Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSCI 467 > 467_Flashcards > Flashcards

467_Flashcards

1
Q

What is malware as defined by NIST 800-83?

A

A program inserted into a system, usually covertly, to compromise confidentiality, integrity, or availability of data, applications, or operating systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an Advanced Persistent Threat (APT)?

A

A well-resourced, persistent attack using various technologies and malware, often state-sponsored, targeting specific businesses or political entities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the main classifications of malware propagation mechanisms?

A

Infected content (viruses), vulnerability exploit (worms), and social engineering (spam emails, Trojans).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a virus?

A

Malware that replicates itself into executable code and propagates when the infected code is executed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a worm?

A

A program that spreads independently by exploiting vulnerabilities and often carries a payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a Trojan horse?

A

Malware that appears legitimate but contains harmful hidden functionality, such as spyware or keyloggers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are botnets used for?

A

Activities such as DDoS attacks, spamming, sniffing sensitive data, and installing additional malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is ransomware?

A

Malware that encrypts user data and demands payment for the decryption key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a logic bomb?

A

Code that triggers a payload when specific conditions are met.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the difference between a rootkit and a backdoor?

A

A rootkit hides its presence and provides admin access, while a backdoor is an entry point bypassing security checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a phishing attack?

A

A social engineering attack where victims are tricked into revealing sensitive information by mimicking trusted sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a macro virus?

A

A virus that uses macro or scripting code in documents to execute and spread.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a drive-by-download attack?

A

Malware installation through a compromised website without user consent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the four generations of anti-virus software?

A

1) Signature-based scanners, 2) Heuristic scanners, 3) Activity traps, 4) Full-featured protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is sandbox analysis?

A

Executing potentially malicious code in a controlled environment to analyze its behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a hash function?

A

A function that converts a variable-length input into a fixed-size output called a hash value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the key properties of a cryptographic hash function?

A

Preimage resistance, second preimage resistance, and collision resistance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is preimage resistance?

A

The property that makes it computationally infeasible to find an input x given its hash value h.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is collision resistance?

A

The property that makes it computationally infeasible to find two distinct inputs x and y such that H(x) = H(y).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the main application of a message digest?

A

To provide message authentication by verifying data integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a digital signature?

A

A mechanism where the hash value of a message is encrypted with a private key to ensure authenticity and integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are simple hash functions, and why are they insecure?

A

Functions like XOR-based hashing are prone to collisions and insufficient for secure applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the birthday paradox in the context of hash functions?

A

The probability of finding a collision is significant after approximately √2^m inputs for an m-bit hash value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the Secure Hash Algorithm (SHA)?

A

A family of cryptographic hash functions designed by NIST, including SHA-1, SHA-2, and SHA-3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Why was SHA-3 developed?

A

To provide a secure alternative to SHA-2 due to concerns about its structural similarity to SHA-1, which has vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the structure of SHA-3?

A

Based on a sponge construction, allowing flexibility in output size and security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are brute-force attacks on hash functions?

A

Efforts to find preimages, second preimages, or collisions by testing large numbers of inputs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a hash-based pseudorandom function (PRF)?

A

A function using a hash to generate pseudorandom values, often for key generation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the significance of the S-box in SHA-2 and SHA-3?

A

Provides nonlinearity to resist cryptanalytic attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How is a hash function used in password storage?

A

Passwords are hashed, and the hash is stored. Verification is done by comparing the stored hash with the hash of the entered password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does RSA stand for?

A

Rivest-Shamir-Adleman, the developers of the algorithm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the purpose of public-key cryptography?

A

To provide secure communication and digital signatures without relying on a trusted key distribution center.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the six components of a public-key cryptosystem?

A

Plaintext, encryption algorithm, public key, private key, ciphertext, decryption algorithm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is a trap-door one-way function?

A

A function that is easy to compute but infeasible to invert without special knowledge (the trap-door).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the basic requirements for a public-key algorithm?

A

Easy to generate key pairs, encrypt with the public key, decrypt with the private key, and infeasible to derive private key from public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the mathematical basis of RSA encryption?

