2.1 What is InfoSec Flashcards
Defining Security: Security involves :
*
protecting assets from various threats, including cyberattacks and natural disasters, with a focus on the most likely risks.
Types of Assets: Assets can be ______________or _____________ and both types require protection.
*
physical (like hardware) or intangible (like data),
Value: In modern computing environments, _____________________ often hold equal or greater value than physical assets.
*
logical assets (data and intellectual property)
Definition of Information Security: Information security is about __________________________.
*
safeguarding information systems from unauthorized access and misuse.
Security vs. Usability: A secure system may be impractical; increasing security typically reduces __________, necessitating a balance between the two.
*
productivity;
Cost vs. Value in Security: Security measures should be _________________ to the value of the asset being protected; excessive security for low-value items is inefficient.
*
proportional
Defining Security Levels: Determining when a system is ______________ is complex; no single measure guarantees complete security.
*
secure
Identifying Insecurity: Examples of insecure practices include failing to apply _____________ or _______________; recognizing these helps mitigate risks.
*
updates or using weak passwords
Legal Standards for Security: _________ ___________ for security vary by industry and country; organizations must comply with relevant laws to avoid violations.
*
Legal frameworks
Regulatory Examples: Specific regulations like _________ and __________ provide guidelines for what constitutes adequate security in various sectors.
*
PCI DSS; HIPAA
Models for Security Discussion: Having models like the CIA triad helps ______________ discussions around security concepts among professionals.
*
standardize
CIA Triad Explanation: The CIA triad—______________ __________ ____________—serves as a foundational model for understanding information security.
*
confidentiality, integrity, and availability
: ______________ involves protecting data from unauthorized access through various means at different levels.
*
Confidentiality
______________ ensures that data remains unchanged except by authorized users; mechanisms like permissions help maintain this principle.
*
Integrity
______________ ensures data is accessible when needed; disruptions can arise from various issues like attacks or system failures.
Availability
*
CIA Triad Application: The CIA triad aids in ___________________ by highlighting potential breaches in confidentiality, integrity, or availability.
*
analyzing specific security incidents
The ______________expands on the CIA triad by including possession/control, authenticity, and utility for a more comprehensive understanding of security.
*
Parkerian hexad
This principle focuses on the _________________of data storage media and its implications for _____________ and ______________.
*
physical control ; confidentiality and integrity.
______________ verifies that data originates from the correct source; _________________ can help enforce this principle.
*
Authenticity - digital signatures
____________ assesses how useful data is; it varies based on context and can impact how effectively data serves its purpose.
*
Utility
Application of Models in Security Discussions: Both the __________ and __________________ provide frameworks for discussing potential security failures and necessary controls.
*
CIA triad , Parkerian hexad
Types of Attacks Overview: Attacks can be categorized into __________, _____________, _____________, and _____________, affecting different aspects of the CIA triad.
*
interception; interruption; modification; fabrication
________________allows unauthorized access to data and primarily threatens _______________ through methods like eavesdropping or unauthorized file access.
*
Interception; confidentiality
_______________ refers to stored data not currently being transferred, while______________is actively being transmitted; both require _______________.
*
Data at rest; data in motion ; protection measures like encryption.
__________ attacks make assets unavailable or unusable, impacting ______________ primarily but potentially affecting __________ as well.
*
Interruption; availability; integrity
____________________ attacks involve unauthorized changes to data or systems, threatening both __________ and __________ depending on context.
*
Modification; integrity; availability
______________ involves creating false data or processes that compromise ____________ and may affect _____________ through resource consumption.
Fabrication; integrity; availability
- ______________ are potential sources of harm specific to certain environments; understanding them is crucial for effective risk management.
*
Threats
___________________ are weaknesses that threats can exploit; identifying them is essential for assessing risk levels in any environment.
*
Vulnerabilities
____________ arises when there is both a threat and a corresponding vulnerability; it quantifies the likelihood of an adverse event occurring.
