1.4-2.2 Flashcards
tpm
trusted platform module. cryptographic processor, random number generator, key generator. password protected
hsm
hardware security module. high end cryptographic hardware, stores thousands of crypto keys. used for multiple devices or in large environments.
key management system
on premises or cloud based. manage from a centralized manager(third party software) all key from one console.
secure enclave
the tpm for mobile devices. does all encryption and other security features.
obfuscation
process of making something unclear. how receipts only give last 4 of credit card
steganography
concealed writing. message is invisible. invisible watermarks
audio steganography
modify the digital audio file, secret message within the audio.
video steganograpy
a sequence of images, use image steganography on a larger scale.
tokenization
replace sensitive data with a non sensitive placeholder. ssn 111-12-1111 is now 235-45-4581
data masking
data obfuscation, may only be hidden from view, control the view based on permissions.
collision
different inputs create same hash
salting
random data added to a password when hashing.
blockchain
a distributed ledger, keep track of transactions with inherent security options.
Open public ledger
A public ledger is an open-access network; anyone can join at any time. The public ledger is fully decentralized, and no single entity controls the blockchain network.
self signed
Internal certificates don’t need to be signed by public CA. Build your own CA.
root of trust
inherently trusted component. trusted from someones elses.
certificate signing requests
send your public and private key with your identifying info. to the CA to be signed that is the (Certificate Signing Request, (CSR))
The CA validates the request
CA digitally signs the certificate with their private key.
wildcard certificates
allows a certificate to support many different domains.
threat actors
the entity responsible for an event that has an impact on the safety of another entity.
what are attributes of threat actor
internal/external
resources/funding
level of sophistication/capability
nation states
external entity
-govt and national security.
hacktivist
a hacker with a purpose.
-motivated by philosophy, revenge
organized crime
professional criminals.
-motivated by money
-Very sophisticated
shadow IT
going rogue
-working around the internal IT organization
-builds their own infrastructure.
threat vectors
method used by attacker to gain access or infect target.
file based vector
adobe pdf, zip/rar, microsoft office
vulnerable software vectors
client-based. such as an -infected executable, or known or unknown vulnerabilities
agentless- meaning the attacker would infect the server
msps
managed service providers.
smishing
sms phishing
vishing
voice phishing