A

C = M^e mod n, where C is ciphertext, M is plaintext, e is the public exponent, and n is the modulus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the prime factors of n in RSA used for?

A

They are used to compute the private key through the totient function ø(n).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are the common attacks on RSA?

A

Brute force, mathematical attacks, timing attacks, hardware fault-based attacks, chosen ciphertext attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How does RSA use the Chinese Remainder Theorem (CRT)?

A

To speed up decryption by breaking calculations into smaller moduli.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is a common public exponent used in RSA?

A

e = 65537, because it has only two 1 bits, minimizing computational overhead.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the countermeasure for timing attacks on RSA?

A

Using constant exponentiation time, adding random delays, or blinding ciphertexts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is Optimal Asymmetric Encryption Padding (OAEP)?

A

A procedure to add random padding to plaintext to prevent chosen ciphertext attacks on RSA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are the applications of public-key cryptosystems?

A

Encryption/decryption, digital signatures, and key exchange.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the main advantage of public-key cryptography over symmetric encryption?

A

Key distribution is simpler as the public key can be shared openly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What does AES stand for?

A

Advanced Encryption Standard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the block and key sizes for AES?

A

Block size: 128 bits. Key sizes: 128, 192, or 256 bits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the structure of AES?

A

Processes data as a 4x4 matrix (State array) through multiple rounds of substitution and permutation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What are the four main transformation functions of AES?

A

SubBytes, ShiftRows, MixColumns, AddRoundKey.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is the purpose of the SubBytes transformation?

A

It substitutes each byte in the State using an S-box designed for cryptographic strength.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What does the ShiftRows transformation do?

A

Performs a cyclic shift of the rows in the State matrix to ensure diffusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the MixColumns transformation?

A

A column-wise mixing operation that combines the bytes in each column of the State matrix.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the AddRoundKey transformation?

A

Performs a bitwise XOR between the State matrix and a round key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

How does AES decryption differ from encryption?

A

Decryption uses inverse transformations and applies the round keys in reverse order.

54
Q

What is the S-box used for in AES?

A

A 16x16 matrix designed to provide nonlinearity and resistance to cryptanalytic attacks.

55
Q

What is the role of the Key Expansion in AES?

A

Generates round keys from the initial key using transformations like RotWord and SubWord.

56
Q

What is the Avalanche Effect in AES?

A

A small change in plaintext or key results in a significant change in ciphertext.

57
Q

Why was AES selected as a standard?

A

Efficiency, security, and its ability to be implemented on various hardware and software platforms.

58
Q

What is the equivalent inverse cipher in AES?

A

A decryption cipher that mirrors the encryption structure with inverse transformations.

59
Q

What is a block cipher?

A

A cipher that processes a fixed-size block of plaintext to produce a ciphertext block of the same size.

60
Q

What are the advantages of larger block sizes in block ciphers?

A

Greater security but reduced encryption/decryption speed.

61
Q

What is a Feistel cipher?

A

A cipher that alternates substitutions and permutations to achieve confusion and diffusion.

62
Q

What is the Data Encryption Standard (DES)?

A

A symmetric encryption algorithm that encrypts data in 64-bit blocks using a 56-bit key.

63
Q

What are the main phases of DES encryption?

A

1) Initial permutation, 2) 16 rounds of substitution and permutation, 3) Final permutation.

64
Q

How is decryption performed in DES?

A

Using the same algorithm as encryption but with the subkeys applied in reverse order.

65
Q

What is the Avalanche Effect in DES?

A

A small change in plaintext or key results in significant changes in ciphertext.

66
Q

What is the Strict Avalanche Criterion (SAC)?

A

Every output bit should change with a 50% probability when a single input bit is inverted.

67
Q

What is the Bit Independence Criterion (BIC)?

A

Output bits should change independently when any single input bit is inverted.

68
Q

What are timing attacks?

A

Attacks that attempt to determine keys by observing the time taken to perform cryptographic operations.

69
Q

What is the purpose of the subkey generation algorithm in block ciphers?

A

To make deducing individual subkeys and working back to the main key difficult.

70
Q

What is the main limitation of DES?

A

Its 56-bit key size makes it vulnerable to brute-force attacks.

71
Q

What replaced DES as the standard encryption algorithm?