*
Risk
Considerations in Risk Assessment: Some organizations consider _________ alongside risk to evaluate the potential consequences based on asset value during threat assessments.
*
impact
Risk Management Overview: Risk management involves _____________ __________, assessing ____________and _____________, and implementing measures to ________ ___________ effectively.
*
identifying assets; threats and vulnerabilities, mitigate risks
Identifying Assets Importance: Knowing what assets need protection is crucial; this task can become __________ in larger organizations with diverse hardware and software environments.
*
Identifying Assets Importance: Knowing what assets need protection is crucial; this task can become complex in larger organizations with diverse hardware and software environments.
Identifying Threats Process: After identifying critical assets, organizations must ____________potential threats using _________________ for clarity.
Identifying Threats Process: After identifying critical assets, organizations must assess potential threats using established models like the CIA triad or Parkerian hexad for clarity.
___________ assessment must consider relevant threats; not all ________________ pose equal risk based on their context within an organization’s operations.
*
Assessing Vulnerabilities Contextually: Vulnerability assessment must consider relevant threats; not all vulnerabilities pose equal risk based on their context within an organization’s operations.
Evaluating _________ involves linking identified threats with corresponding vulnerabilities to determine _________ effectively.
*
risks; overall risk levels
________________—physical, logical, and administrative—is essential for addressing identified risks associated with threats and vulnerabilities.
*
Implementing controls
_____________ safeguard environments where systems operate; they include barriers like locks and guards that prevent unauthorized access to sensitive areas.
*
Physical controls
_____________ protect systems through technical measures such as encryption and access controls that prevent unauthorized activities within networks.
*
Logical controls
__________________consist of policies governing user behavior; their effectiveness relies on enforcement mechanisms to ensure compliance across the organization.
*
Administrative controls
_____________________ are crucial for managing unexpected events efficiently; preparation helps ensure effective action during real incidents.
*
Incident response plans
The incident response process includes______________, ___________, ____________, _____________, _____________, and post-incident activity phases for comprehensive management of incidents.
*
preparation; detection/analysis, containment; eradication; recovery;
_____________ involves creating policies and training personnel ahead of incidents to enhance response effectiveness when emergencies arise.
*
Preparation
__________ and _____________Phase Explained: This phase focuses on identifying incidents using tools like IDS or antivirus software while combining automated analysis with human judgment for accurate evaluation.
*
Detection and Analysis
: ____________ aims to limit damage during an incident by isolating affected systems or implementing measures to prevent further harm from ongoing attacks.
*
Containment
Eradication Phase Actions: Eradication involves removing __________ or other threats from affected systems while ensuring that similar issues do not recur across the environment during recovery efforts.
*
malware;
____________ Phase Challenges: ___________ entails restoring systems to their previous state post-incident; it can be complex due to uncertainties about backup integrity or missing components during restoration efforts.
*
Recovery; Recovery
Conducting ________________ helps organizations learn from events by analyzing causes and implementing improvements to prevent future occurrences effectively.
*
post-incident reviews
______________involves creating multiple layers of defense against attacks; this strategy aims to __________ _________long enough for effective response actions to be initiated if breaches occur.
*
Defense in depth , delay attackers
Effective________ ___________ should include protections at various levels—external network, internal network, host systems, applications, and data—to create robust barriers against potential intrusions.
*
defense strategies
While defense in depth enhances security __________ against attacks, it cannot guarantee______________ ____________; its goal is timely _____________ rather than absolute immunity from breaches.
*
resilience; complete prevention; detection
Password Management Strategies: Implementing strong password policies can_____ ____________ security by making it challenging for attackers to compromise accounts through _____ ____________ methods over time if complexity requirements are enforced consistently across users’ accounts
significantly enhance; brute force
What is Identity Proofing? 3x
- Not the same as authentication.
- Before you give out credentials, you “Identity Proof” somebody.
- Validates someone’s identity before credentials are issued
o Driver’s License, Passport, etc
