something you have : possession factor, physical item ( ID, phone)

Something you are : Inherence factor :unique physical or behavioral characteristics ( biometric authentication )

Something you do : Action factor, user conducting a unique action

Somewhere you are : location factor user being in certain geographic location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

2FA and MFA

A

Two authentication method

Two or more authentication methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why authentication is critical

A
  • Prevent unauthorized access
  • protect user data and privacy
  • Ensure resources validity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Authorization

A

Determining actions or resources an authenticated user can access (permission: who can access what)

Set of rules and policies to dictate who can access, or modify what.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authorization mechanisms

A

role-based
rule- based
attribute - based controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why authorization is important

A
  • protect sensitive data
  • maintain system integrity
  • create more streamline the user experience
    serve as gatekeeper
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Accounting

A

all user activities are properly tracked and recorded ( monitoring and logging)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

why we need accounting

A

to achieve
- transparency
- Security
- Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are we accounting in the system

A

logging and accessing files
modifying configurations
downloading or installing software
attempting unauthorized actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what are some of accounting systems

A

Audit Trail ( chronological record of all user activities)

Regulatory Compliance : maintain a comprhensive record of all the users’ activities.

Forensic Analysis: detail accounting and event logs

Resource Optimization : tracking resource utilization and allocation decision

User Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Technologies used for accounting

A

Syslog servers : aggregate logs from various network devices and systems

Network analysis tools : like wireshark capture and analyze network traffic

SIEMs : Security Information and Event Management : real-time analysis of security alerts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

6 Types of Security Control

A
  1. Preventative control
  2. Deterrent Controls : warning
  3. Detective Controls : detect and alert
  4. Corrective Controls : address issue after they arise
    5/ Compensating Controls : alternative
  5. Directive Controls : dictate specific action
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Methods to achieve integrity

A

checksums: method to verify integrity of data during transmission.

Access Control: only authorized individuals can modify data.

Regular Audits: review logs and operations.

Hashing: process of converting data into fixed size values.

Digital Signature: uses encryption to ensure integrity and authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Integrity is important for three main reasons

A

■ To ensure data accuracy
■ To maintain trust
■ To ensure system operability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How to achieve Confidentiality

A

Encryption: convert data to code

Access Control: authorized personnel only access certain data

Data masking: obscuring data with in database

Physical Security

Training and awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

CIA triad

A

Basis for the development of Security

confidentiality : making sure data is kept secret or private.

Integrity : making sure data is trustworthy and free from tempering.

Availability: make sure system is functioning and accessible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

CIANA

A

Confidentiality: safeguard
Integrity : not altered
Authentication : verification
Non -repudiation : proof
Authorization : access

27
Q

CIA triad

A

Basis for the development of Security

confidentiality : making sure data is kept secret or private.

Integrity : making sure data is trustworthy and free from tempering.

Availability: make sure system is functioning and accessible

28
Q

The Integrity of your data is maintained only if

A

the data is authentic, accurate, and reliable.

29
Q

Authentication Authorization, and Accounting (AAA)

A

security framework that controls access to resources, enforces policies, and audits usage

screening and keeping track of users activity while they are connected.

login -> privileges to access -> keep track

30
Q

Gap Analysis

A

process of evaluating the differences between an organization’s current performance and its desired performance

31
Q

Steps to conduct gap analysis

A
  1. define the scope of analysis( desired outcome)
  2. gather data on the current state of the organization (done through gather survey, interviews, forms of data collection)
  3. Analyze the data to identify the gaps ( where the organization’s current performance falls short)
  4. Develop a plan to bridge the gaps( change of process or system or other area of the organization).
    The plan should also include specific goal, objectives and timeline for achieving them.
32
Q

Type of Gap analysis

A
  1. Technical Gap Analysis : evaluating an organization’s current technical infrastructure and identifying where it falls short of technical capabilities required to fully utilize their security solution.
  2. Business Gap Analysis :evaluating an organization’s current business process and identifying where it falls short of the capabilities required to fully utilize their security solution.
33
Q

Zero Trust

A

Trust nothing and verify everything.
demand continuous verification happens for every transaction within our network regardless of where it came from.

34
Q

Type of planes to to create zero trust architecture

A
  1. Control plane
  2. Data plane
35
Q

What is control plane in zero trust architecture

A

refers to the overarching framework and set of components that are responsible for defining, managing, and enforcing the policies related to user and system access within an organization.

It provides a centralized way to dictate and control how, when, and where access is going to be granted
to ensure that only authenticated and authorized entities can access specific resources.

36
Q

What is Data plane in zero trust architecture

A

ensure policies and procedures are being properly executed.

37
Q

key elements in control plane in zero trust architecture

A

Adaptive identity: real-time validation that takes into account the user’s behavior, their device, their location, and other factors.

Threat scope reduction: limit our users’ access to only what they need for their work task because this drastically reduces the network’s potential attack surface.

Policy-driven access control: develop, manage, and enforce user access policies based on their roles and responsibilities.

Secured zones. isolated environments within a network that are designed to house sensitive data.