A

The Advanced Encryption Standard (AES) in 2001.

72
Q

What is the key design feature of the Feistel cipher structure?

A

Alternating substitution and permutation functions to create secure encryption.

73
Q

What is plaintext?

A

The original, unencrypted message.

74
Q

What is ciphertext?

A

The coded version of the original message after encryption.

75
Q

What are the three main types of cryptographic systems?

A

Substitution, transposition, and symmetric/asymmetric key encryption.

76
Q

What is the Caesar cipher?

A

A substitution cipher that shifts each letter a fixed number of places in the alphabet.

77
Q

What is the main weakness of the Caesar cipher?

A

It is easily broken with brute-force as there are only 25 possible keys.

78
Q

What is a polyalphabetic cipher?

A

A cipher that uses multiple substitution alphabets for encryption.

79
Q

What is the Vigenère cipher?

A

A polyalphabetic substitution cipher using multiple Caesar ciphers determined by a keyword.

80
Q

What is the one-time pad?

A

An unbreakable cipher that uses a random key as long as the message and is used only once.

81
Q

What is the main limitation of the one-time pad?

A

The difficulty of generating and securely distributing large quantities of random keys.

82
Q

What is the Playfair cipher?

A

A cipher that encrypts pairs of letters using a 5x5 matrix constructed with a keyword.

83
Q

What is a transposition cipher?

A

A cipher that rearranges the order of letters in plaintext to create ciphertext.

84
Q

What is the Rail Fence cipher?

A

A simple transposition cipher where plaintext is written diagonally and then read row by row.

85
Q

What is the Row Transposition cipher?

A

A cipher that writes plaintext in a grid and reads it column by column in a permuted order.

86
Q

What is steganography?

A

The practice of hiding information within other non-secret text or data.

87
Q

What is the difference between encryption and steganography?

A

Encryption disguises the content of a message; steganography hides the existence of a message.

88
Q

What is the definition of an intrusion detection system (IDS)?

A

A system that gathers and analyzes information to identify possible security intrusions in a network or computer.

89
Q

What are the three components of an IDS?

A

Sensors to collect data, analyzers to determine intrusions, and user interfaces to view outputs or control behavior.

90
Q

What is the difference between HIDS and NIDS?

A

HIDS monitors host-specific activities like system calls; NIDS monitors network traffic for suspicious activity.

91
Q

What is the purpose of a honeypot?

A

To lure attackers away from critical systems, collect information on their activities, and give administrators time to respond.

92
Q

What is anomaly detection in IDS?

A

Analyzing current behavior against a model of legitimate user behavior to classify it as normal or anomalous.

93
Q

What is signature detection in IDS?

A

Matching known malicious patterns or attack rules with current behavior to identify threats.

94
Q

What is a distributed or hybrid IDS?

A

An IDS combining host-based and network-based sensors to analyze data centrally for better intrusion detection.

95
Q

What are the classes of intruders?

A

Cyber criminals, activists, state-sponsored organizations, and others like hobby hackers.

96
Q

What is a low-interaction honeypot?

A

A simulated environment emulating IT services well enough to detect and warn of imminent attacks.

97
Q

What is a high-interaction honeypot?

A

A real system with full operating environments that occupy attackers for extended periods.

98
Q

What are the advantages of machine-learning in anomaly detection?

A

Flexibility, adaptability, and ability to capture interdependencies between observed metrics.

99
Q

What is the Snort tool used for?

A

An open-source IDS for real-time packet capture, protocol analysis, and intrusion detection.

100
Q

What are examples of intruder behaviors during an attack?

A

Target acquisition, initial access, privilege escalation, maintaining access, and covering tracks.

101
Q

What are the three types of IDS analysis approaches?

A

Anomaly detection, signature detection, and heuristic detection.

102
Q

What is the role of Stateful Protocol Analysis (SPA) in IDS?

A

Comparing observed network traffic against vendor-supplied profiles of benign protocol traffic.

103
Q

What are the challenges of implementing IDS?

A

High resource use, high false positive rates, and difficulty adapting to dynamic network environments.

104
Q

What is the definition of a Denial-of-Service (DoS) attack according to NIST?

A

An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as CPU, memory, bandwidth, or disk space.

105
Q

What is a Distributed Denial-of-Service (DDoS) attack?

A

A DoS attack that uses multiple systems, often forming a botnet, to generate attacks on a target system or network.

106
Q

What are the three main categories of resources that could be attacked in a DoS attack?

A

Network bandwidth, system resources, and application resources.

107
Q

What is source address spoofing in the context of DoS attacks?

A

Using forged source addresses to make attacking systems harder to identify and trace.

108
Q

What is a TCP SYN flood attack?

A

A DoS attack that sends a large number of SYN packets to fill the table of known TCP connections on the server, preventing legitimate users from accessing it.

109
Q

What is an ICMP flood?

A

A ping flood attack using ICMP echo request packets to overwhelm network capacity.

110
Q

What is a DNS amplification attack?

A

A reflection-based attack that uses small DNS requests to generate large responses, overwhelming the target system.

111
Q

What are the four lines of defense against DDoS attacks?

A

1) Attack prevention and preemption, 2) Attack detection and filtering, 3) Attack source traceback and identification, 4) Attack reaction.

112
Q

What are reflection and amplification attacks?

A

Attacks where responses to spoofed requests are directed at the target, often using intermediaries to amplify the traffic volume.

113
Q

What is the Tribe Flood Network (TFN)?

A

An early DDoS tool capable of ICMP flood, SYN flood, UDP flood, and ICMP amplification attacks, used to obscure the path back to the attacker.

114
Q

What is an HTTP-based attack like Slowloris?

A

An attack that monopolizes server request handling threads by sending incomplete HTTP requests, eventually consuming all connection capacity.

115
Q

What are good practices to prevent DoS attacks?

A

Blocking spoofed addresses, managing application attacks with CAPTCHAs, using mirrored servers, and employing good system security practices.

116
Q

How should organizations respond to ongoing DoS attacks?

A

Identify the attack type, analyze packets, filter traffic upstream, and, if necessary, switch to backup servers or new addresses.

117
Q

What does NIST 800-83 define as malware?

A

A program inserted into a system, usually covertly, with intent to compromise data, applications, or OS integrity, confidentiality, or availability.

118
Q

What is an Advanced Persistent Threat (APT)?

A

Cybercrime targeting business/political entities using persistent intrusion technologies, often state-sponsored.

119
Q

What are the characteristics of an APT?

A

Advanced: custom malware; Persistent: sustained attacks over time; Threats: organized, well-funded attackers.

120
Q

Name two examples of early computer viruses.

A

Brain virus (1986) targeting MSDOS, and Chernobyl virus (1998), which overwrites hard drive data.

121
Q

What is the difference between a worm and a bot?

A

A worm propagates and activates itself; a bot requires remote control for activation and coordination.

122
Q

Describe the function of a rootkit.

A

Hides presence on a system by subverting monitoring mechanisms, giving attackers admin privileges.

123
Q

What is ransomware?

A

Malware encrypting user data, demanding payment for decryption keys.

124
Q

What are the four main elements of malware prevention?

A

Policy, Awareness, Vulnerability Mitigation, Threat Mitigation.

125
Q

What is clickjacking?

A

UI redress attack tricking users into clicking unintended actions, often using invisible frames.

126
Q

What is a watering-hole attack?

A

Highly targeted drive-by download where attackers compromise sites likely visited by their victims.

127
Q

What are the phases of a virus?

A

Dormant, Triggering, Propagation, Execution.

128
Q

What is a logic bomb?

A

Malware code triggered by specific conditions to execute its payload.

129
Q

How does sandbox analysis help in malware detection?

A

Runs potentially malicious code in an isolated environment to monitor behavior safely.

130
Q

Name two types of phishing attacks.

A

General phishing (mass emails) and spear-phishing (targeted emails crafted for specific recipients).

131
Q

What are the main types of malware propagation mechanisms?

A

Infected content (viruses), vulnerability exploit (worms), and social engineering (spam emails, Trojans).

132
Q

What is malvertising?

A

Using malicious ads to distribute malware without compromising the hosting site.

CSCI 467 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions