Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

BEC IV > 5. Logical and Physical Access Control > Flashcards

5. Logical and Physical Access Control Flashcards

1
Q

Logical access control: what is often used to manage?

A

Logical access control software: by function or application, who can read, copy, write, create update, delete, execute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Logical access control: what kind of proof is used for user authentication?

A
  • Proof by knowledge: passwords
  • Proof by knowledge and possession: security tokens/credit cards
  • Proof by physical identifier: biometric controls (thumbprint, retina patterns, voice-print, face)
  • Proof by mannerism/context: touch on the keyboard, time of system use
  • Multi-factor authentication: multiple authentication procedures - highly secure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Logical access control: Password (knowledge): how good are they? How are they need to be?

A
  • Not so good authentication system.
  • Need to be strong (i.e. impossible to remember - use password manager?): eight or longer characters, include upper/lower case letters, one numeral and one special character, change periodically (every 3 months?)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Logical access control: Password: what is an effective control?

A

Standard: lockout after 3 failed attempts with reset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Logical access control: what is security token?

A

One-time password (device displays; user inputs device password, user ID and account password) - e.g. new password: generate every 30-60 seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Logical access control: what are smart cards and identification badges?

A

Embedded identification information read by card reader

e.g. credit card chip

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Logical (electronic) access control: what does user authorization matrix do?

A

Define user’s access rights based on role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Logical access control: what makes security (challenge) questions good?

A

Safe, memorable, stable, definitive.

Should not use something people could easily search for.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Logical access control: what are 3 kinds of firewall?

A

NAP: Network, Application, Personal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Logical access control: what is and does firewall do?

A

Prevent and detect unauthorized access.
Hardware and/or software to review and filter network traffic.
e.g. block noncompliant data packets based on set parameters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Logical access control: what is and does network firewall do?

A

On a network (e.g. server).

  • Filters data packets based on header info (source and destination IP address and communication port)
  • Blocks noncompliant transmission based on rules in access control list
  • Very fast (examine headers only)
  • Forward approved packets to application firewall
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Logical access control: what is application firewall?

A
  • Inspect data packet contents

* Can perform deep packet inspection (detailed packet examination)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Logical access control: what is personal firewall?

A

Software enabling end-users to block unwanted network traffic.
Usually on a home network or computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Logical access control: what is IDS? What does it do?

A

Intrusion Detection Systems.

*Monitors network for anomalies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Logical access control: IDS: what are 3 identification methods?

A
  • Signature-based: stored patterns/sources
  • Statistical-based: unusual activity - modeling
  • Neural networks: learns from created database
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Logical access control: what is IPS? Example?

A

Intrusion Prevention Systems - allows identification and blocking from live systems
E.g. honeypot/honeynet: allow hackers access to a decoy system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are IT facilities?

A
  • Computer hardware (CPUs, disk and tape drivers, printers, communications devices, etc)
  • Software (program files)
  • Data files
  • Computing infrastructure (network communication media and devices) computing rooms and buildings in which they reside
18
Q

What does IT facility control?

A

General controls

  • Some preventative controls: e.g. restricting access to IT dept
  • Some corrective controls: e.g. program and data backup, disaster recovery
19
Q

What are power system risks?

A
  • Failure (blackout)
  • Reduced voltage (brownout)
  • Sags, spikes, surges
  • Electromagnetic interference (EMI)
20
Q

What are environmental (physical location) controls?

A
  • Alarm control panel
  • Water and smoke detectors
  • Climate control, humidity
  • Fire extinguishers
  • Manual fire alarms
  • Uninterruptible power supply
21
Q

Physical location controls: fire suppression system: What are needed?

A

Fire suppression systems appropriate for electrical fires *chemical suppressor (halon no longer used) or water
*periodic maintenance

22
Q

Physical access controls: what must be done re: mainframe/large system?

A
  • Restrict access to programs, data files, and computer hardware (e.g. identification badges)
  • Additional restrictions: locks, keypad devices, access card readers, security personnel, and surveillance
  • Secrecy: Keep IT facilities location private
23
Q

Logical access controls: what are system penetration risk?

A
  • “Social engineering”: seek access by tricking employees

* May be conducted by “white” hackers (those hired by other companies) or “black” hackers (criminals, etc)

24
Q

Physical/logical access control: what is physical access risks and responses?

A

Piggybacking = unauthorized user follows and uses authorized user credentials
Response: restricted it by electronic/logical access controls (in a computer lab), physical controls (computer room)

25
Q

Security: What can be done to secure physical access?

A
  • Magnetic disks and tape protection
  • Set file attributes
  • Use software to restrict, record, read, write, update
26
Q

What is encryption? What is the process of reversing encryption called?

A

The process of converting a plaintext message into a secure-coded form (cipher text).
Decryption (to read a message).

27
Q

Why is encryption needed?

A
  • Protect stored or transmitted data

* Verify authenticity of data

28
Q

Encryption: what are essential elements?

A
  • Encryption algorithm: math function
  • Encryption keys: device or code that makes the message unique. Needed to encrypt or decrypt. Begins with an input or parameter. Device encryption (e.g. on a laptop, smart phones). Longer keys are, slower, but harder to crack
29
Q

Encryption: how does it work? What does it facilitate?

A 
Algorithm makes information (called plaintext) unreadable (called ciphertext) except to those with a key.
Facilitates privacy (protect from unauthorized access) and authentication (user identification).
30
Q

Encryption: what is symmetric encryption?

A

Single-key (1 key) or private key encryption.

  • One algorithm to encrypt and decrypt
  • Sender create and sends ciphertext, tells which algorithm (key)
  • Receiver reverses process
  • Most common: data encryption standard (DES-old) and AES (advanced encryption standard-better)
31
Q

Encryption: symmetric encryption: what are advantages? Problem?

A

A: Fast, simple and easy. Common in storage archives (i.e. data at rest).
P: If sending a message, then sender must communicate algorithm - how? what if intercepted?

32
Q

Encryption: what is Asymmetric Encryption?

A

2 keys: also called Public/private encryption.
Paired algorithms
*One to encrypt, one to decrypt
*If public key used to encrypt, private key used to decrypt. Vice versa (usually receiver uses private key)
Safe, but more complicated (slower).
Common in sending of messages (i.e. data in transit)

33
Q

Encryption: what must be a part of encryption? What are other controls that must accompany for stronger security?

A

Comprehensive strategy to achieve confidentiality and security.

  • Access controls and strong authentication techniques
  • Limiting user actions (read, write, change, delete, copy, etc) when accessing confidential info
34
Q

Encryption: what is the phenomenon called with hackers?

A

An “arms” raise with hackers.

35
Q

Encryption: what are emerging strategies?

A
  • “Honey” encryption - wrong guesses about encrypting key yield falsified data that looks correct (but isn’t)
  • Quantum encryption where data are encrypted using the Alice-in-Wonderland-like qualities of quantum computers
36
Q

What is digital certificate?

A
  • Electronic document that contains info.
  • Purpose: provide legally recognized identity and create secure communication.
  • Use public/private key technology
37
Q

What is certificate or certification authority (CA)?

A
  • Created by Microsoft
  • Use asymmetric keys
  • To acquire key pair, user applies for CA - CA registers public key on server and sends private key to user (additional layer of approval to get key).
38
Q

What is digital signature? Weakness?

A
  • Facilitate secure exchanges (e.g. E-commerce)
  • Use public/private key pair to authenticate sender
  • Provide nonrepudiation (audit trail - can’t say he didn’t do)
  • Weakness: public/private key pair can be acquired without verification
39
Q

What are 3 forms of secure internet transmissions protocols? What do they use?

A

*SSL (Secure Socket Layer)
*S-HTTP (Secure Hypertext Transport Protocol)
*SET (Secure Electronic Transactions) Protocol
Asymmetric keys

40
Q

What is a key?

A

A combination of an encryption algorithm and a decryption algorithm.

41
Q

What is VPN?

A

Virtual private network.
*a secure way to create an encrypted communication tunnel to allow remote users secure access to a network. *uses authentication to identify users and encryption to prevent unauthorized users from intercepting data.

BEC IV (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions