3 - Secure data management Flashcards

1
Q

States of data

A
  • At rest
  • In transit
  • In Use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Database vulnerabilities

A
  • Misconfiguration
  • Lack of training
  • Buffer overflows
  • Forgotten Options
  • Unused stored procedures
  • Service account privilege issues (minimum)
  • Weak or poor authentication methods enabled
  • No or limited auditing
  • Lack of input validation etc
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Buffer overflows

A

Crashing server by storing big thing in small place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Forgotten options

A

Weak documentation/redundancy of staff etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Error log

A

Store any errors that occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Access Log

A

Store any attempts to access the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Lack of input validation

A

Santise data in input fields before saving. Never trust the user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Passive Threats

A

Threat to confidentiality
- Unauthorised person may listen to sensitive comms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Active Threats

A

Threats to integrity
- Unauthorised person may alter/delete information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cryptanalysis

A
  • Hacker tries to work out what encrypted information means
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Apps for locating databases on the network

A
  • SQLPing 3.0
  • SQLRecon
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Denial of Service

A

Intended to make data server unavailable/unable to respond to requests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Distributed DoS

A

Uses lots of systems to conduct a Denial of Service attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SQL Injection

A

Exploit “holes” in a Web application to run rogue SQL commands.

Done by placing special characters into existing SQL commands to achieve desired results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Avoiding SQL Injection

A
  • Validating user input
  • Input sanitisation
  • Hashing & encrypting data
  • Execute only with an account with least privilege
  • Avoid error messages containing valuable data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Backdoor

A

Runs in a hidden process to give attacker port to connect to this system.

  • Can do basically everything, especially with admin privileges.
17
Q

Ransomware

A

Locks up a PC etc for a price.

18
Q

Cloud Computing Security Issues

ARL

A
  • Availability (must be available)
  • Reliability
  • Loss of control
19
Q

Misconfiguration Risks

A
  • Steal server info
  • Run scripts
  • Excecute remotely
  • Enumerate servers
  • Denial of serviceN
20
Q

Network based risks

A
  • Attacker capturing network traffic etc
21
Q

Client Side risks

A
  • Risks that affect the user’s system directly
22
Q

Key

A

bigger key = better, 1025bit min

23
Q

Symmetric Encryption

A

Shared key - one key

Relies on secrecy of key

24
Q

Asymmetric Encryption

A

Public key encryption - two keys

25
Signatures
Encrypt with private key. Decrypt with public key and matches received message (see cryptography for better details)
26
Hashing
Function used for integrity assurance. Downloaded file's hash should match the expected hash but working out the plaintext from a hash is very difficult.
27
Asymmetric encryption problems (about the public key in particular!)
_ Ownership of the public key does not guarantee authenticity - Having to revoke keys if compromised - No way of proving that a Public Key belongs to Alice
28
Digital Certificates
Used to auth users and provide non-repudiation. Alcie sends request to CA with identity proof and public key. CA verifies ID then creates, signs and sends certificate