38
Q

Data Plane is consist of

A

subject/system: verify the authenticity to the individual or entity attempting to gain access.

policy engine cross-references: the access request with its predefined policies.

policy administrator: is an essential part of the Zero Trust model that’s going to be used to establish and manage the access policies.( dictates who gets access to what)

policy enforcement point: allow or restrict access and it will effectively act as a gatekeeper to the sensitive areas of your systems or networks.

39
Q

To learn from the different threat actors that are
attacking your network is to set up and utilize

A

deception and disruption technologies

40
Q

How to Outsmarting Threat Actors

A
  • deception and disruption technologies
  • Tactics, Techniques, and Procedures (TTPs): Specific methods and patterns of activities or behaviors associated with a
    particular threat actor or group of threat actors
41
Q

What Deceptive and Disruption Technologies

A

Technologies designed to mislead, confuse, and divert attackers from critical assets while simultaneously detecting and neutralizing threats

42
Q

Deception and disruption
technology

A
  • Honeypot
  • Honeynet
  • Honeyfile
  • Honeytoken
43
Q

Honeypots

A

● Decoy system or network set up to attract and deceive attackers

44
Q

Honeynets

A

● Network of honeypots to create a more complex system that is designed to mimic an entire network of systems
○ Servers
○ Routers
○ Switches

45
Q

Honeyfiles

A

● Decoy files placed within a system to detect unauthorized access or data breaches

46
Q

■ Honeytokens

A

● Fake data to alert administrators when accessed or used

47
Q

Some disruption technologies and strategies

A

■ Bogus DNS entries : Fake Domain Name System entries introduced into your system’s DNS
server

■ Creating decoy directories : Fake folders and files placed within a system’s storage

■ Dynamic page generation: Effective against automated scraping tools or bots trying to index or steal content from your organization’s website

■ Use of port triggering to hide services
● Port Triggering: Security mechanism where specific services or ports on a network
device remain closed until a specific outbound traffic pattern is
detected

■ Spoofing fake telemetry data: When a system detects a network scan is being attempted by an attacker, it can be configured to respond by sending out fake telemetry or network
data

48
Q

Physical securities

A
  • Bollards
  • Access control vestibule
  • Fencing
  • Video surveillance
  • Security guard
  • Access badge
  • Lighting
  • Sensors
    o Infrared
    o Pressure
    o Microwave
    o Ultrasonic
49
Q

what is a Physical Security ?

A

■ Measures to protect tangible assets (buildings, equipment, people) from harm or
unauthorized access

50
Q

Bollards

A

○ Short, sturdy vertical posts controlling or preventing vehicle access

51
Q

Fences

A

○ Barriers made of posts and wire or boards to enclose or separate
areas

52
Q

what is a Surveillance System and the categories?

A

● An organized strategy to observe and report activities

● Components
○ Video surveillance
Security guards
○ Lighting
○ Sensors
- Security Guards

53
Q

Access Control Vestibules

A

● Double-door system electronically controlled to allow only one door open
at a time
● Prevents piggybacking and tailgating

54
Q

kind of Door Locks

A

● Padlocks : Easily defeated and offer minimal protection

● Pin and tumbler locks
● Numeric locks
● Wireless locks
● Biometric locks

● Cipher locks : Mechanical locks with numbered push buttons, requiring a correct combination
to open. commonly used for server rooms

● Electronic access control systems

55
Q

Modern Electronic Door Locks Authentication Methods

A
  • Identification Numbers
  • Wireless Signals: e NFC, Wi-Fi, Bluetooth, or RFID for unlocking
  • Biometrics : Biometrics
56
Q

Biometric Challenges

A

● False Acceptance Rate (FAR)
○ Occurs when the system erroneously
authenticates an unauthorized user
○ Lower FAR by increasing scanner sensitivity

● False Rejection Rate (FRR)
○ Denies access to an authorized user.
Adjusting sensitivity can increase FRR

● Crossover Error Rate (CER)
○ A balance between FAR and FRR for optimal
authentication effectiveness

57
Q

Video Surveillance Can include the following.

A

○ Motion detection
○ Night vision
○ Facial recognition

58
Q

Sensors

A

Devices that detect and respond to external stimuli or changes in the
environment

59
Q

categories of sensors

A

○ Infrared Sensors:
■ Detect changes in infrared radiation that is often emitted
by warm bodies like humans or animals

Pressure Sensors
■ Activated whenever a specified minimum amount of
weight is detected on the sensor that is embedded into the
floor or a mat

○ Microwave Sensors
■ Detect movement in an area by emitting microwave pulses
and measuring their reflection off moving objects

○ Ultrasonic Sensors
■ Measures the reflection of ultrasonic waves off moving
objects

60
Q

Access Control Vestibules

A

■ Double-door system that is designed with two doors that are electronically
controlled to ensure that only one door can be open at a given time

help prevent piggybacking and tailgating.

61
Q

Piggybacking

A

● Involves two people working together with one person who has
legitimate access intentionally allows another person who doesn’t have
proper authorization to enter a secure area with them

62
Q

Tailgating

A

● Occurs whenever an unauthorized person closely follows someone
through the access control vestibule who has legitimate access into the secure space without their knowledge or consent

63
Q

Badges contains

A

● RFID (Radio-Frequency Identification)
● NFC (Near-field Communication)
● Magnetic strips

Security+ (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions